3 ms·

That drove me up the wall in Python so much - ALL the documentation just described how to put a massive library into a cookie cutter example and never explained

by izacus 4y ago

That drove me up the wall in Python so much - ALL the documentation just described how to put a massive library into a cookie cutter example and never explained how it's supposed to work so I could debug the darn thing.

znpy 4y ago
when it comes to this kind of things there's really no way around it: you're supposed to read the RFCs: - https://www.rfc-editor.org/rfc/rfc6749.html https://www.rfc-editor.org/rfc/rfc6749.html: The OAuth 2.0 Authorization Framework - https://www.rfc-editor.org/rfc/rfc6750.html https://www.rfc-editor.org/rfc/rfc6750.html: The OAuth 2.0 Authorization Framework: Bearer Token Usage
- asdfman123 4y ago
  As someone who is hired to sling out features as rapidly as possible, that’s not going to happen. I mean, you might say “but you should” or “it would actually help” or “in an ideal world…” but it is still, realistically, not going to happen.
  - sytringy05 4y ago
    Well hopefully someone has taken the time to, or there will be nasty surprises I certainly don't want people building security sensitive parts of an app to be slinging the features out.
  - znpy 4y ago
    > As someone who is hired to sling out features as rapidly as possible, that’s not going to happen. you do you, i guess. but that's where the source of truth about how oauth 2.0 works is. the "why" you're looking for it's in there.
  - deleted 4y ago
    [deleted]
- izacus 4y ago
  That doesn't explain what the library is trying to do and how it implements it though.
  - znpy 4y ago
    if the library is implementing oauth 2.0, that explains what the library is trying to do. how it's implemented... well that's an implementation detail, that most often one couldn't understand without the domain knowledge (unless it's something "trivial" like an off-by-one in some string comparison or something like that).
    - izacus 4y ago
      Yes, that "domain knowledge" is kinda important when you're trying to debug a blob of code that results in random permission errors after OAuth request. The "implementation details" are what we're tasked with implementing ;)
- paulddraper 4y ago
  The difference is that the RFC covers everything, whereas OAuth providers choose a subset of what they actually want to support. Search engine > Encyclopedia
Rapzid 4y ago
Asp.Net authentication is 10 times worse in this regard.
snapetom 4y ago
Not sure if they still do this, but when I first started learning, front and center of the documentation was telling you how to do it in a mobile app, then JS SPA app. The use case of a backend API+JS/mobile frontend was buried. And it was all stupidly named. It wasn't blatant like 1) MOBILE APP FRONTEND 2) JS APP FRONTEND 3) API BACKEND + FRONTEND. So for me, mobile wasn't relevant, SPA wasn't relevant, and my use case, the third one was hard to find.

by izacus 4y ago

znpy 4y ago

when it comes to this kind of things there's really no way around it: you're supposed to read the RFCs: - https://www.rfc-editor.org/rfc/rfc6749.html https://www.rfc-editor.org/rfc/rfc6749.html: The OAuth 2.0 Authorization Framework - https://www.rfc-editor.org/rfc/rfc6750.html https://www.rfc-editor.org/rfc/rfc6750.html: The OAuth 2.0 Authorization Framework: Bearer Token Usage

asdfman123 4y ago
As someone who is hired to sling out features as rapidly as possible, that’s not going to happen. I mean, you might say “but you should” or “it would actually help” or “in an ideal world…” but it is still, realistically, not going to happen.
- sytringy05 4y ago
  Well hopefully someone has taken the time to, or there will be nasty surprises I certainly don't want people building security sensitive parts of an app to be slinging the features out.
- znpy 4y ago
  > As someone who is hired to sling out features as rapidly as possible, that’s not going to happen. you do you, i guess. but that's where the source of truth about how oauth 2.0 works is. the "why" you're looking for it's in there.
- deleted 4y ago
  [deleted]
izacus 4y ago
That doesn't explain what the library is trying to do and how it implements it though.
- znpy 4y ago
  if the library is implementing oauth 2.0, that explains what the library is trying to do. how it's implemented... well that's an implementation detail, that most often one couldn't understand without the domain knowledge (unless it's something "trivial" like an off-by-one in some string comparison or something like that).
  - izacus 4y ago
    Yes, that "domain knowledge" is kinda important when you're trying to debug a blob of code that results in random permission errors after OAuth request. The "implementation details" are what we're tasked with implementing ;)
paulddraper 4y ago
The difference is that the RFC covers everything, whereas OAuth providers choose a subset of what they actually want to support. Search engine > Encyclopedia

Rapzid 4y ago

Asp.Net authentication is 10 times worse in this regard.

snapetom 4y ago

Not sure if they still do this, but when I first started learning, front and center of the documentation was telling you how to do it in a mobile app, then JS SPA app. The use case of a backend API+JS/mobile frontend was buried. And it was all stupidly named. It wasn't blatant like 1) MOBILE APP FRONTEND 2) JS APP FRONTEND 3) API BACKEND + FRONTEND. So for me, mobile wasn't relevant, SPA wasn't relevant, and my use case, the third one was hard to find.