4 ms·

How we rebuilt complex permissions without migrating to Zanzibar

73 points by FinnLobsien 23d ago

deleted 21d ago
[deleted]
warkdarrior 21d ago
[dead]
knob 21d ago
I thoroughly enjoyed this read. As it states at the beginning: rbac is necessary, yet not sexy. I don't use infiscal, yet this post was quite a good insight. Thanks for sharing it!
0x696C6961 21d ago
The https://casl.js.org/v7/en/ https://casl.js.org/v7/en/ link is dead edit: fixed now
Synthetic7346 21d ago
I think this is true of security features, and even security teams in general. Only noticed in their absence
jzelinskie 21d ago
I love reading posts like this because it shows that authorization isn't as niche as it once was. I also empathize with avoiding dependencies when you ship enterprise software for running on-prem; we abused Postgres a lot while serving enterprise customers for Quay before we founded AuthZed/SpiceDB. As an engineer it's your job to decide when is the right time to use a dedicated system or continue to invest in your own. I can't help but see the similarities in their design to concepts from Zanzibar/SpiceDB, and that's great! It also means if they ever do encounter a situation where the existing system is no longer viable (engineers leave or a new design constraint requires rethinking), they _can_ migrate to a dedicated solution easily. One trade-off I didn't see acknowledged in this post is the sacrifice in terms of tooling. Dedicated solutions have toolchains for debugging and proving correctness that you can integrate into CI/CD and homegrown solutions can't typically spare the time to also build themselves a nice toolchain.
- Shadowmist 21d ago
  Maybe they don’t like opt-out telemetry?
  - jzelinskie 20d ago
    If you are seriously considering SpiceDB and our approach to telemetry bothers you, please do us a favor and open a GitHub issue (or find an existing one if someone beats you to it) and include your perspective. We want to be respectful while also maintaining a feedback loop to be able to improve what people use. We do a lot more than I've seen others do to communicate when/when/how/why we collect and how to re-configure (off or collect it yourself) so those who wish to opt-out can immediately. If this is not the right balance or our solution is just entirely wrong, it's important for us to understand why and improve rather than alienating folks.
    - noir_lord 20d ago
      > We want to be respectful Make telemetry strictly opt-in then, that's really the only respectful way to do it. Everything else is sophistry. Not singling you out either, too many projects do it by default, yours at least makes it obvious here that you do and how to turn it off https://authzed.com/docs/spicedb/ops/observability#telemetry https://authzed.com/docs/spicedb/ops/observability#telemetry so kudos for not hiding it in the basement behind a "Beware of the Leopard" sign. For open source projects I just find it more offensive, I'd expect closed source projects to do it by default (but I expect less of them to start with) but for open source it rankles much more.
      - solatic 18d ago
        Not OP, but - You didn't explain why, in your opinion, opt-out is disrespectful; why respect requires opt-in. For most Western users, the bandwidth is hardly a drop in the bucket, and while there are certainly kinds of telemetry that are disrespectful of a user's privacy, telemetry in and of itself is not (in my opinion) abusive of user privacy, and therefore neither is opt-out abusive. Indeed, if you were to argue that telemetry violates user privacy, then opt-in (i.e. to help send bug reports) doesn't fix that. If you add a "send bug report" button, but the data collected in the bug report abuses the user's privacy, why is it ethically any better? The data collected is far more important than the frequency or control over how and when it's sent. Users who desire taking that control should anyway run their own restrictive, allowlist-based firewall, which no opt-in/opt-out setting can overcome anyway.
peterldowns 21d ago
But why not Zanzibar?
- phoghed 21d ago
  > That’s also because we didn’t migrate to a Zanzibar-style system like SpiceDB or OpenFGA. Adopting one would mean rewriting every permission check and asking every self-hosted customer to run another stateful service and introduce breaking changes.
bbkane 21d ago
Maybe it's because I'm not an RBAC expert, but I had a hard time understanding the data model for folders. Are they a subject? And then there's a layered CASL where layers overwrite each other? And the user is an actor?
sandeepkd 20d ago
From what I have seen this subject needs a lot more attention than what it receives which translates in the reality that in almost majority of the places the access rules are pretty open from inside. This is one area where centralization (using some solution like AuthZed) and decentralization (skipping the checks based on business domain locally) present this healthy tension which requires some one who has expertise on the business domain to make it work efficiently
- tyre 20d ago
  I believe this is a problem that Oso[0] was solving, but sadly it seems they pivoted to AI. [0]: https://www.osohq.com/ https://www.osohq.com/
quietraster 20d ago
[dead]
citizenpaul 20d ago
>The best case is no complaints and that the system is correct. It can never excel. There's no 10x RBAC system people rave about on Twitter. Access controls are a box a product checks, but not a killer feature. This reminded me of the tine i said something similar to teammate whom asked why our work always felt so bad. They Lost thier mind went off on some 20m rant and refused to talk to me for weeks and we were never on good terms again. I broke something in them i guess. They ultimately left thr tech industry. It was the first of a number of incidents in my life that I learned that there really are a certian set of people that cannot be told the truth. not really relevant but whatever it was a weird incident maybe that will entertain someobe

73 points by FinnLobsien 23d ago

deleted 21d ago

[deleted]

warkdarrior 21d ago

[dead]

knob 21d ago

I thoroughly enjoyed this read. As it states at the beginning: rbac is necessary, yet not sexy. I don't use infiscal, yet this post was quite a good insight. Thanks for sharing it!

0x696C6961 21d ago

The https://casl.js.org/v7/en/ https://casl.js.org/v7/en/ link is dead edit: fixed now

Synthetic7346 21d ago

I think this is true of security features, and even security teams in general. Only noticed in their absence

jzelinskie 21d ago

I love reading posts like this because it shows that authorization isn't as niche as it once was. I also empathize with avoiding dependencies when you ship enterprise software for running on-prem; we abused Postgres a lot while serving enterprise customers for Quay before we founded AuthZed/SpiceDB. As an engineer it's your job to decide when is the right time to use a dedicated system or continue to invest in your own. I can't help but see the similarities in their design to concepts from Zanzibar/SpiceDB, and that's great! It also means if they ever do encounter a situation where the existing system is no longer viable (engineers leave or a new design constraint requires rethinking), they _can_ migrate to a dedicated solution easily. One trade-off I didn't see acknowledged in this post is the sacrifice in terms of tooling. Dedicated solutions have toolchains for debugging and proving correctness that you can integrate into CI/CD and homegrown solutions can't typically spare the time to also build themselves a nice toolchain.

Shadowmist 21d ago
Maybe they don’t like opt-out telemetry?
- jzelinskie 20d ago
  If you are seriously considering SpiceDB and our approach to telemetry bothers you, please do us a favor and open a GitHub issue (or find an existing one if someone beats you to it) and include your perspective. We want to be respectful while also maintaining a feedback loop to be able to improve what people use. We do a lot more than I've seen others do to communicate when/when/how/why we collect and how to re-configure (off or collect it yourself) so those who wish to opt-out can immediately. If this is not the right balance or our solution is just entirely wrong, it's important for us to understand why and improve rather than alienating folks.
  - noir_lord 20d ago
    > We want to be respectful Make telemetry strictly opt-in then, that's really the only respectful way to do it. Everything else is sophistry. Not singling you out either, too many projects do it by default, yours at least makes it obvious here that you do and how to turn it off https://authzed.com/docs/spicedb/ops/observability#telemetry https://authzed.com/docs/spicedb/ops/observability#telemetry so kudos for not hiding it in the basement behind a "Beware of the Leopard" sign. For open source projects I just find it more offensive, I'd expect closed source projects to do it by default (but I expect less of them to start with) but for open source it rankles much more.
    - solatic 18d ago
      Not OP, but - You didn't explain why, in your opinion, opt-out is disrespectful; why respect requires opt-in. For most Western users, the bandwidth is hardly a drop in the bucket, and while there are certainly kinds of telemetry that are disrespectful of a user's privacy, telemetry in and of itself is not (in my opinion) abusive of user privacy, and therefore neither is opt-out abusive. Indeed, if you were to argue that telemetry violates user privacy, then opt-in (i.e. to help send bug reports) doesn't fix that. If you add a "send bug report" button, but the data collected in the bug report abuses the user's privacy, why is it ethically any better? The data collected is far more important than the frequency or control over how and when it's sent. Users who desire taking that control should anyway run their own restrictive, allowlist-based firewall, which no opt-in/opt-out setting can overcome anyway.

peterldowns 21d ago

But why not Zanzibar?

phoghed 21d ago
> That’s also because we didn’t migrate to a Zanzibar-style system like SpiceDB or OpenFGA. Adopting one would mean rewriting every permission check and asking every self-hosted customer to run another stateful service and introduce breaking changes.

bbkane 21d ago

Maybe it's because I'm not an RBAC expert, but I had a hard time understanding the data model for folders. Are they a subject? And then there's a layered CASL where layers overwrite each other? And the user is an actor?

sandeepkd 20d ago

From what I have seen this subject needs a lot more attention than what it receives which translates in the reality that in almost majority of the places the access rules are pretty open from inside. This is one area where centralization (using some solution like AuthZed) and decentralization (skipping the checks based on business domain locally) present this healthy tension which requires some one who has expertise on the business domain to make it work efficiently

tyre 20d ago
I believe this is a problem that Oso[0] was solving, but sadly it seems they pivoted to AI. [0]: https://www.osohq.com/ https://www.osohq.com/

quietraster 20d ago

[dead]

citizenpaul 20d ago

>The best case is no complaints and that the system is correct. It can never excel. There's no 10x RBAC system people rave about on Twitter. Access controls are a box a product checks, but not a killer feature. This reminded me of the tine i said something similar to teammate whom asked why our work always felt so bad. They Lost thier mind went off on some 20m rant and refused to talk to me for weeks and we were never on good terms again. I broke something in them i guess. They ultimately left thr tech industry. It was the first of a number of incidents in my life that I learned that there really are a certian set of people that cannot be told the truth. not really relevant but whatever it was a weird incident maybe that will entertain someobe