hirsin

19 ms·

241.
by hirsin 5y ago
Steps 2 and 3 are unrelated to the gallery. The gallery entry is basically a registered url that takes you to the app, to trigger a login (2) which triggers provisioning (3) in your tenant. So you can visit any app and add it to your tenant
242.
by hirsin 5y ago
Very much so the right person to ask! This is great to hear that there's a need for this. I think our mental model of a lot of enterprises is that "old code" stays SAML and new code (that isn't copy paste from old) is OI
243.
by hirsin 5y ago
Thanks for the feedback and experience! This is the difference between provisioning (adding an instance of an app to your tenant) and registration (Azure AD knowing your app exists). The pattern you're talking about is provisioning, an
244.
by hirsin 5y ago
If you want to federated eg AAD with Gsuite, it'll be via SAML, but I don't know of any consumer service that's ever supported SAML. It's so weird the author used Twitter when they were one of the classic original Oauth
245.
by hirsin 5y ago
The Enterprise Apps section is heavily SAML based, but if you want to look up how to write an app for AAD you won't likely find any SAML docs, you'll find the OIDC docs and oauth SDKs we build. If you see other places where you fe
246.
by hirsin 5y ago
This is inaccurate. Multi tenant apps can simply be signed into via OIDC and they're added to your tenant, if you allow it. All Microsoft apps use OIDC and are not allowed to use SAML, but SaaS app developers are not quite as far ahead
247.
by hirsin 5y ago
Getting people to believe error messages is surprisingly hard. "The server says I used the wrong certificate - what am I supposed to do here, what went wrong?". 9/10 times they used the wrong cert, and the rest of the time th
248.
by hirsin 5y ago
Maintenance cost likely scales with both size and cost. Size, for obvious reasons, and cost because the labor/materials cost of a repair is likely correlated with housing prices in the area. You then have to account for the portion of
249.
by hirsin 5y ago
Thank you for alleviating my guilt about also napping during my recent watch of Stalker. It certainly didn't hurt, and I'd agree it helped in an odd way.
250.
by hirsin 5y ago
Don't? We're in the midst of a great realization that you don't need to be physically near someone to work with them. Alternately, ensure they have sufficient pay and benefits to ignore the GOP restrictions and then hope they
251.
by hirsin 5y ago
Immutable here meaning that all keys need to be known ahead of time of the construction? Certainly that's been one of the nice features of our use of bloom filters - we can safely add keys over time on demand, sharding every hour and g
252.
by hirsin 5y ago
Teams was built on Electron a long time before Microsoft purchased Github.
253.
by hirsin 5y ago
A "solve" is common parlance in puzzling in my experience (ie puzzle hunt). Never used it in my day to day PM role though, agreed it would sound awkward.
254.
by hirsin 5y ago
Currently it's 8 dollars to clear in 6 hours. The cost to turn that back into money isn't included here.
255.
by hirsin 5y ago
Yup. First thought on the shopping bag was "how heavy is that empty?". Designers were not worried about over burdening whatever carried it, necessarily. That mixer likely won't handle a small load (as in, a single family size
256.
by hirsin 5y ago
My searching is failing, but I believe a similar scheme was uncovered in a popular app using a 'strings' equivalent. It would run through intents on iOS and Android to figure out what was installed. Interesting to see if on the we
257.
by hirsin 6y ago
"This project happens to be owned by Google" is common for a reason.
258.
by hirsin 6y ago
Not any more, as of a year or two ago? We finally updated our internal structure to follow the NIST guidelines we helped write.
259.
by hirsin 6y ago
The implicit grant, while deprecated, is still used across the ecosystem. Further, embedded apps (eg you have a portal that iframes Salesforce and Salesforce needs to be authenticated) can't redirect to the login page or open that ifra
260.
by hirsin 6y ago
Yes, Teams relies on silent auth from within an iframe (all those chat windows etc). This is impossible without 3p cookies, so we're working with Google to find a solution. Storage access API in Safari works, but sounds like it won&#x2
261.
by hirsin 6y ago
Care to reach out? This username at Microsoft. We're working to understand what legitimate use cases are broken without 3p cookies so we can work with Google to backfill them. FLOC helps ad trackers track but doesn't help with any
262.
by hirsin 6y ago
A comment in the WP post brings up the malicious nature of FLOC opt-out - it requires base layer changes to your site. Google knows from Samesite that it requires "your app is going to break" levels of urgency to get old sites to
263.
by hirsin 6y ago
Surely you don't accuse developers of being in cahoots with the attackers that use their bugs? Now, we fix our bugs, so there's a difference...
264.
by hirsin 6y ago
Interesting, mine is specifically gluten free, celiac household. And that's fascinating, I had no idea! Time to check on the spice packet from my grandmother and compare to the store bought stuff. Thanks!
265.
by hirsin 6y ago
Huh. We usually joke that hing (the Hindi name) is like bay leaves - mostly there for tradition but largely tasteless. I couldn't tell you what it tastes like and use the traditional "big pinch" of hing in most of my cooking.
266.
by hirsin 6y ago
As you yourself said - a problem with implicit flows is abuse of open redirects. It's a rare open redirect that is vulnerable to implicit that's not also vulnerable to PKCE protected auth code flow. This pattern is generally true
267.
by hirsin 6y ago
Thanks for taking a stab at it. I'm well aware of how the auth code flow works - I have yet to see a serious discussion though on how PKCE fixes the issues inherent in the implicit flow. Everything I've seen is "implicit bad,
268.
by hirsin 6y ago
Yes, indeed :-)
269.
by hirsin 6y ago
Unencrypted, client legible access tokens is probably one of the worst ecosystem mistakes you can make. It lets devs (like the article author) read oauth as oauthN "because I can read the token". So now you have clients taking a s
270.
by hirsin 6y ago
And replacing it with auth code flow fixes that? I'll go along with auth code flow to fix Safari (now everyone) breaking cookies, but the security aspect of PKCE always smelled to me.

More ›