HACKER Q&A
📣 emreb

What are your top worries when externalizing authorization?


If you were to or are considering externalizing your application's authorization layer to a product like OPA[0], OSO[1], Cerbos[2], SpiceDB[3], what are the top three things you worry about?

[0] https://www.openpolicyagent.org [1] https://osohq.com [2] https://cerbos.dev [3] https://authzed.com/products/spicedb


  👤 PaulHoule Accepted Answer ✓
That the provider will go out of business.

That I'll tell management that the provider will go out of business and they'll blow me off and the provider goes out of business anyway.

That the provider's end game is to get acquired and... go out of business.

---

There are times when I think people are just 'fricken sheep. Circa 2001 I developed a user management framework that was designed for easy integration into the web application frameworks. For my own account and for customers I used it on numerous sites, some of which got 500,000+ users.

As an open source release it got no traction, just got "security reviews" from sketchy people who never told me the results.

Then all of a sudden "we're going to go out of business someday" 3-rd party auth solutions became really fashionable and it was like a lightning bolt, the idea that you were depending on some provider that could go out of business was the part of the value proposition that I was missing back then.