OIDC+OAuth is what most people actually want when they think of OAuth imo. The main issue here is that OAuth was not designed as an authentication protocol.
At Google, people can use "Cider" which is a web browser based IDE, and they can use a "Cloudtop" which is a desktop virtual machine provisioned via Google's cloud infrastructure, as alternatives to a dedicate physical workstation.
in the uk, most pay tax by an even simpler method, Pay as You Earn (PAYE). the taxes are all filed by the employer, and the online website allows taxpayers to add anything else
Before the layoffs I worked on a security checks team (“ISE Hardening”) at Google. Google requires for almost all projects that code is physically imported into the SCS; when this code touches anything at all, extremely stringent security checks run at build-time.
These checks often don’t attempt to detect actual exploit paths, but for usage of APIs that simply may lead to vulnerability. These checks can only be disabled per file or per symbol and per check by a member of the security team via an allowlist change that has to be in the same commit.
This is not perfect but is by far the most stringent third party policy I’ve seen or worked with. The cost of bringing 3p code into the fold is high.
The flipside of this is that Google tech ends up with an insular and conservative outlook. I’d describe the Googl stack as ‘retro-futuristic’. It is still extremely mature and effective.
Not only are the products confusing (which one does what parent mentioned?) but that pricing is out of reach for so many I'm wondering if the company is actually real or not?
If you are a big corp a security leak costs you 10 mil USD, it might make sense to pay. Instead of paying $50k for a one time security audit, you get a part of it in the form of a subscription.
I want to second this. The top StackOverflow comment for protecting against XSS in PHP still recommends htmlspecialchars() https://stackoverflow.com/questions/1996122/how-to-prevent-x... which is a terrible and ancient approach (context-aware templates are the modern approach).
I also Googled to check CSRF protection and all the sites I can find just discuss rolling it yourself; the example uses some CSPRNG that can potentially return not cryptographically secure numbers without erroring. https://www.section.io/engineering-education/csrf-protection...
That's one thing that really drove me away from PHP. It presents an extremely simple seeming universe, in which web apps are very easy to write – but has really naïve bones, requiring a lot of extra scaffolding to be safe.
You do get XSS protection out of the box in most templating languages, though, and PHP is also a templating language.
Take this template:
<h1>{{ title }}</h1>
In most templating languages, for a title of "<script>alert();</script>", the result will end up being:
<h1><script>alert();</script></h1>
In PHP, which is a templating language, the equivalent seems to be:
<h1><?php echo $title; ?></h1>
But this will print the title unescaped, which is a security vulnerability, and incorrect. In reality, the equivalent is:
<h1><?php echo htmlspecialchars($title); ?></h1>
Now, you could say, don't use PHP as a templating language! But if you're not supposed to use PHP as a templating language, why does it behave as one? This is one of PHP's footguns to be avoided. Personally, I recommend a linter like PHPCS to catch issues like this one.
Templating languages are abstractions on top of other technologies. I don't see how PHP is a templating language. I could write that exact same code above in NodeJS and I'd need to use mustache to escape the output. So you can make the same mistakes in Node, Python.
Nobody writes PHP mixing HTML and PHP anymore, and if you do you should run. Shit code is not unique to PHP and I've seen more than my life's share in JS and Python codebases.
> I don't see how PHP is a templating language [...] Nobody writes PHP mixing HTML and PHP anymore
PHP is designed to be a template language, but it's a terrible template language, so nobody (it is claimed) uses it as it was originally designed to be used anymore.
So "use PHP" is not good advice if what you mean is "use a web framework and a separate third-party template language", which works just as well in any language and doesn't give PHP any particular advantage.
Tangential, but I've always found Mustache's tagline "logic-less templates" confusing - what they mean is that the template language doesn't have control flow. Logic is not a synonym of control flow in my mind.
Well, of course not from any lang that treats HTML as a string, but there are langs, which treat HTML as structured data, in their standard libraries. Take a look at SXML libraries for example. Whatever script you stored as a username for example, it would still get treated as text, not tag, when put into lets say a span or p. SXML is aware of the boundary between tags, their attributes and their content.
Alright, let's go with widely-used programming languages for now - I've been programming for over 20 years and never heard of Guile.
I am not against the idea of having native protections built into stdlib, we can agree there, but it's disingenuous to suggest that this problem is unique to PHP as the parent comment suggested. It's the same in all of the major programming languages used to spit out HTML as far as I can tell.
Oh, very much so. I don't doubt it. Most of them are doing it wrong, fiddling with strings, instead of structured data, which HTML would lend itself really nicely to. Especially PHP, with its "output HTML" in-built mentality should have gotten it right, but did not. Many others did not do any better.
I think this kind of gets to the point of what protobuf is, and what a lot of tech is like at Google in general. I spent a lot of my career believing elegance and expressiveness was so important to strive for, even if we as engineers often fall short.
But tech at Google tends to be pragmatic in the specific way that protobuf is. It's not perfect, it doesn't fit neatly into a grand ideology, but it is (at least within Google itself) simple enough, easy enough to understand, portable and fit for purpose. In a similar way to bazel, it's full of components worthy of criticism, but those fixes get made when they become the ecosystem's most pressing issues, and not before.
“the crown” is an idea stemming from english constitutional law representing “the state”, i.e. the legal entity constituting the country. It doesn’t have a lot to do with the physical monarch except in metaphor. It looks like, based on some Googling, that Jamaica, which is a republic (canada is not) still uses the term “crown” in this sense: https://www.mof.gov.jm/careers/crown-counsel-mlss-legal-serv...
wanted to correct this one: I confused Barbados with Jamaica here. Barbados is a republic. I am sure its laws still use the term "the crown", but it looks like it uses the term "Public Prosecutor" instead of "Crown Prosecutor".
"English constitutional law" is any English law that pertains to something you consider to be "constitution".
The term "Crown" used to mean the prosecution in criminal cases derives from the actions of Henry I and particularly Henry II, in despatching teams of royal justices around the country, to hear cases in the provinces. Previously, such cases were heard mainly in baronial courts. In that sense, these kings made the English law more uniform, and more accessible.
One of the customary requirements of kings was that they should dispense justice. One of the classes of court in the UK is Crown Courts, which hear criminal cases in front of juries (and appeals from magistrates courts). They are not controlled by The Crown, and the judges are not appointed by The Crown.
In theory, the government here governs by the grace of The Crown; everything is by grace of The Crown. In practice, it's nonsense.
Surely this is a question of supply and demand and if a 4 day workweek is the legally cheap and good path supported by governments in the same way the 5 day workweek is, the competition for salaries will be nearly identical
