October 2023 Summaries

Using a single container per application can lead to scalability issues and make it harder to manage processes. Installing things at runtime can cause problems such as rate limiting, failed downloads, or internet connection saturation. Writing logs to files instead of stdout makes it harder for orchestration platforms to collect and aggregate service logs, making debugging more difficult. Using a single container per service allows for horizontal scaling, distinguishes between components, and enables starting processes in a specific order. Installing dependencies at runtime can lead to rate limiting, failed downloads, or internet connection saturation, and using the `:latest` tag without pinning dependencies can cause problems with updates and compatibility. Logging to stdout makes it easier for orchestration platforms to collect and aggregate service logs, making debugging more efficient.

Authentik is an open-source identity provider that aims to consolidate identity needs by replacing platforms like Okta, Keycloak, and Ping, and is developed by Authentik Security, a public benefit company. The text discusses the importance of proper container deployment practices to ensure ease of use and scalability, focusing on the separation of services into individual containers according to the Single Responsibility Principle. This setup allows for horizontal scaling and better management, particularly when using container orchestrators like Kubernetes or Docker Compose. It also highlights common mistakes such as installing dependencies at runtime, using the :latest tag for Docker images, and writing logs to files instead of standard output, which can lead to inefficiencies and challenges in management and scalability. The text advocates for practices like pinning dependencies to specific versions using GitOps and logging to standard output, thereby promoting better infrastructure management and flexibility for future changes.

The breach at Okta highlights the importance of vigilance in security measures and the potential risks associated with seemingly reasonable requests, such as uploading HAR files to a support system. The incident demonstrates how hackers can exploit vulnerabilities in support teams, using them as entry points to gain control over the main dashboard and entire support system. The delayed response from Okta has been criticized, particularly its lack of transparency and acknowledgment of customer notifications. The breach also underscores the need for customers and security teams to stay vigilant and implement multiple layers of controls, enforced processes, and defense-in-depth policies to prevent breaches.

The "SSO tax" refers to vendors charging exorbitant prices for single sign-on (SSO) functionality, which is essential for security, but only available on expensive enterprise plans. This practice has become normalized, with many companies paying twice as much or more than they need to for SSO. The SSO tax is a form of "security tax" that traps individuals into paying for features they don't need, making it difficult for companies to adopt and maintain security best practices. Despite efforts to raise awareness about the issue through the SSO Wall of Shame, vendors have been able to continue charging high prices due to the low PR risk and the collective action problem of interconnected organizations relying on each other's security. To address this issue, potential compromises include offering cheaper ways to authenticate, charging less for SSO features, unbundling security from support and value-added features, or shifting industry norms towards a "buy vs. build" framework that prioritizes security by default.

SCIM (System for Cross-domain Identity Management) is a protocol that offers improvements over LDAP, including security benefits and time- and cost-saving advantages for companies with cloud-native applications. However, implementing SCIM can be challenging due to deviations from the standard, lack of clear documentation, and testing issues. Many vendors have their own interpretations of the standard, leading to quirks and workarounds that are not well-documented. This can make it difficult for developers to implement SCIM correctly, especially when compared to more mature protocols like OpenID Connect, which has a well-defined test suite and certification process. Additionally, updating user information in SCIM can be unnecessarily complex, requiring the use of custom filtering expressions and parser generators like ANTLR. The immaturity of SCIM is evident in its lack of standard implementations and documentation, making it harder for developers to implement correctly and troubleshoot issues.