February 2024 Summaries

Jake Moshenko, CEO and co-founder of AuthZed, shares his entrepreneurial journey from leading tech corporations like Boeing, Amazon, and Google to launching AuthZed, discussing obstacles, insights gained, and the company's pioneering mission in authorization solutions. He reflects on leadership philosophy, problem understanding, user empathy, and market strategy, offering guidance for budding entrepreneurs, while sharing his vision for AuthZed's future and its impact on cloud-native technologies.

In an insightful episode of the Risk Management Show, Boris Agrinovich welcomes Jake Moshenko, the co-founder and CEO of AuthZed, to discuss the crucial role of authorization in application security, common challenges organizations face in implementing robust authorization mechanisms, and innovative approaches AuthZed is taking to address these issues. The discussion emphasizes the importance of distinguishing between authentication and authorization, highlighting the potential and limitations of AI in authorization, and addressing misconceptions surrounding modern authorization systems. AuthZed's solutions are streamlining permissions management, enabling companies to focus on their core competencies while ensuring secure and scalable applications. By focusing on application authorization over workforce authorization, AuthZed is reducing operational costs and accelerating time-to-market by simplifying permissions management, and strongly advocating for strongly consistent systems in authorization.

The talk by Jimmy Zelinskie at FOSDEM 2024 discusses the evolution of access control models and their historical development, from traditional models like DAC and MAC to more modern approaches such as ABAC and ReBAC. The discussion also touches on the challenges posed by web security threats, including Broken Access Control's rise to OWASP's top threat list. SpiceDB is introduced as a parallel graph database designed for authorization checks, built upon Google's Zanzibar project and extending its concepts to be more flexible and applicable outside of Google's infrastructure.

Jake discussed the world of permissions and access control on The Privacy Files podcast, exploring the evolution of permissions management technologies and their role in ensuring digital privacy. He emphasized the challenges of permissions management and its importance in outsourcing non-core competencies, such as security and scalability issues with custom permissions code. Jake's background at Amazon and Google influenced his interest in building large services focused on developer experience, leading to the founding of AuthZed, a comprehensive solution for permissions management inspired by Google's Zanzibar paper. The company aims to simplify permissions management for companies while addressing challenges in selling infrastructure to enterprises and real-world implications of permissions mismanagement.

AuthZed Materialize has entered Early Access for AuthZed Dedicated customers, providing accelerated SpiceDB API responses and efficient streaming of access changes to other systems. This new service is a significant development in AuthZed's mission to secure the internet by building scalable authorization systems. The company has refined Google's Zanzibar design while maintaining its original goals of consistency at a global scale, setting a new standard for systems inspired by Zanzibar. With this innovation, AuthZed aims to provide developers with a robust foundation for building permission systems, and is eager to share it with the world once it reaches general availability.

Jake Moshenko, CEO and co-founder of AuthZed, shares his entrepreneurial journey and insights gained from developing authorization services to simplify and secure access control for companies. His background includes studying computer engineering at the University of Michigan and working at tech giants like Boeing, Amazon, Google, and IBM, before founding Quay which was acquired by CoreOS, then Red Hat, and eventually IBM. AuthZed focuses on addressing complex authorization systems within companies, moving beyond traditional role-based access control models to accommodate share-heavy applications. Jake's leadership style is influenced by his experiences at tech giants and his own ventures, with a focus on servant leadership, and envisions AuthZed becoming integral to companies' authorization strategies in the future.

To effectively answer the large number of authorization requests per second, Google's Zanzibar project introduced a novel way of caching that reuses authorization results. In SpiceDB, this caching mechanism is used to enable super large scales by breaking down check requests into subproblems, which can be cached and reused while answering other check queries. However, this approach introduces the issue of staleness, where cache entries become invalid if underlying data changes. To address this, Zanzibar settled on a configurable temporal window for caching, throwing out all entries after that window closes. The system also uses token hashring to distribute the cache across nodes in a stable fashion, ensuring maximal reuse and deduplication of requests. As a result, SpiceDB users can often see high cache rates, with up to 60% over all subproblems being computed, and up to a 40% reduction in the number of requests. The caching strategy is designed to be configurable and adaptable to different use cases, with plans for future updates and improvements.

The new year brought some exciting updates to SpiceDB's backup and restore functionality. The `zed` CLI tool has been improved with a simple and intuitive interface for creating, restoring, extracting, and redacting backups. SpiceDB's backup data is stored in an Apache Avro container, which efficiently stores schema, snapshot revision, and relationships. New features include conflict handling, automatic retries, and the ability to restore subsets of a backup. Additionally, `zed` now supports obfuscating or "redacting" sensitive information from backups, making it easier to share or use for testing purposes. The tool also includes context-aware shell completion, allowing users to construct commands more effectively based on their existing schema.

SpiceDB 1.29.0 and 1.29.1 have been released, featuring improvements such as streaming checkpoint revisions and schema changes in the Datastore Watch API, and additional tests for invalid schema and permissions. The AuthZed team will be attending FOSDEM and KubeCon EU, where they'll meet community members and discuss their work on authorization and secure permissions management. New blog posts have been published, including articles on growing a sustainable culture at a remote tech startup and the differences between authentication and authorization. The SpiceDB community is updating its office hours format to accommodate busy schedules across time zones, with recordings of sessions being uploaded to the YouTube channel. Additionally, the team has made updates to Zed, their backup redaction tool, and have welcomed new first-time contributors to the project.