News for hackers. Stuff that matters.

mathiasn

mathiasn on Hacker News

Re:Reverse Engineering PowerPoint's XML to Build a Slide Generator on Monday February 17, 2025 @02:16PM (#43082329)
Is that something you want to open source?
Re:The SSO Wall of Shame on Wednesday January 08, 2025 @08:32AM (#42633999)
https://ssotax.org gets more updates. There is also a Friends of SSO page :-)
Re:Launch HN: Langfuse (YC W23) – OSS Tracing and Workflows to Improve... on Tuesday December 17, 2024 @11:23AM (#42442658)
What are other potential platforms?
Re:Ask HN: How To: Store and share passwords in a company? on Thursday September 05, 2024 @04:24AM (#41454675)
Or better ssotax.org which is already way ahead.
Re:The SSO Wall of Shame on Friday August 02, 2024 @04:46AM (#41137144)
Yeah that's the old not very much up2date page. https://ssotax.org has more data and even has a Friends of SSO page.
Re:Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Risky OAuth ... on Thursday August 01, 2024 @12:57PM (#41131154)
Depending on the point of view it can also be a strength. Actually many of our customers like that we're in Slack because their people are already there:

- no login required to request an access - they don't need to "learn a new application"

So for end users that's great. There is still a web app for admins with more details.

But I can see where you're coming from. We plan to offer an alternative to Slack to be independent if the customers want that.

Re:Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Risky OAuth ... on Thursday August 01, 2024 @03:40AM (#41126969)
Slack is required for AccessOwl. It's used for things like approval workflows, task management and notifications in general.

What do you use instead?

Re:Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Risky OAuth ... on Thursday August 01, 2024 @03:02AM (#41126797)
From a legal point of view that might be true, but I believe people are not aware that this is a problem. They just register, check the "Agree terms of service" box and do whatever they want to do. I saw that often, especially with Marketing.
Re:Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Risky OAuth ... on Thursday August 01, 2024 @02:56AM (#41126761)
Which makes it even worse because you cannot detect that then :/

Shouldn't people just be able to try out new things? How can a company be innovative otherwise? And at a specific point (e.g. putting customer data into it), they need to start a proper vendor assessment process.

Show HN: Shadow IT Scan – Uncover SaaS Apps, Users and Risky OAuth Scopes

Posted by mathiasn on Wednesday July 31, 2024 @08:05AM
from the show-hn dept.

https://www.accessowl.io/scan

Hey HN,TL;DR: We’ve launched a free version of our Shadow IT scanner to identify which SaaS apps are used in your company, who uses them, and if they have high-risk OAuth scopes.Philip and I went through YC with AccessOwl in 2022. We started the company because, in our previous roles, we struggled to track all the SaaS apps, users, and granted OAuth scopes. The Shadow IT scanner started as a...

( Read More... | 36 comments | 3 points | on HN )
Re:Show HN: Adding Mistral Codestral and GPT-4o to Jupyter Notebooks on Tuesday July 02, 2024 @01:53PM (#40858929)
Have you seen Livebook? Best Jupyter Notebook ever!! https://livebook.dev/
Re:Ask HN: What happens when I click "Request for quote" on your SaaS? on Wednesday June 19, 2024 @10:37AM (#40728729)
or even better https://ssotax.org
Re:Show HN: A web debugger an ex-Cloudflare team has been working on f... on Monday May 13, 2024 @03:27AM (#40340596)
BTW: https://ssotax.org is more up2date
Re:Tailscale SSH is now Generally Available on Wednesday April 17, 2024 @05:20AM (#40062244)
It's a community project, you can just update it :-)
Re:Multi – Multiplayer Collaboration for macOS on Tuesday February 27, 2024 @03:40AM (#39521633)
There is a better ssotax.org which is more up2date and has even a Friends of SSO page.
Re:Show HN: Ending the Absurdity of SSO Tax – Introducing ssotax.org on Monday November 20, 2023 @05:21AM (#38345900)
Yes, that's what I heard too. I mean they still have SCIM which allows you create/remove user accounts via API. Although that's still security relevant, giving at least SSO out for free would help already. Still, I would prefer something that does not relate to security.

What do you mean with Docker? I saw on their page that they offer SSO on the highest tier, so they do not look solely on ARR then?!

Show HN: Ending the Absurdity of SSO Tax – Introducing ssotax.org

Posted by mathiasn on Monday November 20, 2023 @03:33AM
from the show-hn dept.

https://ssotax.org

Ever heard of the SSO Tax? In short, it's a tactic where software vendors bully security-conscious companies to upgrade to costly enterprise plans. They do this by gating SSO (Single Sign-On) features behind their priciest options, causing companies to pay up to 70 times their standard rates.As a former CTO at a VC-backed and security-conscious company, I've faced the tough choice of skipping...

( Read More... | 3 comments | 3 points | on HN )
Re:Ask HN: Is there still a reason to use Okta for SSO? Okta vs. Googl... on Friday April 21, 2023 @01:39PM (#35657320)
Hmm audit compliance? Google gives you a log of who logged in where, doesn't it? And with "proper RBAC" you mean that you can put somebody into the "Developer" role, hence he gets AWS, GCP, Datadog, right?

Ask HN: Is there still a reason to use Okta for SSO? Okta vs. Google SSO

Posted by mathiasn on Thursday April 20, 2023 @01:56PM
from the ask-hn dept.

Is there even a reason to use Okta SSO?Every company actively decides at some point in time how employees shall login to SaaS vendors. The typical answer for early stage companies is Google SSO, whereas later stage companies tend to switch to Okta SSO.In the early SSO days Okta was the best option to get MFA and granular controls. However, nowadays Google is offering 2FA as well. It’s also...

( Read More... | 34 comments | 6 points | on HN )
Re:Show HN: Skip the SSO Tax, access your user data with OSS on Wednesday April 12, 2023 @07:13AM (#35537827)
Oh yeah, that's indeed a step back when you compare it like this. Especially today, automation should be possible everywhere. There is no real reason for that. SaaS apps could just stop blocking that and everyone would be happy. Some just need to start...
Re:Show HN: Skip the SSO Tax, access your user data with OSS on Wednesday April 12, 2023 @07:09AM (#35537790)
Did you also consider building it with Elixir and LiveView?
Re:Show HN: Skip the SSO Tax, access your user data with OSS on Wednesday April 12, 2023 @07:07AM (#35537770)
Indeed, that became a bad practice... Zoom, Calendly just to name a few do that. That's so stupid and just not customer-friendly at all. Whenever I see this, I start searching for an alternative... But there are also role models in the market like Slack that prorate even based on days after a user was deactivated. And they even remove users from billing when there were inactive for a longer period. Very kind :-)
Re:Show HN: Skip the SSO Tax, access your user data with OSS on Wednesday April 12, 2023 @03:50AM (#35536277)
Oh yeah, Elixir is just amazing <3. We use it for our commercial platform accessowl.io. Parts of OpenOwl are originated from there. It was the fastest way to push OpenOwl out. Moreover doing it like this allows us to use OpenOwl as library there.

But yeah I was thinking longer about it as Playwright is pretty good for scraping/RPA and works best with Node. One (expected) limitation is that we cannot easily open a browser window to let the user enter a OTP or solve a captcha as we encapsulated everything into Docker. Not sure how we can solve it yet...

Older »