I think most of the other commenters trying to suggest that RH is arms-length on Keycloak are missing that most of the core contributors ...
I think most of the other commenters trying to suggest that RH is arms-length on Keycloak are missing that most of the core contributors work for RedHat. > I am a strong proponent of open source. However, I believe that those who develop important projects should carefully consider the impact that their work can have. I think that for a centralized authentication system, a bypass of the two-factor authentication should be solved or at least mitigated in a timely manner: 10 months is a lot of time to fix a core feature of a security product. What does the author propose as the solution here? Simply saying "you should be careful" isn't a solution. If you proposed a fix, where was the PR? Why is there no further discussion of what the holdups were? My guess here, not being privy to internal communications: The RedHat folks were probably worried that a simple change like increasing the required access to add another 2FA would break some other functionality, or cause logical loopholes for situations where a user loses access to their 2nd factors. The result was that they were exceedingly careful/slow to get to testing and validation. Doesn't make it right. This guess comes from what I observed in my previous time at IBM -- I saw a lot of the company's open source contributions hung up in similar ways.
Posted by BeefWellington on Nov 14, 2024, 5:12 PM
Tags
Related issues
- The biggest problem with having an LLM do this, from what I've observed of at least frontier models, is that the way they are trained...
- The biggest problem with MOND is that it was hand-crafted with additional parameters simply to fit the data.
- (My comment is about detached houses).
- The biggest problem with this is that I can't run my company's own internal benchmarks against this API, because they will be trained int...
- > steer Claude away from over-engineering parts of the system in response to hypothetical concerns.
- Why is there no comparison with FLUX 3 Image?
Raise real-world problems, find people facing the same issue, and discuss solutions.5,000 issues0 comments
hackernews (Other)
The biggest problem with having an LLM do this, from what I've observed of at least frontier models, is that the way they are trained...
NewThe biggest problem with MOND is that it was hand-crafted with additional parameters simply to fit the data.
(My comment is about detached houses).
The biggest problem with this is that I can't run my company's own internal benchmarks against this API, because they will be trained int...
> steer Claude away from over-engineering parts of the system in response to hypothetical concerns.
Why is there no comparison with FLUX 3 Image?
> our Git monorepo was developing an annoying problem Sentences like this are so common from people using monorepos that I am convinced ...
Why is there no contact form?
I think most of the other commenters trying to suggest that RH is arms-length on Keycloak are missing that most of the core contributors ...
I think most of the other commenters trying to suggest that RH is arms-length on Keycloak are missing that most of the core contributors work for RedHat. > I am a strong proponent of open source. However, I believe that those who develop important projects should carefully consider the impact that their work can have. I think that for a centralized authentication system, a bypass of the two-factor authentication should be solved or at least mitigated in a timely manner: 10 months is a lot of time to fix a core feature of a security product. What does the author propose as the solution here? Simply saying "you should be careful" isn't a solution. If you proposed a fix, where was the PR? Why is there no further discussion of what the holdups were? My guess here, not being privy to internal communications: The RedHat folks were probably worried that a simple change like increasing the required access to add another 2FA would break some other functionality, or cause logical loopholes for situations where a user loses access to their 2nd factors. The result was that they were exceedingly careful/slow to get to testing and validation. Doesn't make it right. This guess comes from what I observed in my previous time at IBM -- I saw a lot of the company's open source contributions hung up in similar ways.
Comments (0)
No comments yet. Start the discussion.