[HN Gopher] Google Zanzibar Through Our Eyes
       ___________________________________________________________________
        
       Google Zanzibar Through Our Eyes
        
       Author : jzelinskie
       Score  : 54 points
       Date   : 2022-12-08 17:37 UTC (5 hours ago)
        
 (HTM) web link (authzed.com)
 (TXT) w3m dump (authzed.com)
        
       | Keverw wrote:
       | I was just skimming over real quick but don't have to either to
       | read the whole thing. One thing that stood out, is a group can
       | hold another group. So I guess if you had a role like tech
       | support, web development, financial, etc you could make a CEO
       | role that includes the permissions within those other roles? If I
       | am reading that right, never thought about that though. Kinda
       | neat as role reusability.
        
         | oh_sigh wrote:
         | Not only inclusion, but other operators as well, such as
         | negation, so you can say
         | CanAccessAmericanSecrets = AllSREs - EmployeesInEnemyState
         | 
         | (or whatever)
        
           | rad_gruchalski wrote:
           | No idea why you are getting downvoted. You are correct. The
           | white paper section 2.3. Talks exactly about that. The
           | namespace configuration pseudocode show exactly how this is
           | written. Took me over a year to arrive at this conclusion.
        
         | jschorr wrote:
         | Yep! Groups can be easily nested under one another by simply
         | creating a relationship between the group's members and the
         | members of another group.
         | 
         | In SpiceDB [0] schema this can be represented like so:
         | definition group {         relation member: user | group#member
         | }
         | 
         | Here `member` allows a relationship to itself, which allows
         | writing a relationship saying that every member of one group is
         | a member of the containing group.
         | 
         | I threw together an example in our playground [1], if you'd
         | like to try it out!
         | 
         | [0]: https://github.com/authzed/spicedb [1]:
         | https://play.authzed.com/s/9D5h9I7mE9mK/schema
        
       | njhale wrote:
       | Your notes immediately crystalized some of the concepts I was
       | still fuzzy on before reading. Awesome!
       | 
       | https://github.com/authzed/zanzibar-annotated is very slick too!
       | 
       | Is there any way to attribute an annotation to a set of authors
       | (sans git history)?
        
       | mooneater wrote:
       | I love the annotation interface, did you do that all yourself or
       | use a tool? Ty!
        
         | jschorr wrote:
         | All custom but fully open source! Code can be found at
         | https://github.com/authzed/zanzibar-annotated
        
           | ignoramous wrote:
           | Not only targeting devs with tech-specific content-marketing,
           | but content-marketing with code, too! Nice (:
        
       | brancz wrote:
       | Super interesting! It's interesting to think about what Zanzibar
       | ultimately is: an efficient way to store and traverse graphs to
       | determine an outcome, in this case typically authorization, but
       | ever since I learned of this I keep seeing more and more problems
       | that could be solved this way.
       | 
       | Also I can't decide whether this paper is more interesting or the
       | tech they built to annotate it, I keep thinking of papers I'd
       | want to do this with now.
        
         | jzelinskie wrote:
         | >an efficient way to store and traverse graphs to determine an
         | outcome ... I keep seeing more and more problems that could be
         | solved this way
         | 
         | Yes! The team over at Authzed keeps seeing this, too!
         | 
         | While SpiceDB is fully embracing its primary use-case for
         | permissions, you could also use it to solve many other problems
         | that boil down to "the existence of a path on a graph". For
         | example, we've considered using it for storing update graphs
         | for automating software updates for our Kubernetes operator[0]
         | 
         | The wonderful Kris Nova has also made this realization and
         | considered SpiceDB for dependency resolution for an init system
         | designed to replace systemd[1].
         | 
         | [0]: https://github.com/authzed/spicedb-operator
         | 
         | [1]:
         | https://docs.google.com/document/d/1dA591eipsgWeAlaSwbYNQtAQ...
        
       | jzelinskie wrote:
       | Hey HN! I'm one of folks that helped launch this project.
       | 
       | You can go directly to the annotated paper here[0]. It's got all
       | kinds of goodies like the ability to direct link from anywhere
       | and generate OpenGraph previews (e.g. [1]).
       | 
       | Coolest of all, it's entirely open source[2] built on NextJS.
       | 
       | [0]: https://zanzibar.tech
       | 
       | [1]: https://zanzibar.tech/2R50fs-R_n:1i:3u
       | 
       | [2]: https://github.com/authzed/zanzibar-annotated
        
       ___________________________________________________________________
       (page generated 2022-12-08 23:00 UTC)