[HN Gopher] Cedar is an open source policy language and evaluati...
       ___________________________________________________________________
        
       Cedar is an open source policy language and evaluation engine
        
       Author : mooreds
       Score  : 67 points
       Date   : 2023-05-15 15:53 UTC (7 hours ago)
        
 (HTM) web link (github.com)
 (TXT) w3m dump (github.com)
        
       | thayne wrote:
       | How does this compare to Open Policy Agent, or oso? Why would I
       | use this instead?
        
         | sarahcec wrote:
         | The main benefits of Cedar are: *Verifiable/Analyzable
         | *Deterministic Low Latencies *No Security Sandboxing Needed
         | *Ergonomic (easily readable) *Enables parallel execution More
         | here:
         | https://www.youtube.com/watch?t=1798&v=k6pPcnLuOXY&feature=y...
        
           | alexeldeib wrote:
           | I love the dual implementation, I hadn't heard of Dafny.
           | 
           | Can you speak to the point about latency? I wasn't aware it
           | made performance guarantees
        
             | abrahms wrote:
             | OPA allows you to make API calls from it. This doesn't.
             | This makes the latency more deterministic.
        
               | alexeldeib wrote:
               | Ah, I didn't realize that. I was thinking in the context
               | of pure policy evaluation. I know rego/opa had a policy
               | performance doc so was curious. Thanks :)
        
         | mritun wrote:
         | The challenge with authorization is that mistakes are
         | catastrophic.
         | 
         | The foremost benefit of Cedar is that the implementation is
         | formally proven. Which means that you are extremely unlikely to
         | have to deal with unexpected behavior! Of course, the modeling
         | needs to be reviewed manually for completeness, but the
         | verifier can tell if the model is buggy or inconsistent.
        
         | candiddevmike wrote:
         | If you're all in on AWS, use it, if not, use OPA. Lots of
         | vendors support OPA/rego, I can't think of anything I use
         | outside of AWS that supports Cedar.
        
           | mooreds wrote:
           | I think that is part of why they open sourced it, to try to
           | get more folks to use it. :)
        
       | jwineinger wrote:
       | I find a few things about Cedar exciting. The formal verification
       | and automated reasoning stuff sound great!
       | 
       | Unfortunately, there doesn't seem to be much of a story here to
       | solve authz-aware searching/listing for object/row level access.
       | Since Cedar/AVP doesn't come with an entity store, it seems I'd
       | have to send my entire database(s) on each call so that the
       | policies have the right data to evaluate. If that's true, then it
       | seems like this would be only be useful on small data sets.
       | 
       | I'm struggling to come up with use cases for "fine-grained
       | permissions and authorization" (what AVP bills itself as) that
       | don't involve some sort of listing or searching of things.
        
       | NegativeLatency wrote:
       | Looks neat, one of the places I've seen open source systems like
       | this trip on is when you need to know: what principals can do a
       | certain thing
       | 
       | Went through a big Ory Keto implementation to get stuck on not
       | being able to do this last crucial bit, so we ended up
       | implementing our own role based access control
        
         | mooreds wrote:
         | > what principals can do a certain thing
         | 
         | Hmmm. What's an example of this?
        
           | SgtBastard wrote:
           | Policy: Transactions under $X can be raised and approved by
           | the same person. >X requires an independent approver with
           | permission "supervisor".
           | 
           | Activity: Alice (a supervisor), raises a transaction >X, Bob
           | is a supervisor, Eve is not.
           | 
           | Problem: "Who can approve the transaction?"
           | 
           | (As humans the answer is obviously Bob, but for typical
           | implementation approaches to AuthZ policy, this is
           | challenging to determine. Typically it's done out of band and
           | then makes a decision when requested by Bob (allow) or Eve
           | (deny))
        
       | lalaithion wrote:
       | It would be nice to have performance numbers. Right now the only
       | thing I can find on performance is "Cedar is fast and scalable.
       | The policy structure allows your policies to be indexed for quick
       | retrieval. The design also supports fast, scalable, real-time
       | evaluation with bounded latency." which doesn't tell me if it is
       | will respond within 100 ms with 100,000 entities or within 10 ms
       | for 100 million entities.
        
       | bebop wrote:
       | The company announcement was posted last week and also has some
       | discussion here: https://news.ycombinator.com/item?id=35890784
        
       ___________________________________________________________________
       (page generated 2023-05-15 23:02 UTC)