Feedback needed: Cerbos Hub is now in public beta! reddit / selfhosted ---------------------------------------------------------------------- AuthZ_Trooper · 2023-11-07 08:56 Hello everyone! I'm with **Cerbos** ([https://cerbos.dev/](https://cerbos.dev/)), a self-hosted, open-source dev tool designed to manage who can do what in your software applications. For a couple of years now, Open Worldwide Application Security Project (OWASP) is naming authorization a [**top 10 API security risk**](https://owasp.org/API-Security/editions/2023/en/0x11-t10/). We are thrilled to announce that Cerbos Hub is now in **public beta**! You can think of **Cerbos Hub** as an inter, the Cerbos engine and everything that has to do with making decisions IS and will always be, and the Hub serves to help mitigate the collaborative update pains.licy updates in real-time even to the edge and end client devices via its WebAssembly extension. It is a stateless, scalable and collaborative solution for teams who want to save time, streamline their workflows and confidently roll out authZ updates. While the **Hub per-se is NOT self-hosted**, the Cerbos engine and everything that has to do with making decisions IS and will always be, and the hub serves to help mitigate the collaborative update pains. Help us shape the future of authZ, and help your teams (or yourself) focus on innovation! Looking forward to your feedback, with hopes of not infringing the self-hosted nature of this community. Much appreciated :) [Cerbos Hub](https://preview.redd.it/gwkvooe84wyb1.png?width=2880&form at=png&auto=webp&s=81d9974c841a6757af583bff03009766109f2fb7) ---------------------------------------------------------------------- casperghst42 · 2023-11-07 11:15 Interesting concept, not sure if there aren't better solution. This is "just" another PIM/PAM solution. Though the API for checking access looks intersting. ---------------------------------------------------------------------- AuthZ_Trooper · 2023-11-07 12:03 Hehe I say, if you are versed in the area go check the [playground](https://play.cerbos.dev/) in a couple of minutes and tell me what you think :D I'd argue that Cerbos is the smoothest solution out there for many reasons. Speaking about the PDP engine itself; among other things, none of the zanzibar-based ones is stateless, as it would go against its core values, whereas Cerbos is. It's quite opinionated and specializes in application authZ, opposed to the many of its alternatives trying to solve it across the board (may I add by doing so also failing to optimize their efforts), and it actually solves the listing problem in a way that is not forcing you to do way too much yourself (for some tech stacks it comes with tooling so you have to sweat your brains about nothing at all). Plus, YAML and CEL instead of learning a dedicated new programming language for it seams neat. The Hub part is in beta, so I wouldn’t stretch the argument for that part being the top pick in the group already, but we'll sure do our best to get there. :) ---------------------------------------------------------------------- casperghst42 · 2023-11-07 14:14 Oh, I've been working with large PAM and IDM installation for more than a decade and anything which can't be automated isn't interesting. Remember, often the real world does not have 10 uses, but closer to 10.000 or more. Hint: remember to do some performance testing with +100.000 users (I know a few developers who have landed in the hot seat for only testing with a couple of thousand users/identities). I would be nice with more in depth documentation on how to onboard identities and role from an external system using for example REST. Otherwise it looks nice, but I do not create applications which would use this, I build the systems which gives users access to them (the applications).