vinckr

Has that law ever been enforced ? (e.g. taking away a FOSS or other project that someone wrote in their own time)

in most cases you dont need explicit permission but you need to sign a CLA (Individual Contributor License Agreement) - which kind of includes permission

Coming from Germany I found it funny how tiny the subway lines are in major cities in the US compared to medium-sized cities here.

I always thought Germany was a country centered a lot around cars but it was so much more extreme in the states; seemed not possible to live in a city(!) without a car.

Personally I hate magic links via email with a passion and will actively avoid products that have this as the only authentication method

I don't think we can let that one go so easily, since they might not be scanning for ad targeting (pinky promise?) - but they most certainly will slurp everything up for their AI stuff: https://blog.google/products-and-platforms/products/gmail/gm...

How is it obvious that this project bought starts on GitHub?

Very cool, thanks for sharing. Feel free to add it to https://github.com/ory/awesome-ory !

Tickets cannot be moved between trackers

You can convert an issue to a discussion and vice versa, so no duplication is needed and your notification should be preserved.

Or do you mean something else?

after clicking on your link I browsed twitter for a minute and damn that place has become weird (or maybe it always was?)

I think most commit messages use conventional commits (https://www.conventionalcommits.org/en/v1.0.0/) - I found them to be quite useful for creating structures commit messages.

I think gitmore could be improved if it used the conventional commits specification, there is a reason almost everyone uses them.

These are fair concerns, and I want to clarify what's included versus what's paid.

The confusion here is about two different types of SSO:

_Admin SSO (for managing Ory itself)_ - Ory is fundamentally an API. For self-hosted deployments, you control access however you want - through your infrastructure, reverse proxy, or using Ory Polis. This is not gated.

_Organizations SSO (for your end users)_ - This is the paid feature. It allows your B2B customers to bring their own identity provider. If you're building a SaaS product and BigCorp wants their employees to authenticate using Okta or Azure AD, Organizations handles that federation.

The distinction matters because maintaining integrations with enterprise IDPs is continuous work. For example Google randomly changes their OIDC implementation on a Saturday evening. Someone needs to wake up and fix that. For products serving other businesses at scale, that operational burden is real.

Organizations is one of the few areas where we charge, specifically targeting the B2B SaaS use case. If you're self-hosting for internal use or building a consumer product, you don't need Organizations. If you're selling to enterprises that require SSO, you're generating revenue to support the cost.

if you leave the admin APIs unsecured in production it is an attack vector, not sure what you would prefer being told here?

It says "When deploying Ory open-source Servers, protect access to their APIs using Ory Oathkeeper or a comparable API Gateway."

sorry to hear that, hope you have a better experience going forward. if you feel like it send me some details on what was most painful and we'll fix it.

Another problem is also that "standards" like OAuth2/OIDC are used for a thousand use cases that weren't intended by the authors, so people get really creative with them. Plus the spec itself is vague on many essential things, for example how logout should work. Thankfully I never had to implement SAML but I would guess it's even worse there...

if you are a masochist that is a great retirement project!

Check out Ory Polis if you want SAML/SCIM support: https://github.com/ory/polis

CAPTCHA is not in scope for Kratos, there are already great solutions out there that you can use

You can use other parts of the Ory ecosystem to add these features, such as Ory Polis for SAML/SCIM support: https://github.com/ory/polis

CAPTCHAs aren’t a big help anymore in my personal opinion, but you can easily integrate them on the frontend when using Kratos. The commercial offering just bundles all of this out of the box for you.

If Keycloak fits your needs well and you see no room for improvement, that’s perfectly fine; by all means use what works best for you.

you should check out Ory Polis if you are looking for SAML support in the OSS version: https://github.com/ory/polis

Ory Kratos itself doesn't support SAML that is correct.

However the newest addition to the Ory ecosystem, called Ory Polis (formerly known as BoxyHQ) does close that gap. It is also Apache2 licensed, do check it out here: https://github.com/ory/polis

i feel you; working with a heavily patched fork of anything can be rough check out the new version, i'm sure it has improved quite a bit since then. Of course simpler solutions than Ory Kratos exist, but they often come with other tradeoffs

sure, I would say its mostly correct. You can solve Permissions and API Gateway also differently - for example many use OAuth2 claims and scopes for permissions. I personally think that isn't good practice - like "first-party auth" I think its outside of the scope that OAuth2 was built for originally - but it works and many are used to building authz that way. You could also use the identity metadata on Kratos for permissions - this works well for simple RBAC usecases but if you want "large scale" and "finegrained" something like Ory Keto is probably the more reasonable choice.

Feel free to message me on the Ory Community Slack if you want to discuss further: https://slack.ory.com/

that's fair! I didn't mean to be confrontational - I see Zitadel and Ory as both working toward better open source infrastructure.

At Ory, features like high-availability setups, zero-downtime upgrades, large scale multi-tenancy, and formal SLAs are part of the commercial offering. In most cases, if you’re not operating Ory at large enterprise scale, you won’t need those.

It’s a reasonable tradeoff: the commercial offering covers the costs of maintaining those capabilities and helps fund continued open source development. Big organizations that rely on Ory in production should ideally help sustain the ecosystem they depend on.

Hey, if you want to share a bit more feedback would love to hear it! feel free to also message me directly if you don't want to share it here.

tbh i don't know too much about it other than that they moved away from the apache2 license recently

(disclaimer: I'm working for Ory)

It depends what your requirements are.

If you are "just" doing first-party login, session, and user mgmt then Ory Kratos is all you need. I would say in the majority of cases you would be fine with just Ory Kratos.

If you want 3rd party integrations, or become an IDP (think "login with $yourcorp"), or you migrate an existing system that relies on OAuth2 that you want to keep, or you have more complex auth flows where OAuth2 shines, then you want Ory Hydra.

If you want a "fine-grained" global, centralized authz system, complex and scalable authz as described by Google Zanzibar, then you want Ory Keto.

If you want to support SAML as well, you want Ory Polis.

If you want a "zero trust" setup, then you want Ory Oathkeeper.

That being said in almost all cases Kratos will be fine and you can pick and choose what you actually need.

Yea part of the motivation to create Ory Kratos was that Keycloak was too clunky and cumbersome for us to use, also hard to scale and a bunch of other issues - so we wrote our own basically.

(i work for Ory as DevRel)

Hey Dan, appreciate the discussion!

Ory’s setup is indeed true multi-region active-active; not just sharded or active-passive failover. Each region runs a full stack capable of handling both read and write operations, with global data consistency and locality guarantees.

We’ll soon publish a case study with a customer that uses this setup that goes deeper into how Ory handles multi-region deployments in production (latency, data residency, and HA patterns). It’ll include some of the technical details missing from that earlier blog post you linked. Keep an eye out!

There are also some details mentioned here: https://www.ory.com/blog/personal-data-storage

the most obvious is that abortions are illegal in the US and you can monitor that status through the app.

So in extreme cases if you are pregnant and the baby is going to kill you, you aren't allowed to abort it - get an illegal abortion - woops the app spied on me and now you are in prison.

thanks Dan!

To save you one click you can go here directly: https://slack.ory.sh/

(Disclosure: in charge of community at Ory ;-))

For me the normal video recommendations are awesome on Youtube, I regularly find very obscure super interesting stuff in my recommendations.

For shorts it is abysmal, I only get horrible recommendations there - no idea why it is so different.

https://en.wikipedia.org/wiki/Smolensk_air_disaster