this post was submitted on 25 Jun 2023
353 points (99.2% liked)

Programmer Humor

19704 readers
124 users here now

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

founded 1 year ago
MODERATORS
 
top 21 comments
sorted by: hot top controversial new old
[–] most_likely_bollocks 18 points 1 year ago (1 children)

It’s really not that hard. Authentication is about proving the identity of the subject e.g. logging in using information only known / in possession by the subject (password, mfa etc). Authorization is about establishing what permissions that identity has in a given context. E.g. is this identity allowed to create/read/update/delete these resources. Authorization is typically done through roles (RBAC) or more granulary through attributes (ABAC).

[–] [email protected] 12 points 1 year ago (1 children)

Now how does this compare to AuthN and AuthZ...

Holy crap after writing that AuthN must be authentication and AuthZ must be authorization.

I'm a genius.

[–] most_likely_bollocks 3 points 1 year ago

Indeed you are ;)

[–] [email protected] 15 points 1 year ago

Just call it a11n or a12n and nobody will know if they can't count or if you can't count

[–] [email protected] 10 points 1 year ago (1 children)

And even with 'AuthN' vs 'AuthZ' it always takes me a minute to spell them out and work out which is which

[–] [email protected] 5 points 1 year ago (2 children)

What's this authN / authZ business?

[–] RandomDevOpsDude 9 points 1 year ago* (last edited 1 year ago) (2 children)

AutheNtication vs. AuthoriZation, I believe

[–] [email protected] 3 points 1 year ago (3 children)

How's that supposed to help?

[–] [email protected] 16 points 1 year ago* (last edited 1 year ago) (2 children)

AuthN is: I claim to be dreadgoat, but how can I prove it? (login, password, mfa)
AuthZ is: Now that you know I am dreadgoat, do I have permission to post this comment? (access control, roles, attributes)

[–] [email protected] 3 points 1 year ago (1 children)

I know what they are and the differences, I thought the N and Z would somehow be an easy way to work it out/remember. But the trick is just to remember which is which.

[–] [email protected] 1 points 1 year ago

N comes before Z in the alphabet, and you must always AuthN before you can AuthZ. Easy mnemonic.

[–] RandomDevOpsDude 1 points 1 year ago

This is a great explanation, thank you.

I deal mainly with authorization and I'm not sure I've ever had the differences explained this simply (so I incorrectly lump them together)

[–] [email protected] 1 points 1 year ago

It doesn’t

[–] [email protected] 2 points 1 year ago* (last edited 1 year ago) (1 children)
[–] RandomDevOpsDude 1 points 1 year ago

Ahh, that would make more sense, thank you - corrected

[–] [email protected] 6 points 1 year ago

That's the thing, nobody really knows!

[–] bsdGuy0 6 points 1 year ago* (last edited 1 year ago)

Who doesn't like compounding two words with different meaning by definition, but for some inexpiable reason have the same meaning in the programming world, by shortening them?

Now the poor, average programmer has to deal with strange words. One such example is "permission," which is normally used within a casual context, rather then within a more serious context, like a program handling secure data. The poor programmer can now no longer take his job seriously, and is now forever in an existential crisis, due to the lack of formality. ;)

[–] [email protected] 5 points 1 year ago

I made a class one time called Auther that did both. Got some chuckles in the code review so I was pretty happy with that

[–] nibblebit 3 points 1 year ago

Access Control