Hacker News

Top stories

Live mirror
30 storiesupdated just nowView source snapshot
  1. GPT-6 Sol and Luna(openai.com)
    366comments
  2. Claude Opus 5.5(anthropic.com)
    608comments
  3. OpenAI GPT–6 Astra breaks Enigma message that has resisted solution since 2005(cryptocellar.org)
    331comments
  4. SAML: A Fractal of Bad Design(trailofbits.com)
    3comments
  5. Claude Opus 5.5 Intelligence, Performance and Price Analysis (Max)(artificialanalysis.ai)
    43comments
  6. WordPress: Unauthenticated path traversal leading to conditional RCE(github.com/wordpress)
    50comments
  7. Unreal Agent(unreallabs.ai)
    17comments
  8. There's a high chance of devices being sold with GrapheneOS preinstalled in 2027(grapheneos.social)
    74comments
  9. OpenAI is well positioned to fast-follow Jev(arcturus-labs.com)
    159comments
  10. Overreliance on AI contributed to missile strike on Iran school – Pentagon(bloomberg.com)
    74comments
  11. Obscura: The first VPN that can't log your activity(obscura.com)
    discuss
  12. Launch HN: Coverage Cat (YC S22) – Umbrella insurance via your personal agent(coveragecat.com)
    20comments
  13. 16-bit Intel 8088 chip (c. 1985)(allpoetry.com)
    12comments
  14. Native apps written in TypeScript and CSS(github.com/geastack)
    discuss
  15. Writing Rust code that's fast by asking agents to make the code faster(minimaxir.com)
    39comments
  16. Apple has added persistent 'ads' to iOS, and it's driving users crazy(techradar.com)
    369comments
  17. George Lucas Returns to Earth, Bearing Gifts(commonedge.org)
    12comments
  18. Solitaire Alone Together(solitairealonetogether.com)
    25comments
  19. Show HN: Drop – A rootless Linux sandbox with gVisor support(droprun.sh)
    44comments
  20. Show HN: AI·rete·RAG – a Rete rule engine decides, RAG explains why(ai-rete-rag.com)
    2comments
  21. Can gzip be a language model?(nathan.rs)
    138comments
  22. Explaining to business people why building software is still hard(manager.dev)
    8comments
  23. One Minute Park(oneminutepark.tv)
    5comments
  24. A Faster Shortest Path Algorithm(vals.ai)
    discuss
  25. A study of sequence weighting at scale(janestreet.com)
    1comments
  26. AMD's random number generator can't generate a 0?(flatassembler.net)
    174comments
  27. The Economics of Open-Weight Inference(ornn.com)
    25comments
  28. Truman World(trumanworld.live)
    31comments
  29. Show HN: InstinctFlash – Run 5B world-action models in real time on Jetson Thor(github.com/general-instinct)
    2comments
  30. Relativistic raytracing(publish.obsidian.md)
    5comments

SAML: A Fractal of Bad Design

40 pointsby 1h agoblog.trailofbits.com
3 comments
30m agoHN ↗

Eh, if you don't have SAML support, I can find a product that does. Not a problem. \o/

(Or to be more clear, it is mostly unacceptable for an enterprise product to have opinionated decisions about what authentication it works with. You either work with what we use or you are not viable as a product for our need. It's kinda simple. I would expect someone whose authentication was OIDC-based to be similarly dismissive if you told them you only would do SAML.)

16m agoHN ↗

That mindset is indicative of security theatre to me. But as security theatre is common in entrprise IT that does not surprise me.

8m agoHN ↗

This is only a reasonable stance at the very surface level.

1. "You either work with what we use" - so whatever organization you represent isn't capable of evaluating and shifting to more secure technologies?

2. "it is mostly unacceptable for an enterprise product to have opinionated decisions about what authentication it works with" - you think companies that care about security should not care about integrating with flawed protocols?

A potential customer making bad choices does not obligate a business to make bad choices for their business.