Germán

Un rico pibe cualquiera.
Социальная справедливость

[Jaydeep @_jaydeepkarale]

Authentication & Authorization is beautiful. Every concept has a story. You just don't know it yet.

You build an API.

Anyone can call it. Anyone can read the data. Anyone can delete the records.

There is no "who". There is just "anyone".

So you add a password. Now the user proves who they are before they get in. That is Authentication. The oldest problem in computing, solved with a string you type and hope nobody guesses.

Your server checks the password on login and lets the user in. But HTTP has no memory. Every request arrives like a stranger. The server forgets them immediately.

So you create a Session. The server remembers the user server-side and hands them a Session ID. They send it back with every request. The server looks it up and recognises them.

One stable ID. One server-side store. It works until you have ten servers and no idea which one holds the session.

So you put Session state in Redis. Every server reads from the same store. The user can hit any server. The session survives.

Now you have mobile apps, microservices, third-party integrations. They cannot use cookies. They need something they can carry themselves.

So you use a JWT. A self-contained token with the user's identity baked in. No database lookup. The server verifies the signature and trusts the claims.

It scales. It is stateless. It feels elegant.

Then a user gets compromised. You want to invalidate their token. But the token is valid for 24 hours and there is no registry to check. You cannot un-issue a JWT. It is just out there, valid, until it expires.

So you make tokens short-lived. 15 minutes. You add a Refresh Token, long-lived and stored securely, used only to get a new access token.

Now revocation is possible. The refresh token hits your server. Your server can reject it. The 15-minute window is acceptable risk.

Your app needs to access the user's Google Calendar. You ask them for their Google password. They give it to you. You store it. Now you hold credentials you were never supposed to have.

So you use OAuth 2.0. Google asks the user directly. The user says yes. Google gives your app a scoped token. Your app never sees the password. The user can revoke access without changing their password.

Delegation, not impersonation. The right model.
You add OAuth. Users log in with Google. But now you need to know who they are, not just that they have access. The access token lets you call Google APIs. It does not tell you the user's name.

So you add OpenID Connect. An identity layer on top of OAuth. Google sends an ID Token, a signed JWT with the user's name, email, and a unique ID. Authentication and Authorization in one handshake.
Users are in. Now the question changes.

Not "who are you" but "what can you do".
You give every user full access. It is simpler. One user deletes the production database. Accidentally. They had no reason to have that permission. You had no reason to give it.

So you add Roles. Admin. Editor. Viewer. Each role has specific permissions. Each user gets a role. The Editor cannot delete. The Viewer cannot edit.

It works until you have 40 roles and nobody can explain what each one does.

So you write Policies. Not roles assigned to users but rules evaluated at request time. This user, this resource, this action, this time of day. OPA evaluates it. You get a decision. Access or deny.

Expressible. Auditable. Composable.

A user logs in with just a password. An attacker gets the password from a breach database. Your database was not the one that leaked. Your users reuse passwords. The attacker is in.

So you add MFA. A second factor the attacker does not have. A TOTP code from an authenticator app. A hardware key. A biometric. The password alone is no longer enough.

The attacker has the password. They still cannot get in.
A user gets a phishing email. A fake login page, pixel-perfect. They type their password and their TOTP code. The attacker relays both in real time. MFA did not save them. The fake site looked real. The user could not tell the difference.

So you use Passkeys. No password to steal. No code to intercept. The user's device holds a private key bound to your site's exact origin. A fake site is a different origin.

The key does not work there.

Phishing becomes structurally impossible. Not harder. Impossible.

Your services talk to each other inside the cluster. Service A calls Service B. But B has no way to know the request actually came from A and not from something that found a way inside the network.

You trusted the network. The network is not enough.
So you use mTLS. Both sides present certificates. Both sides verify each other. A service cannot lie about its identity. A compromised pod cannot impersonate a trusted service.

Zero Trust. Not because it sounds good in a pitch deck. Because the alternative is assuming your internal network is safe. It is not.

Authentication answers: who are you.
Authorization answers: what can you do.

Most teams get Authentication right and treat Authorization as an afterthought.

That is where breaches live. Not at the login page. In what you let authenticated users do after they are inside. The pattern across all of it is the same.

Every concept exists because the previous one had a gap. Sessions because HTTP is stateless. JWT because sessions do not scale. OAuth because passwords should not be shared. Passkeys because passwords should not exist.

Each one is a better answer to the same question.

"Who are you. And what are you allowed to do here."

[Ritesh Roushan @devXritesh]

The queue is what saves your notification system:

You should never let a campaign directly hit Push, Email or SMS providers with millions of requests.

A scalable design:

Client
↓
API Gateway
↓
Notification Service
↓
Kafka/Message Queue
↓
Notification Workers
↓
Provider Router
↓
Push/Email/SMS

The important pieces:

1. Queue everything

10M notifications become 10M events in a durable queue instead of 10M immediate provider calls.

2. Partition the workload

Partition by user ID, tenant, campaign or channel so workers can process notifications in parallel.

3. Rate-limit per provider

Each provider has different limits.

The Provider Router controls throughput so one campaign doesn't overwhelm downstream services.

4. Make delivery idempotent

Give every notification a unique notification_id.

Retries should never accidentally send the same notification twice.

5. Retry intelligently

Transient failure → exponential backoff → retry

Permanent failure → dead-letter queue.

6. Respect user preferences

Check opt-outs, channel preferences and quiet hours before delivery.

7. Track state separately

PENDING → PROCESSING → SENT
↘ FAILED → RETRY

Store delivery events asynchronously so analytics doesn't slow down the sending path.

8. Autoscale workers

Campaign spike → increase consumers.

Traffic drops → scale them back down.

The key idea:

Don't scale the API to handle 10M notifications.

Scale the queue + workers + provider routing layer.

[Juan Manuel @GeoffreyFirmin5]

@elcancillercom @esciclico Vi el programa. Me costó, pero lo ví entero.
Lo que sugiere Hadad, tal vez él sea parte de esa negociación con marginales del trumpismo, es de un infantilismo que te hace preguntar como hizo este tipo para convertirse en fronting del grupo Montoto.

[Sid Vina @SidVina]

Gente de Twitter: mí amigo Marto hizo este mapazo de las islas malvinas en estilo cartografía Tolkien/antigua. Vende sus láminas en su cuenta de ig marte.ilustracion. Corred mis pequeños elfos, corred. Le dan una re mano 🫡

[Vicky @vickytedije]

Leí un comentario en tik tok que decía “ahora no solo somos su papá, también somos su mamá?” Kjjjjjjj

[Mihai Chirculescu @m_chirculescu]

People with unlimited free tokens be like "you're doing it wrong"

[Raj Savaliya @s_r_x_9]

@m_chirculescu reminds me of “you are homeless? why don’t you buy a house”

[Lucas. @ruquitasluiz]

Obvio que sabe que Diego y Messi son más grandes, idiotas, pero en su corazón es su deber decir lo que dice, porque la gratitud y el amor no cuentan balones de oro. "Nunca lo voy a bajar del pedestal porque lo amo y me dio mucho", y punto. Hasta el tarado de Fantino lo entiende.

[Sebastián Lacunza @sebalacunza]

No amigo. Escribir bien es importante, acertar un nombre propio es el abc del periodismo, y que no haya filtros que frenen un error tan básico y otros varios que salieron en el lanzamiento habla justamente de la carencia de la que se jactan. Bienvenidos los verificadores, los usaremos con criterio. Nunca un verificador va a reemplazar la relación de un periodista con su fuente; el instante de la duda que te lleva a tirar del hilo.

[Fede Berg ✊🏻 @fedeberg80]

La verdadera noticia acá es que el FBI lee tus chats con la IA

[Lore 💙💛 @lorentuit]

Meza contó recien en TyC Sports que la dirigencia de Riber los separó, les puso una carpa con tres bicicletas en pleno invierno y que los empleados del predio los hicieron entrar al container.
Jaja club millonario vivir con grandeBLABLA 🤣🤣🤣🤣🤣🤣

[Manuel Olivari @ManuOlivari]

Cuando la IA tenga fuentes, llame, coteje, discrimine y chequee podemos tener esta discusión sin problemas.
El periodismo está justificadamente en debate, pero esa IA por ahora recopila.
No genera.
Mientras no lo haga, será parte de muchos debates pero no de este.

[Leo Brockman @Trozco1]

Boca tiene periodistas y tuiteros retrasados (cuando ven la granada gritan) que escriben para hinchas con lectura crítica. river tiene periodistas y tuiteros "inteligentes" (cuando ven la granada se le tiran encima) que escriben para hinchas retrasados.

[Sid Vina @SidVina]

imaginate que te gobierna gente que piensa que
propiedad privada = vivienda

[mei ꕤ @kvaramei]

que manera de restarle importancia a los logros importantes de otros deportistas solo porque no juegan al fútbol, ustedes no entienden la cantidad de chicas que se anotaron a jugar hockey solo por LUCHA AYMAR y que esta basura de mierda diga esto ??

[Ezequiel Kopel @ezekopel]

Si sacan a Netanyahu, este hombre que está acusando de antisemitas a dos documentalistas israelíes judíos será componente fundamental del próximo gobierno israelí

[guido @guido__ce]

El consumidor argentino cuenta con prendas de vestir más baratas pero decidió masivamente comprar menos y estirar la duración de sus guardarropas, probablemente invadido por una frenética conciencia ambiental.

[guido @guido__ce]

El presidente opinó que Mendoza todavía no le estaba robando suficiente a La Pampa.

[Allegretto 💚 @allegrettto]

Ese informe de Anthropic de los escenarios del trabajo en el futuro, onda, bueno, toda la vida se rotó el trabajo, los programadores tendrán que ser enfermeros jajaja ok. Otra genial es que la IA te ahorra este laburo y este y este pero te agrega el de CHEQUEAR SI HIZO TODO BIEN