TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Cedar: A New Policy Language

12 点作者 cjg超过 2 年前

3 条评论

rendaw超过 2 年前
IAM policies are yet another example of something that started as a &quot;simple&quot; declarative specification, then people realized it wasn&#x27;t actually simple and started tacking on poorly thought out language constructs until it became a new awful embedded turing complete language.<p>Rather than make a new language, they should have made a WASM or eBPF API and just let people use the full power of whatever language they want.<p>&gt; Cedar is written in Rust, which makes it run in milliseconds<p>This statement is so weird. Milliseconds isn&#x27;t particularly fast, and does that mean it runs in that time span regardless of complexity?
vlmutolo超过 2 年前
I like the Datalog-based policy language used in Biscuits.<p><a href="https:&#x2F;&#x2F;www.biscuitsec.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.biscuitsec.org&#x2F;</a>
Taikonerd超过 2 年前
So, &quot;like IAM but generalized to all cloud providers&quot;?<p>My worry is that there will be statements that only make sense with one cloud provider -- like, you&#x27;re running on Google Cloud, and you want to make some declaration that only makes sense in Google Cloud. But I guess Cedar wouldn&#x27;t allow that?<p>It&#x27;s like SQL libraries: the ones that are supposed to be database-agnostic usually have some escape hatch to say &quot;I need to call this Postgres-specific function.&quot;