Airbnb Engineering

Hey HN! Ege from Permify here. Permify is an open-source authorization service and policy engine based on Google-Zanzibar[0] with our own twist. Me and my co-founders have known each other for years since high school. And we love building things.

We have both worked with fortune 500 companies to small businesses [1], and every authorization system was unique. Yet we always tackle the same problems.

- Modeling the authorization logic was hard. As the product grows things get complicated very fast. So, it’s challenging to design a model that’s both easy to start with and future-proof. [2]
- Designing the architecture was a dread. It’s not a huge problem when you have a monolith. But when it comes to micro-services it’s a nightmare since authorization data is a subset of application data. [3]
- Authorization checks occur in so many places; like user interfaces, routers, API endpoints, database queries… So, choosing where to enforce authorization, and loading the authorization data is hard.

So, Permify syncs your authorization data as relation tuples with CDC(Change Data Capture) from Databases you want to a DB you point at.[4] And based on this data you can get boolean returns for your access control checks.

I know many alternatives had launched at HN over the course of time. So what’s the twist. What we concurrently encountered was orchestrating the authorization data was a nightmare.

What you can except from Permify in following months;

- Message broker to support more…

This release follows Airbnb posts describing their deep experience in React Native and why they ended up abandoning it:
https://medium.com/airbnb-engineering/sunsetting-react-native-1868ba28e30a

Based on the issues they've had with React Native [1] I believe they would've had a better experience with Dart and Flutter which also has a fast iterative dev experience with a productive language that lets you build both iOS and Android Apps from a single code-base. But in contrast to RN, Dart 2 is statically typed and AOT compiled into native ARM which enables better performance and doesn't have any of the JS VM issues Airbnb kept running into. I also prefer Flutter's x-plat approach of drawing all their widgets with Skia as it also mitigates the UI widget inconsistencies they would've had if they tried to wrap native widgets. Flutter widgets follow Material design by default but can also be themed to look like native iOS widgets (https://flutter.io/widgets/cupertino/).

React Native nails the development experience but is plagued with issues which isn't clear if it's because it's architecturally flawed or that it's just poorly resourced and Facebook only cares about resolving their own issues.

I've been burnt by the lack of support in React Native indiscriminately closing issues, which stopped me from wasting my time reporting any more issues and eventually stopped using React Native altogether.

I've been pleasantly surprised by Flutter, it does what it says on the tin,…

Two years ago, we founded Aserto to simplify authorization for developers. Authorization is critical and hard to get right, yet isn't a source of differentiation for most applications.

Google [1], Airbnb [2], Netflix [3], Carta [4], Intuit [5], and others have written about their authorization systems. It's clear that these are all significant undertakings by sizable teams. Most engineering organizations don't want to spend their precious cycles reinventing this wheel.

Over the last two years, we've collected a set of best practices that are common across these projects. We call these the Principles of Authorization [6]. Our goal has been to democratize these principles into an authorization service, and save you time and effort.

Topaz [7] is an open source authorization system you can use to start building robust authorization in minutes. It provides fine-grained, real-time, policy-based access control for modern cloud applications. You can deploy it as a sidecar or a microservice in your cloud, ensuring low latency to your application.

Topaz combines the best ideas from two cloud-native authorization ecosystems: OPA and Zanzibar. Read our blog post [8] for more on why we built Topaz.

Happy hacking!

[1] https://research.google/pubs/pub48190/

[2] https://medium.com/airbnb-engineering/himeji-a-scalable-centralized-system-for-authorization-at-airbnb-341664924574

[3] https://www.infoq.com/presentations/authorization-scalability/

[4]…

I have seen HN crowd hating R very similar to hating js. While I'm not getting into those details, I'd like to list a few reasons why I like R:

- RStudio is simply great. I know Python has got Jupyter notebook but RStudio makes a good IDE for anyone (even beginners).

- Python is great because it's easier for beginners to start doing magick without getting frustrated hence a good beginners language and it is more appropriate for R because anyone who wants to begin with Data Analytics, R is a lot easier - without trying to figure out how to install a new package, load a new package, make a plot or anything of that matter. Hence the fall out rate would be less.

- Tidyverse. Without denial, it's a better Universe than Marvel's cinematic universe. Not a single day in my job goes without using dplyr.

- While I've quoted tidyverse in general, ggplot2 - embracing the grammar of graphics has set a very nice standard for visualization libraries which matplotlib (the goto library of Python doesn't offer much)

- Pandas is nothing but a library built on Numpy to offer R like data wrangling functions hence I'd like to consider dplyr and R's inbuilt data manipulation functions superior.

There is no doubt that Python has its own advantages with single library scikit-learn and webservices, R is no way to be hated.

Even millenial companies have found interest in R …

A few examples I can think of off the top of my head:

- AirBnB uses a model to recommend a daily price for a new listing. They have to base this off the area and how other similar listings are priced.

- Uber has an entire team (maybe teams) dedicated to forecasting demand at a location/time, they distribute this information to divers so they can plan to be certain places at certain times to get more fares.

- Uber collects your location 5 minutes before/after your ride. They use this (at least in part) to figure out where people normally go when they request to be dropped off at an address, and then they can optimize the drop-off location using that information.

Really though, the trick is to find a problem that can be solved with machine learning, and where profit of the solution is multiple times the cost of developing it. The only way to spot these opportunities reliably is to have a lot of machine learning experience, and quite a bit of domain knowledge. It may be worth following some tech company ML engineering blogs to get a better grasp of how they leverage ML.

[1]: https://medium.com/airbnb-engineering/aerosolve-machine-learning-for-humans-55efcf602665

[2]: https://eng.uber.com/forecasting-introduction/

[3]: https://www.npr.org/sections/alltechconsidered/2016/12/01/503985473/uber-now-tracks-passengers-locations-even-after-theyre-dropped-off

I think this is an interesting approach, and I think many people in this thread are missing the point.

When you are a company that needs to maintain multiple clients across platforms (web, android, ios, and so on) it is very hard to be good at 3 things at the same time: application performance, development velocity and cross-platform consistency. Every solution that currently exists sacrifices some of the points to improve others. For example: If you make a web app across platforms, then you sacrifice performance on mobile; If you use native apps everywhere, you sacrifice development velocity and cross-platform consistency.

You might be wondering: isn't something like React Native or Flutter solve all those issues? Yes, on the surface it's a great fit. For only slight sacrifice in performance you get everything. That is why Airbnb have tried React Native initially, but decided to abandon it in the end due to technical and organizational issues (read mote here [1]).

This is their new attempt at getting good trade-offs here. You get full performance because you are doing everything natively. You get solid cross-platform consistency and high development velocity, because you are making changes in one place. Bravo Airbnb!

[1] https://medium.com/airbnb-engineering/sunsetting-react-native-1868ba28e30a