« first day (2624 days earlier)      last day (28 days later) » 

8:55 AM
Faith in humanity.. further depleted:
-2
Q: How to deal with medical information about a new applicatant

John DoeI'm working in a small team at a (growing) startup, and have been asked about a developer applying who worked at my previous company. He started after I left, so I didn't get to know him personally. However, I get on well with my former colleagues and had met them occasionally, so I'd heard some ...

 
not only it's none of his business, but it's only a rumor, which may be exaggerated/deformed
 
I'm taking a wild stab in the dark here that this is a made-up question.
 
@Snow yeah could be.. in which case my faith in humanity still goes down, just for different reasons. I mean what kind of person makes up crap like that just to ask it here? The mind boggles
 
You haven't been here for very long, have you?
 
@Snow lol I know it happens, I just still don't understand why
 
9:07 AM
This is the internet, people type for the joy of being heard.
 
10:01 AM
geez.. spam question deleted by the community in less than a minute
that's some goin!
 
By mistack i accept two offers now can i choose one what ever i want? — user105818 9 mins ago
not sure if made-up or just dumb
 
@Kepotx methinks the misleading nature of the question was an intentional move to try and avoid owning up to the "mistack" of accepting both
 
TL:DR; "Did I screw up?"
short answer: yes
 
10:56 AM
Hmmmmmmm. So if I process a GDPR personal info deletion request for a user/client, how can I actually confirm to that user that this was done? If I actually carried out the request I wouldn't know how to contact them any more... If I mail or call them then by definition I still possess PII on them at the time...
Schrodinger's GDPR? :)
 
@Lilienthal The notification to them that you've deleted the PII is considered part of your audit log and so long as it is retained and "used" only for that purpose you're fine
the right to erasure doesn't cover holding/processing PII for purposes such as recording compliance
 
11:33 AM
Hello...
 
11:48 AM
@MisterPositive Due to GDPR, I'm forbidden to answer you.
 
GDPR....
hmm
first cup of coffee FWIW
Anyone worked with Identity Server 4?
 
12:04 PM
@MisterPositive a bit.. been a couple of years though
 
12:31 PM
@motosubatsu Hah, good to know. ;)
 
@Lilienthal no worries.. GDPR is a tangled mess of seeming contradictions, general vagueness and steaming cow manure
it's kinda hard to work out up from down with it sometimes
 
12:58 PM
@motosubatsu Looking at this for SSO
 
@MisterPositive should do the job pretty well - are you planning on integrating with external providers?
(google auth etc)
 
1:16 PM
@motosubatsu definitely with Win AD
but probably not Auth0 and the like. ( at least not yet )
 
1:38 PM
@MisterPositive if you were only doing AD integration then it's overkill IMO - but if you think there is a possibility of adding another provider down the line (even if it's only a possibility) it will save you pain in the long run
 
1:57 PM
Well, for me @motosubatsu I need to secure API's as well as add seemless log in to apps that live inside and ourside our DMZ
AD for sure, but I token based security, with expiration, etc.
that works for both AD and non AD sites.
 
yeah Identity Server sounds like a clear win there
 
@motosubatsu yeah....and some of our interfaces need it too. GIANT implementation
and of course Core compatible.
remember any gotchas or sources for coding advise?
Where is @RoryAlsop when you need security counseling?
 
nothing that comes to mind.. the docs are pretty well written :)
 
Good deal. I may pick your brain from time to time if you don't mind :-)
 
no probs :)
I assume you're familiar with standard ASP.NET Identity ?
 
2:13 PM
You rang?
I haven't been a programmer for 20 years or so, so these new languages are a bit alien to me. I'm happy with C, COBOL, Forth, Pascal and other proper languages :-)
 
2:41 PM
@RoryAlsop LOL
@RoryAlsop Getting ready to do an Identity Server Implementation...
Just thought of you and hadn't chatted with you in a bit
@motosubatsu Somewhat. I will be when I am done though...
 
@MisterPositive I'd say it's worth giving yourself a refresher on that as a first step
 
Roger that. Identity Server built on top of that or part of it?
 
@MisterPositive sort of the first thing.. but not quite
 
{please continue}
 
Identity Server provides the authentication middleware - but you're going to need something to authenticate against
a list of users and their permissions (aka "claims" in Identity lingo)
 
2:51 PM
Ah I see.
 
by using ASP.NET Identity you'll get all that - in a way that pretty seamlessly correlates with how IdentityServer works
you could roll your own of course
but why bother when Microsoft have done the hard work for you ?
 
So...most of our applications currently use AD for Authentication. We have another app that uses standard User and PWD against a SQL Server DB, and then one that is internal only ( for now ) that isn't secured at all
The boss said he want SSO
:-)
So I am/was thinking Identity Server 4 as part of the solution
 
is the plan for everyone who uses these to have an AD login?
 
@motosubatsu probably not
I was thinking hoping we could do AD on Azure and essentially gain single sign on through that
AND
we may SAAS our applications and have to use their LDAP for Authentication while we handle authorization
 
3:07 PM
if you're AD is on azure and you may have users without AD logins then Identity Server is just the ticket :)
 
@motosubatsu Good, I was hoping I was on the right track.
 
you basically (ha!) implement IdentityServer as what's termed a "Federation Gateway" (no it's nothing to do with star trek)
 
@motosubatsu Star Trek!!!
 
Azure or on-prem AD then become an "external" authentication provider to the IdentityServer
so they use one login screen but login with whatever account they have
 
@motosubatsu So far we are in sync
 
3:11 PM
you use ASP.NET Identity to provide the user store for the IdentityServer (which is absurdly easy - they clearly intended you to do that)
that does bring a gotcha to mind actually
 
@motosubatsu do tell
por favor
 
when you're acting as a Federation Gateway you need to handle what happens if the user signs out of the external provider directly
i.e. not through your IdentityServer sign out page
it varies from provider to provider but IdentityServer has docs to cover the scenario
 
yeah I got a lot or reading to do and a few plural sight courses I will be taking
 
@MisterPositive yeah there's PluralSight courses specifically around IdentityServer IIRC
they might be worth adding to the list
 
There are and they are on my list
as in today
and the next few
 
3:18 PM
googling on the subject can get confusing - particularly around any ASP.NET Identity aspects, there was a significant change when it went to v2 and if you come across old info you can get lost very quickly!
 
@motosubatsu yeah getting lost in the weeds sucks
don't wanna do that
 
3:34 PM
@motosubatsu Are you voting at the IPS?
 
3:52 PM
@MisterPositive already voted :)
you?
 
4:06 PM
@MisterPositive happily voted
 
I also voted. From looking at the questionaire votes, it seems there's a clear favourite.
 
@Snow oh, I didn't check those votes. [scurries off to have a look]
 
lol. We were talking yesterday about people who vote on these elections without looking at the meta questions/answers for the nominees...
 
4:25 PM
New badges ahead , for people who like badges.
Jon Ericson on June 18, 2019

Analytical

Documentation badges

Tumbleweed and Reversal

Julia Silge’s analysis demonstrated that the Tumbleweed badge wasn’t serving its purpose.

Meg Risdal is our Product Manager who led us to make these changes.

Jane Willborn wrote the code.

Nick Craver made sure the Lifejacket and Lifeboat triggers don’t break the site.

Ben Voigt suggested the trigger we used first for Winter Bash hats and now for two new badges.

A bunch of people tested those triggers on our sites and prodded us to keep considering something like these new badges. We also got a bunch of feedback about Reversal and especially Tumbleweed that helped us understand how they worked in practice. We’ve got an amazing community here! …

 
4:39 PM
The new badges are being retrospectively award now, so you may see some badges appear for your old answers and wonder what the heck they're about.
3
 

« first day (2624 days earlier)      last day (28 days later) »