Isn’t it also easier than ever to learn though? The moat that seniors built around their expertise enabled a juicy buffer of mediocre devs paid mediocre rates pushing up the value of mythical 10x engineers.
How can you tell a human actually understands? Prove to me that human thought is not predicting the most probable next token. If it quacks like duck. In psychology research the only way to research if a human is happy is to ask them.
> A shared secret removes the potential for detection from the service while asynchronous key signing does not.
I would approximate that 95% of the time when a webhook sender discusses signatures they are referring to HMAC (symmetric-key signing). There is a clear benefit to asymmetric-key signatures but that's not the focus of this article. It's discussing the industry convention of using symmetric-key signing.
> Thank you for helping me understand that I had missed context
My pleasure!
> The signing process retains private signing materials under the custody of the sender
In the signing process, with a symmetric key, the signing materials do not remain under the custody of the sender. Both parties need access to the signing key. If the consumer leaks the key they have to notify the sender and vice versa.
Asymmetric signing is used very sparingly in the context of webhooks.
Sorry if I'm misinterpreting your sentence a little too literally here.
> If you move authentication to the web hook implementer you lose control of what authentication mechanisms are in use
I don't understand where you are coming from. The article is comparing shared secret vs signing. In both those auth methods the "control" remains in the same place. The webhook consumer has to do the auth verification. The webhook sender mandates what authentication method is used.
Under none of these scenarios is the webhook consumer providing their own "authentication system".
The API producer will always retain ownership over the authentication mechanism.
The article is comparing the use of a shared secret vs HMAC.
For shared secret: Who specifies auth? The webhook producer. Who implements auth? The webhook consumer. For HMAC / signing it's exactly the same parties who do those things.
Discussions about mutual TLS and public keys are out of scope.
I would be curious too. I think it comes down to the benefits are there and they're cheap enough that they may as well recommend a more secure approach.
London
https://davidadler.pages.dev/
https://github.com/mfbx9da4
dalberto [dot] adler [at] gmail [dot] com