I've never worked at a place where the code was "good".

OIDC is a layer on top of OAuth...

Yes. But it’s authentication, whereas OAuth is authorization.

I kinda disagree. Authentication is at OAuths core. You still need to authenticate to obtain a token and in more complex setups you don’t use it for authorization at all because tokens are stale immediately after issuing them. It’s why things like Zanzibar and OPA have been made.

It’s really not. OAuth makes zero assumptions about how you login - granted, the client credentials flow is a form of authentication if you will, but for the user perspective, OAuth starts when you’re signed in. That’s also why you can easily combine it with all kinds of authentication providers.

> OAuth makes zero assumptions about how you login

Neither does OIDC: "The methods used by the Authorization Server to Authenticate the End-User (e.g., username and password, session cookies, etc.) are beyond the scope of this specification."

OAuth makes zero assumptions about a lot of things, like even how you "authorize". That doesn't mean that authentication doesn't play a crucial role. While it doesn't specify how you authenticate the user it still specifies that you must authenticate the user. Outside of the authorization code flow, other flows strictly mandate that you should authenticate the clients.

Amdahl’s law.

Yes.

Let's say it was critical for the business, with no viable alternatives? I'm all for "find a way or make one" but there are times when you need to be more practical than dogmatic.

Would love to hear your thoughts

Sometimes in business you ultimately and unavoidably have to eat shit, so it is what it is. But you should strive to be someone who doesn’t have to eat shit, and until then, if you still gotta eat shit, then try not to make a habit of it.

Well said :)

Well, if you start accepting eating shit in a new way you’re only fooling yourself you won’t accept it again.

> Let's say it was critical for the business, with no viable alternatives?

If its that critical for you why are you rolling the dice on a general email and ... waiting for an email back and forth? Something so important as a vender "license" deciding if your company succeeds or fails should not rely on an email sent to an address pulled on their website.

Find a contact, a human, drive (or fly) to their office and make an in-person appointment, show they are important to you. Otherwise that game of AI email tag should be more than enough to tell both parties just how not serious the whole thing is.

This might be dogmatic, but I genuinely don’t care. Outside of the business not caring enough to get a human to respond, I just don’t want to give money to people using LLMs. The technology is based off of theft from the working class. It’s the same reason I choose union businesses.

This is why I’ve thought that MCP and LLM access never made sense. You’re moving your users out of your brand and out of product.

Some companies are taking the opportunity to use the MCP server to send messages to the agent that the user won't necessarily see to protest. Agents are generally incredibly gullible and a huge opportunity for this type of thing.

Java has had plugin isolation libraries for decades.

Most of which run the code in a subprocess and use IPC.

Not in my experience

Care to provide a counter-example?

Can they produce decent code at all?

sad days

It’s awful. A ton of words to say absolutely nothing.

I do not understand why anyone would want an LLM to cosplay as them on a forum. I get maybe (selfish) idle curiosity but beyond that…?

I don’t know why anyone just blatantly copies and paste LLM output. Laziness? Anxiety about being wrong? I don’t know.

Well that’s corner cutting/avoiding work so I can see it. But commenting on forums?