Top all-time · #1128
Aaron Parecki
Personal blog · aaronparecki.com · on HN as aaronpkprogrammingwebsecurity
Aaron Parecki's personal blog at aaronparecki.com covers programming, web and security. Since 2012, 60 different Hacker News readers have linked it 87 times, most often “OAuth for the Open Web”. It is still writing: the last post was on 2026-10-31, and you can follow it by feed.
Sometimes recommended · 11 of 38 sampled comments recommend it?
Why HN links it
Aaron Parecki's blog explains OAuth 2.0, IndieAuth, Webmention and IndieWeb ideas, and MCP authorization. Commenters point to it as a clear explainer of OAuth and recommend it as a learning resource.
- Recommended for · 11 comments
- Called 'fantastic', 'comprehensive yet accessible', a 'very nice article' and a 'good writeup'; one says it has 'great ideas'.
Summarised by Claude from a sample of 38 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- OAuth for the Open Web7 people · 9 mentions · first linked 2018-07-07
- OAuth2 Simplified6 people · 6 mentions · first linked 2017-05-08
- Why I Live in IRC (2015)5 people · 5 mentions · first linked 2016-08-11
- Let's Fix OAuth in MCP4 people · 4 mentions · first linked 2025-04-08
- Enterprise-Ready MCP3 people · 4 mentions · first linked 2025-05-23
- /3 people · 3 mentions · first linked 2020-04-27
- /2018/03/12/17/building-an-indieweb-reader2 people · 2 mentions · first linked 2019-01-19
- IndieAuth now supports OpenID delegation2 people · 2 mentions · first linked 2013-09-16
- It's Time for OAuth 2.1 (2019)2 people · 2 mentions · first linked 2020-03-16
- /2 people · 2 mentions · first linked 2017-01-30
What Hacker News says?
> Most people understand these two things to be, collectively, the "provider" side of OAuth Citation needed. As another commenter already noted, the term "Provider" is rarely used in OAuth itself. When it is mentioned, it's typically in the context of OpenID Connect, where it refers specifically to the Authorization Server - not the Resource Server. > the service provider, who is providing an API that requires autho…
Comment linking /2025/04/03/15/oauth-for-model-context-protocol
on “Cloudlflare builds OAuth with Claude and publishes all the prompts”Submitted Why you should not be displaying relative dates. as a story · 213 points
HN discussionAs an example https://aaronparecki.com/ does it, but when it comes to documentation entry page https://activitypub.rocks/ and otherwise https://www.w3.org/TR/activitypub/
Comment linking /
on “Find your Twitter friends on Mastodon”Submitted OAuth for the Open Web as a story · 149 points
HN discussionI am a member of the W3C Social Web Working Group ( https://www.w3.org/wiki/Socialwg ), and have been organizing IndieWebCamp ( https://indieweb.org/ ) conferences in this space for the last 7 years. We've been making a lot of progress: * https://www.w3.org/TR/webmention/ - cross-site commenting * https://www.w3.org/TR/micropub/ - API for apps to create posts on various servers * https://www.w3.org/TR/websub/ - real…
Comment linking /2017/06/08/9/indieweb
on “Ask HN: What are we doing about Facebook, Google, and the closed internet?”Submitted How Does FreeConferenceCall.com Make Money? (2012) as a story · 142 points
HN discussionAaron Parecki, the author of the "OAuth 2.0 Simplified" book, wrote a blog post on the misunderstandings around Sign in with Apple: https://aaronparecki.com/2019/06/04/23/sign-in-with-apple-mi...
Comment linking /2019/06/04/23/sign-in-with-apple-misunderstandings
on “Sign In with Apple [video]”Submitted Why I Live in IRC (2015) as a story · 132 points
HN discussionSome of my favorites... * Tantek Çelik -> http://tantek.com and https://indieweb.org * Aaron Parecki -> https://aaronparecki.com and https://indieweb.org * Patrick (patio11) McKenzie -> http://www.kalzumeus.com * Moxie Marlinspike -> https://moxie.org * Scott Hanselman -> http://www.hanselman.com * Joel Spolsky -> https://www.joelonsoftware.com * Jeff Atwood -> https://blog.codinghorror.com * Gina Trapani -> http://…
Comment linking /
on “Ask HN: Which developers do you closely follow?”Submitted Thoughts on the Resiliency of Web Projects as a story · 107 points
HN discussionA nice, comprehensive yet accessible blog post about it can be found here[1], got submitted earlier[2] but didn't gain traction. [1]: https://aaronparecki.com/2025/04/03/15/oauth-for-model-conte... [2]: https://news.ycombinator.com/item?id=43620496
Comment linking /2025/04/03/15/oauth-for-model-context-protocol
on “Everything wrong with MCP”Submitted Let's Clarify Some Misunderstandings Around Sign in with Apple as a story · 107 points
HN discussionHas support for IndieAuth and/or FedCM (when stable enough) been considered? https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web https://github.com/fedidcg/FedCM
Comment linking /2018/07/07/7/oauth-for-the-open-web
on “Native Matrix VoIP with Element Call”Submitted Why I Live in IRC (2015) as a story · 97 points
HN discussionThis is fantastic. I've implemented OAuth2 4-5 times over the past few years. It seams overly complicated at first, but over time I've come to understand more of the vulnerabilities each piece of complexity exists to mitigate. Every time I've thought I could do it simpler, I eventually discovered a vulnerability in my approach. You get basically all that knowledge here in a concise blog post. This is going to be the…
Comment linking /2018/07/07/7/oauth-for-the-open-web
on “OAuth from First Principles”Submitted Improving Remote Meetings and Presentations as a story · 75 points
HN discussionI'll shoot you an email, and we can talk more if you do end up working on this. I'm not a big fan of pre-registered clients in the first place. Ideally any client should be able to talk to any OAuth2 server that speaks the same profile, ie endpoints and scopes. Aaron Parecki describes a way to allow "anonymous" clients here[0]. As I understand that's how IndieAuth is implemented. But I'm still relatively new to OAut…
Comment linking /2018/07/07/7/oauth-for-the-open-web
on “Show HN: SheetUI – Turn Google Sheets into Web Pages”Submitted Providing APIs for content-driven websites as a story · 36 points
HN discussion> In Keycloak nothing made sense to me until I got myself familiar with OAuth 2.0 and OpenID Connect. Hot take: OAuth2 is a really shitty protocol. It is one of those technologies that get a lot of good press, because it enables you to do stuff you wouldn't be able to do in standardized manner without resorting to abysmal alternatives (SAML in this case). And because of that it shines in comparison. But looking at i…
Comment linking /oauth-2-simplified/
on “Keycloak: Open-Source Identity and Access Management”Submitted Show HN: A graph of the languages you use on Github as a story · 35 points
HN discussionI don't actually believe JWT is useful for that, and indeed recommend something simpler like OAUTH2 (OpenID Connect) simply because it actually handles this use-case, and because it doesn't require any cryptography or anything complicated for a (junior) developer to consume correctly. EDIT: I just saw your spreadsheet. Perhaps you have gotten a bad impression of OAUTH2 by looking at some client libraries. Many of th…
Comment linking /oauth-2-simplified/
on “Things to Use Instead of JSON Web Tokens”Submitted Letsencrypt just sent an email containing all their users' email addresses as a story · 14 points
HN discussionDon't trust google on metadata recommendations, they change it way too often: https://aaronparecki.com/2016/12/17/8/owning-my-reviews
Comment linking /2016/12/17/8/owning-my-reviews
on “Solid aims to radically change the way web applications work”Submitted Let's Fix OAuth in MCP as a story · 11 points
HN discussionI wrote about how and why I switched to Gogs from GitLab and Bitbucket here: https://aaronparecki.com/2016/02/13/18/
Comment linking /2016/02/13/18/
on “Gogs – Go Git Service”Submitted Why not JSON? as a story · 11 points
HN discussionThanks for sharing my site! As you say, I'm quite big with IndieWeb, and for readers there are quite a few other folks you'll want to see - https://snarfed.org/ https://tantek.com/ https://aaronparecki.com/ and https://www.barryfrost.com/ to name just a few. If anyone is interested learning more about the IndieWeb, https://www.jvt.me/posts/2019/10/20/indieweb-talk/ is a transcript of a conference talk I gave on what…
Comment linking /
on “'Expert Twitter' Only Goes So Far – Bring Back Blogs”Submitted The Cause of the Sign in with Apple Zero-Day as a story · 8 points
HN discussionI think FDWs are not more used because they're not easy to get into. The best link/example I found was https://github.com/beargiles/passwd-fdw and it's quite easy to follow the code and understand all the moving parts. Once you've written a FDW you'll see them everywhere. In fact the same author wrote https://github.com/beargiles/zip file-fdw and https://github.com/beargiles/tarfile-fdw If you (still?) need inspirat…
Comment linking /2015/02/19/8/monitoring-cpu-memory-usage-from-postgres
on “The Splitgraph Data Delivery Network – query over 40k public datasets”Submitted OAuth2 Simplified as a story · 4 points
HN discussion
