Pinned Tweet
It's not easy to describe what a developer advocate does, so I wrote this booklet to explain it to anyone who's interested (and to clarify it for myself, too).
Download it now and let me know what you think! It's free! 👇
leanpub.com/i-am-a-developer…
Andrea Chiarelli retweeted
Many developers treat OpenID Connect as a black box until something breaks.
My second Dometrain course is live. It breaks apart the flows, JWTs, token signing and PKCE.
Thanks @nickchapsas and @dometrain
dometrain.com/course/getting…
#OpenIDConnect #OAuth #OIDC #Dometrain #MVPBuzz
"On-Behalf-Of" (OBO) names a pattern.
OAuth Token Exchange (RFC 8693) is the standard that formalizes it.
Microsoft's OBO flow predates it and isn't RFC 8693-compliant.
Why that distinction matters for AI agents: auth0.com/blog/on-behalf-of-…
I’ve just released a new version of identiflows.dev (even though it’s Friday).
A new look and feel, new diagrams (though many are still missing).
As always, your feedback is very welcome.
Enjoy!
identiflows.dev/
Andrea Chiarelli retweeted
Regarding the Danfoss refrigeration systems hacked in France:
The username is `admin`, and the password automatically changes every day to... the current date.
Yes, today's date.
The French supermarkets affected in today's attacks had exposed all its refrigeration controllers directly to the internet.
Every single device reportedly used the same password: today's date...
There's also a documented authentication bypass: sending a POST request to /xml.cgi can bypass the login entirely.
Via: GossiTheDog
I shared this "little sad story" in a meetup to point out that the core of AI agent security comes down to one rule: don't grant permissions it shouldn't have.
Andrea Chiarelli retweeted
AI agents didn’t invent the Confused Deputy problem. They just gave it a much bigger blast radius. 👀
Learn how a bug from 1988 is showing up again in agentic systems, and what developers can do about it.
Read the blog by @andychiare ⬇️ auth0.com/blog/confused-depu…
Just launched identiflows.dev, a visual reference site for identity protocol flows like OAuth 2.0 PKCE.
Built to save time when you need to double-check exact sequences, it's an early release with 8 flows so far.
Try it out and share your feedback!
Andrea Chiarelli retweeted
The first app I built with my 8 years old son hit the App Store today.
It’s an app to learn new languages, build for kids by a kid. It’s fun, and they can learn vocabulary and conversations they can use with other kids.
apps.apple.com/us/app/lingo-…
I’m super hyped about it!
It’s all local-first, no cloud, no data collection, fully private, and with strong parental tools.
Enjoy!
What do a 1988 compiler & modern AI agents have in common?
The 'Confused Deputy' flaw.
Here's why AI brings it back & how to fix it (spoiler: prompts won't save you): auth0.com/blog/confused-depu…
Part 4 of my secure agents series is out!
Learn how to use CIBA for secure expense report approvals with Microsoft Agent Framework and Auth0.
Check it out!
auth0.com/blog/building-secu…
Part 4 of my secure agents series is out!
Learn how to use CIBA for secure expense report approvals with Microsoft Agent Framework & @auth0.
Check it out!
auth0.com/blog/building-secu…
Authorization isn’t short on terms: MAC, DAC, RBAC, ABAC, ReBAC, and ACLs overlap across the same lifecycle.
Stop treating them as competing models on a flat list.
Read more: idpro.org/authorization-term…
Andrea Chiarelli retweeted
13 community, un evento.
Il 4 dicembre torna la .NET Conference 2026 alla Microsoft House di Milano: 2 track, 16 sessioni e partecipazione gratuita.
Iscrizioni e Call for Speaker sono aperte.
👉 dotnetconference.it/
#dotnet #community
ALT Locandina illustrativa dell'evento, del quale mostra nome e data di svolgimento
Andrea Chiarelli retweeted
4.9 percentage points higher verified task quality. 67% lower estimated cost.
Project HydraFusion delivered those results against Claude Opus 5 on Terminal-Bench 2.1 in controlled offline evaluations.
HydraFusion orchestrates the models and workflow for each coding task. You select it like any other model. ⬇️
github.blog/ai-and-ml/github…
We are in the context of "who verifies the verifier?"
anthropic.com/research/forma…
Authorization terminology is a total mess after years of rapid evolution. It’s time to take stock, clean up the language, and fix it.
Read my new article on @idpro_org blog: idpro.org/authorization-term…
Andrea Chiarelli retweeted
latest episode of making software podcast is out!
with a familiar face for the @auth0 channel: @jesstemporal !!
we talked all things career, AI workflow, and home made pasta. (link in thread)
I'm excited to share that I got my CIDPRO Certification!
credly.com/badges/dfa05d62-5…
