Tag: Authentication

En abril de 2021 hice mi primer commit en el monorepo de la plataforma cloud-native de CARTO. Era el PR número 9, un docker-compose. Cinco años después he mirado hacia atrás con calma y me he encontrado con unos 450 commits, unos 447 pull requests y presencia en prácticamente todos los servicios del repositorio.

Lo interesante no son las cifras. Lo interesante es que, revisando ese historial, aparece un hilo conductor que yo mismo no había identificado del todo: he pasado media década conectando la plataforma a data warehouses ajenos. Seis proveedores distintos —BigQuery, Snowflake, Redshift, Databricks, Oracle y PostgreSQL—, cada uno con su propio modelo de credenciales, su pooling, sus timeouts y sus mensajes de error.

In April 2021 I made my first commit to the monorepo behind CARTO’s cloud-native platform. It was PR number 9, a docker-compose. Five years later I’ve looked back with some calm and found around 450 commits, around 447 pull requests, and a presence in virtually every service in the repository.

The numbers aren’t the interesting part. What’s interesting is that, going through that history, a thread shows up that I hadn’t fully identified myself: I’ve spent half a decade connecting the platform to other people’s data warehouses. Six different providers — BigQuery, Snowflake, Redshift, Databricks, Oracle and PostgreSQL — each with its own credential model, its pooling, its timeouts and its error messages.

The Problem We All Know (But Pretend Doesn’t Exist)

As someone who has managed web infrastructure for decades, I’ve seen too many bots pretending to be what they’re not. User-Agent: “Mozilla/5.0 (Windows NT 10.0; Win64; x64)” when in reality it’s a Chinese scraper sucking up your content at 3 in the morning.

Traditional methods for identifying legitimate bots have been, let’s be honest, pathetic:

• IP ranges: That change, are shared, or are spoofed
• User-Agent headers: That anyone can forge in one line of code
• Reverse DNS: That works until it doesn’t

Today Cloudflare announced that it’s integrating HTTP Message Signatures directly into its Verified Bots program. And after reading the technical details, I have to admit something: this could definitively change the rules of the game.