4 ms·

I'm not a big fan. I think the advantages of rolling your own fully custom auth outweigh the simplicity of a plug-and-play framework like this. Sure, there mig

I'm not a big fan. I think the advantages of rolling your own fully custom auth outweigh the simplicity of a plug-and-play framework like this. Sure, there might be some use-cases and I can see why people might opt for it, but not me...

davedx 2y ago
Yup, come to the same conclusion. I browsed the source of this project, in particular the password hashing and encryption, it seems overcomplicated compared to a KISS bcrypt implementation. I’ve also spent way too much time integrating Auth0 on previous projects, and I now think the cost/benefits of using third party auth is very debatable.
neilv 2y ago
I've rolled my own before (including implementing several distinct F500 SSO variants atop it). I'm sympathetic to the benefits of that, but I think most Web developers would get the nuances of it wrong, to the point of increasing both system downtime and security vulnerabilities. That said, I recently went to add off-the-shelf JS/TS authn to a new SvelteKit app, looking at a few different packages, and was surprised how rough it was to do any method other than sell out your users to adtech companies just a little bit more. (The last off-the-shelf auth framework I used, for Python Flask, was more straightforward to add, and for a rich feature set.) So there seems to be an opportunity to do better.
- mckirk 2y ago
  Did you take a look at Lucia? If so, what were your thoughts on it?
  - neilv 2y ago
    I think I'll probably use Lucia for my second attempt, though initially Auth.js looked like it would work more rapidly out of the box. (I threw out the first attempt, and decided that my most urgent needs, for standing up the beta site and then showing previews for prospective partners, only needed a mix of Nginx HTTP Basic Auth and then simply non-public URLs. Which I could do in minutes, and would also have lower friction for partners to look at. Once authn for normal users percolates back up the project management urgency-sorted backlog, I'll take another quick look at off-the-shelf options, in case there's changes, and then expect I'll probably go with Lucia. Or maybe this Better Auth will be looking like what I want.)
- bschmidt3 2y ago
  [flagged]
  - neilv 2y ago
    ">" is a convention for verbatim quotes. Please don't use it for paraphrasing. Also, please try to avoid uncharitable interpretations, as well as ad hominem attacks. HN guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - madeofpalk 2y ago
      FWIW, it is a verbatim quote from their bio. Using one’s bio to dunk on them is an age old tradition. Comment is still insufferable. Perfect caricature of SF HN tech bro.
      - neilv 2y ago
        > FWIW, it is a verbatim quote from their bio. Using one’s bio to dunk on them is an age old tradition. That's not what was paraphrased. > Comment is still insufferable. Perfect caricature of SF HN tech bro. I believe that a related idea, "Don't roll your own crypto[graphy]", is widely accepted good advice. Authentication in Web systems overlaps with that, and has a bit of the same nature. Though the nuances in Web systems aren't as hard as the nuances can get in cryptography math and protocols, and in computer implementation of same. Still, it's much harder than it looks, to get sufficiently right. Most people don't have time for that. Personally, I take both seriously. I don't touch cryptography implementation myself directly. And lately (as I said in the original comment), I'm trying to use off-the-shelf Web authentication. Because, as I implied, it's hard get all the nuances right. Aside: "Dunk on" of other commenters sounds to me like contemporary social media personal attack sport, which I'm trying to avoid on HN. When I stopped by HN on Saturday morning, to get a little startup business mindset/enthusiasm, before spending the day working on an indie Web project, I wasn't looking to have a reasonable assessment called "insufferable", by some random new account. (A new account of someone who seems to be having a bad day, and getting off on the wrong foot with HN, with every single of their 6 comments attacking other commenters.) And then, after I tried to respond reasonably constructively to them, some other person, who might've misread the situation, jumps in, to double-down for the new account. Maybe all 3 of us would like to start the day over, and not spread bad day contagion further?
deleted 2y ago
[deleted]

davedx 2y ago

Yup, come to the same conclusion. I browsed the source of this project, in particular the password hashing and encryption, it seems overcomplicated compared to a KISS bcrypt implementation. I’ve also spent way too much time integrating Auth0 on previous projects, and I now think the cost/benefits of using third party auth is very debatable.

neilv 2y ago

I've rolled my own before (including implementing several distinct F500 SSO variants atop it). I'm sympathetic to the benefits of that, but I think most Web developers would get the nuances of it wrong, to the point of increasing both system downtime and security vulnerabilities. That said, I recently went to add off-the-shelf JS/TS authn to a new SvelteKit app, looking at a few different packages, and was surprised how rough it was to do any method other than sell out your users to adtech companies just a little bit more. (The last off-the-shelf auth framework I used, for Python Flask, was more straightforward to add, and for a rich feature set.) So there seems to be an opportunity to do better.

mckirk 2y ago
Did you take a look at Lucia? If so, what were your thoughts on it?
- neilv 2y ago
  I think I'll probably use Lucia for my second attempt, though initially Auth.js looked like it would work more rapidly out of the box. (I threw out the first attempt, and decided that my most urgent needs, for standing up the beta site and then showing previews for prospective partners, only needed a mix of Nginx HTTP Basic Auth and then simply non-public URLs. Which I could do in minutes, and would also have lower friction for partners to look at. Once authn for normal users percolates back up the project management urgency-sorted backlog, I'll take another quick look at off-the-shelf options, in case there's changes, and then expect I'll probably go with Lucia. Or maybe this Better Auth will be looking like what I want.)
bschmidt3 2y ago
[flagged]
- neilv 2y ago
  ">" is a convention for verbatim quotes. Please don't use it for paraphrasing. Also, please try to avoid uncharitable interpretations, as well as ad hominem attacks. HN guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - madeofpalk 2y ago
    FWIW, it is a verbatim quote from their bio. Using one’s bio to dunk on them is an age old tradition. Comment is still insufferable. Perfect caricature of SF HN tech bro.
    - neilv 2y ago
      > FWIW, it is a verbatim quote from their bio. Using one’s bio to dunk on them is an age old tradition. That's not what was paraphrased. > Comment is still insufferable. Perfect caricature of SF HN tech bro. I believe that a related idea, "Don't roll your own crypto[graphy]", is widely accepted good advice. Authentication in Web systems overlaps with that, and has a bit of the same nature. Though the nuances in Web systems aren't as hard as the nuances can get in cryptography math and protocols, and in computer implementation of same. Still, it's much harder than it looks, to get sufficiently right. Most people don't have time for that. Personally, I take both seriously. I don't touch cryptography implementation myself directly. And lately (as I said in the original comment), I'm trying to use off-the-shelf Web authentication. Because, as I implied, it's hard get all the nuances right. Aside: "Dunk on" of other commenters sounds to me like contemporary social media personal attack sport, which I'm trying to avoid on HN. When I stopped by HN on Saturday morning, to get a little startup business mindset/enthusiasm, before spending the day working on an indie Web project, I wasn't looking to have a reasonable assessment called "insufferable", by some random new account. (A new account of someone who seems to be having a bad day, and getting off on the wrong foot with HN, with every single of their 6 comments attacking other commenters.) And then, after I tried to respond reasonably constructively to them, some other person, who might've misread the situation, jumps in, to double-down for the new account. Maybe all 3 of us would like to start the day over, and not spread bad day contagion further?

deleted 2y ago

[deleted]