Author here. This is a really insightful comment, and I think there are a few things I should have mentioned in the two articles to help explain why I feel this

Author here. This is a really insightful comment, and I think there are a few things I should have mentioned in the two articles to help explain why I feel this is needed a bit more. I've been working with Flask for a long time now, and like you, I really appreciate how flexible and free it is, compared to heavier frameworks that force a lot of stuff on you. I'm of the opinion, however, that user data, particularly, should be handled for me automatically. My reasoning is this: - It's really scary to be responsible for user data and security -- it's very hard to do properly. For a lot of HN readers, bcrypting stuff is an afterthought, but for many developers, this is challenging and confusing. - The way you setup your user database / relationships matters, a lot. It has a huge performance affect on every other page of your site / app, and many people don't realize this when they're developing stuff. I've always felt like authentication is one of those things that should be completely black-boxed, to give developers the following: - Faith in their security, without understanding the underlying representations of data. - Transparent user scaling. This one is critical, in my opinion, because many people don't realize how quickly user data becomes a problem since it relates to almost everything else. So, to summarize, while I do love Flask's flexibility, etc., I've always felt like having that flexibility applied to user stuff, in particular, is a bad choice, as it's incredibly easy to mess up, and the stakes are very high.