Live data from Hacker News

Three things to never build yourself: auth, notifications, payments

courier.com

11–20 of 193 posts

Re: Three things to never build yourself: auth, notifications, payments

#13

This is a biased article. I would not let another company handle authentication or notifications for my apps. Payments, yes.

Sure, it is obviously biased – I started Courier because I think developers shouldn't be building their notifications infra themselves.

Why would you offload payments instead of e.g. connecting directly to payment gateways yourself, but wouldn't do the same for auth & notifications?

Re: Three things to never build yourself: auth, notifications, payments

#15
post #5

Regarding auth, I absolutely bought to JWT cool-aid but honestly if you're still on the monolith phase just use the most popular auth framework for your language. JWT adds a lot of complexity and room for misconfiguration, you do get something in return of course - it is stateless (hence scalable), works great with microservices, and improves your security model somewhat by separating issuing from verification. But y…

To make things easy I usually use "alg":"none". It makes using jwts a breeze.

https://datatracker.ietf.org/doc/html/rfc7518#section-3.6

Re: Three things to never build yourself: auth, notifications, payments

#16
Crap, I’ve done all three! Well, maybe not all at once though.

I can see why not to do notifications, but it’s hard to avoid doing some form of it if you’re making an app with focus on low latency realtime updates.

The bigger problem is that out of all three categories, I only really feel content with trusting Stripe, and only so much. Auth0 has its issues, and decent authentication systems you can roll on your own are plentiful. Maybe building it yourself no longer makes sense, but I do think owning your user database is a good idea, even if you do primarily lean on OAuth.

Re: Three things to never build yourself: auth, notifications, payments

#19

This is a biased article. I would not let another company handle authentication or notifications for my apps. Payments, yes.

Sure, it is obviously biased – I started Courier because I think developers shouldn't be building their notifications infra themselves. Why would you offload payments instead of e.g. connecting directly to payment gateways yourself, but wouldn't do the same for auth & notifications?

Payment has lots of legal pitfalls if done wrong not to mention the financial damage.
Post reply on HN