Live data from Hacker News

Three things to never build yourself: auth, notifications, payments

courier.com

21–30 of 193 posts

Re: Three things to never build yourself: auth, notifications, payments

#21
post #3

Letting other people handle Auth and Notifications is a great way to get the rug pulled out from under you.

Exactly, how are all the Auth0 customers feeling about that acquisition?

unclear if we will all have to switch off Auth0 with the acquisition but I've built a company with Auth0 as the auth provider and definitely would not take it back, saved us so much time and allowed us to focus more time on product market fit

Re: Three things to never build yourself: auth, notifications, payments

#22
post #19

Earlier quoted context omitted.

Sure, it is obviously biased – I started Courier because I think developers shouldn't be building their notifications infra themselves. Why would you offload payments instead of e.g. connecting directly to payment gateways yourself, but wouldn't do the same for auth & notifications?

Payment has lots of legal pitfalls if done wrong not to mention the financial damage.

FWIW given GDPR, CCPA, et al so do auth & communication. I'd honestly have a big problem with our team wanting to store passwords ourselves...

Re: Three things to never build yourself: auth, notifications, payments

#23

This is a biased article. I would not let another company handle authentication or notifications for my apps. Payments, yes.

> notifications for my apps

What kind of notifications are we talking about where you can get away with self-hosting? AFAIK, Push Notifications on smartphones have to go through Google and Apple's servers. Maybe if you're doing email notifications?

Re: Three things to never build yourself: auth, notifications, payments

#24

Earlier quoted context omitted.

Exactly, how are all the Auth0 customers feeling about that acquisition?

unclear if we will all have to switch off Auth0 with the acquisition but I've built a company with Auth0 as the auth provider and definitely would not take it back, saved us so much time and allowed us to focus more time on product market fit

In the end this is the whole goal of something like stripe, or even something like Courier. Let your engineers spend more time on PMF and building cool new features.

Re: Three things to never build yourself: auth, notifications, payments

#26
post #3

Letting other people handle Auth and Notifications is a great way to get the rug pulled out from under you.

That's not true at all. Most vendors, if you make them specify it in a contract, will provide you with a way to export the hashes and some vendors support importing users with existing hashes. Okta in particular will import existing hashes.

My company moved to Okta from a home grown solution in 6 months and I suspect after the work we put in place to facilitate that would allow us to move somewhere else in even less time as long as they supported importing hashes.

Re: Three things to never build yourself: auth, notifications, payments

#27
Never outsource Auth. Maintain control over user accounts. That's the life blood of your business. If you have to ask everyone to reset their password because your auth provider increases their pricing or goes out of business, the churn will likely kill your company.

I would say the same for Stripe, but at least they'll help you migrate off their platform. Auth providers cant help you because the passwords are hashed... You need the same algo or you cant authenticate using the data they have.

And the only way off without a mass password reset is a silent migration in the background: migrate the user when they login.. but we all know that will take months and you will never get 100% to login during the migration period.

Pick an auth provider and you better believe in their business as much as your own. You will incur damage when you leave.

Re: Three things to never build yourself: auth, notifications, payments

#28
post #19

Earlier quoted context omitted.

Payment has lots of legal pitfalls if done wrong not to mention the financial damage.

FWIW given GDPR, CCPA, et al so do auth & communication. I'd honestly have a big problem with our team wanting to store passwords ourselves...

You don't store passwords. And regarding GDPR, I have problems giving sensible data to third parties. Another point of failure and no control for me what happens to the data.

Re: Three things to never build yourself: auth, notifications, payments

#29
post #19

Earlier quoted context omitted.

Sure, it is obviously biased – I started Courier because I think developers shouldn't be building their notifications infra themselves. Why would you offload payments instead of e.g. connecting directly to payment gateways yourself, but wouldn't do the same for auth & notifications?

Payment has lots of legal pitfalls if done wrong not to mention the financial damage.

Both auth and notifications get extraordinary complex at even minimal scale. Obviously each business needs to decide which areas make sense to invest from tech perspective but LinkedIn and AirBnB each spend around $20m/year just on their notification systems.

https://medium.com/airbnb-engineering/airbnbs-promotions-and...

https://engineering.linkedin.com/blog/2018/03/air-traffic-co...

Post reply on HN