Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Stack Auth (YC S24) – An Open-Source Auth0/Clerk Alternative

github.com

Post reply on HN
Print view View original

101–110 of 146 posts

Re: Launch HN: Stack Auth (YC S24) – An Open-Source Auth0/Clerk Alternative

#101

Post by brianfryer »

n2d4 wrote: post #40
no1youknowz wrote: post #36

This is great. Competition is definitely needed in the Authentication/Authorization space. Quick question. How would this compare to supabase/gotrue [0] and permify [1]? [0]: https://github.com/supabase/auth [1]: https://github.com/Permify/permify

Supabase Auth is only authentication; it doesn't do organizations, permissions/RBAC, impersonation, etc. We are working on some fancy Postgres connectors to let you use Stack Auth with the DB part of Supabase and RLS. GoTrue and Permify are on a lower abstraction level than us; we connect the entire stack (from frontend to database), while GoTrue and Permify still require a lot of setup and manual integrations.

What’s your timeline look like on that fancy supabase connector?

Auth is literally the next thing I’m working on…

Re: Launch HN: Stack Auth (YC S24) – An Open-Source Auth0/Clerk Alternative

#102

Post by dang »

saled wrote: post #90

Hmm. Am I the only one who immediately jumps to the thought that any VC backed "open source" tool is just using open source as a cost of customer acquisition, and will soon find a way to pay-wall necessary features? The majority of the effort will be in the paid SaaS product, not the open source stuff. Maybe I'm getting old and jaded, but that's not really the spirit of open source.

YC does an 'open source panel' every batch where people come to hear from founders of successful open-source startups in order to learn the ropes. I've attended 4 of those by now (I think), so I have a sense of what gets said about this stuff from within the YC space at least.

I haven't heard anyone talk about ways to "pay-wall necessary features" or otherwise exploit users into paying. On the contrary, there's a lot of talk about how critical it is to be transparent and fair with your community. The consensus is that things tend to go well if you do that and badly if you don't.

The focus for these open-source companies is finding a natural way to carve out the free vs. paid parts of the space. By 'natural' I mean something that is a good fit for the domain and that both sides feel is fair. The free users know it's in their interest for the company to make money because that's how the whole thing is sustainable. People just need to feel that the paid product is one that it makes sense to charge for and that it's a fair exchange.

The most common way to do this is to open-source the product and offer a paid cloud offering. There are other approaches which I remember I found rather interesting, but unfortunately I forget the details because thanks to HN I never remember anything anymore!

But the main thing is no, not only are these founders not looking for ways to screw their open-source users, the seasoned ones are advising the junior ones to shy away from the slightest trace of that. The model by which an open-source company is making money needs to be as transparent and unimpeachable as possible.

One downside is that it's hard to get this right from the beginning, and changes can be messy. From what I've heard, the consensus is that if you keep a good relationship with your community at every step, and preserve transparency as an invariant, then it's at least possible to explain why a change is necessary and get through a messy phase that way.

Re: Launch HN: Stack Auth (YC S24) – An Open-Source Auth0/Clerk Alternative

#103

Post by lukevp »

n2d4 wrote: post #60
Alupis wrote: post #59

Regarding managed hosting - I don't see a mention of using your own custom domain anywhere. Did I miss it? Which tiers can use custom domains, if they are supported? Also, do you support m2m tokens, ie. client credentials flow? What are the limits, if any?

Our approach to sign-in pages is a bit different than Auth0's; instead of redirecting you to us, all of our components live on your very own website. The only time the browser will redirect to our domain is momentarily during the OAuth callback. We also don't brand our components, so your users may never even see that you use us for auth.

Is it possible for the OAuth callback url to be self-hosted on a free/OSS plan too? otherwise it would allow the cloud hosted app to intercept the token exchange flow of a client credential grant, wouldn’t it?

Re: Launch HN: Stack Auth (YC S24) – An Open-Source Auth0/Clerk Alternative

#104

Post by 8organicbits »

Can you explain the example in the docs?

    Here’s an example. To retrieve the current user, simply call:
    
    export function MyComponent() {
      const user = useUser({ or: "redirect" });
      return {user ? `Hi, ${user.displayName}` : 'You are not logged in'};
    }
    
    That’s it! Stack will either return a User object or redirect the user to the login page.
It seems like the "not logged in" message is dead code as the earlier logic would instead redirect to the login page. Am I misunderstanding something?

Re: Launch HN: Stack Auth (YC S24) – An Open-Source Auth0/Clerk Alternative

#106

Post by n2d4 »

8organicbits wrote: post #104

Can you explain the example in the docs? Here’s an example. To retrieve the current user, simply call: export function MyComponent() { const user = useUser({ or: "redirect" }); return {user ? `Hi, ${user.displayName}` : 'You are not logged in'} ; } That’s it! Stack will either return a User object or redirect the user to the login page. It seems like the "not logged in" message is dead code as the earlier logic would…

You're right. Thanks, fixed!

Re: Launch HN: Stack Auth (YC S24) – An Open-Source Auth0/Clerk Alternative

#107

Post by beachy »

erksa wrote: post #62
june07 wrote: post #52

Earlier quoted context omitted.

Surprisingly your the only one who has mentioned Keycloak so far?! I switched several projects from Auth0 to it some time ago and didn't look back... particularly when they started tightening things since said projects were not even profitable.

I'm also surprised with the lack of mention of keycloak. It's been great to work with, and immediately curious how it would compare.

It's heavy weight and has an industrial vibe, and does way more than any single user could want. Consumes 300M or so just to run.

I don't care. Transaction volumes to the auth are comparatively low and computers are cheap so keycloak is a good choice.

Re: Launch HN: Stack Auth (YC S24) – An Open-Source Auth0/Clerk Alternative

#109

Post by n2d4 »

conradludgate wrote: post #108

I see you're using bcrypt for now with a salt cost of 10. How do you plan to: 1. Make sure you keep increasing the cost over time 1a. Maybe even newer algorithms 2. Update old password hashes, even if the user does not log in

Some people much smarter than me have written excellent articles about this topic: https://www.michalspacek.com/upgrading-existing-password-has...

Re: Launch HN: Stack Auth (YC S24) – An Open-Source Auth0/Clerk Alternative

#110

Post by digitcatphd »

saled wrote: post #90

Hmm. Am I the only one who immediately jumps to the thought that any VC backed "open source" tool is just using open source as a cost of customer acquisition, and will soon find a way to pay-wall necessary features? The majority of the effort will be in the paid SaaS product, not the open source stuff. Maybe I'm getting old and jaded, but that's not really the spirit of open source.

Same here. I’d rather them be transparent with the price and just undercut them. Last ‘open source’ YC project I reviewed almost felt like a hidden trap paywall. If they could cut my bill in half I’d switch, there is no reason Auth0 should charge so much. On the contrary another YC project just cut their competitor pricing and we are using them.
Post reply on HN