121–130 of 146 posts
I see you're using bcrypt for now with a salt cost of 10. How do you plan to: 1. Make sure you keep increasing the cost over time 1a. Maybe even newer algorithms 2. Update old password hashes, even if the user does not log in
Some people much smarter than me have written excellent articles about this topic: https://www.michalspacek.com/upgrading-existing-password-has...
Are you planning on implementing passkeys at all?
Earlier quoted context omitted.
First, incorporating Stack into your project is really easy if you use Next.js — literally just a single command: npx @stackframe/init-stack@latest If you use our managed hosting, we'll deal with deployment, backup, ... for you. . Anyways, here are a few things that you'd have to build for yourself but come for free with Stack Auth: - Session management, because you probably don't want to store passwords in cookies,…
Nice list. You came well prepared. > Email shenanigans — for example, some mail clients click verification links automatically to check them for spam and then even interact with the page What is the technical workaround for this issue? Do you check user agent?
what people smoke to do those features?
Could your service be a replacement for WorkOS. Currently I'm only using their Google OAuth and their Google SAML. I see that your SAML is paid only.
Any comparisons to Propel Auth? (Another YC funded auth service that seems to have lot of overlap here)
We use Ory right now, but it is very hard to setup and integrate into.
Hmm. Am I the only one who immediately jumps to the thought that any VC backed "open source" tool is just using open source as a cost of customer acquisition, and will soon find a way to pay-wall necessary features? The majority of the effort will be in the paid SaaS product, not the open source stuff. Maybe I'm getting old and jaded, but that's not really the spirit of open source.
Earlier quoted context omitted.
Nice list. You came well prepared. > Email shenanigans — for example, some mail clients click verification links automatically to check them for spam and then even interact with the page What is the technical workaround for this issue? Do you check user agent?
Check for cookies. If they exist, we can continue like normal. If not, require user interaction (none of the spam filters we tested click buttons, but from what I could gather, one of them — Outlook — moves the mouse).
Hmm. Am I the only one who immediately jumps to the thought that any VC backed "open source" tool is just using open source as a cost of customer acquisition, and will soon find a way to pay-wall necessary features? The majority of the effort will be in the paid SaaS product, not the open source stuff. Maybe I'm getting old and jaded, but that's not really the spirit of open source.
YC does an 'open source panel' every batch where people come to hear from founders of successful open-source startups in order to learn the ropes. I've attended 4 of those by now (I think), so I have a sense of what gets said about this stuff from within the YC space at least. I haven't heard anyone talk about ways to "pay-wall necessary features" or otherwise exploit users into paying. On the contrary, there's a lot…
Products are frequently over-complicated so self-hosting is difficult. There are often outright rug-pulls or dark patterns, keeping basic features behind their cloud offerings. The mega corps sometimes swoop in and take all the candy from the kids. Products are designed suboptimally, eg kubernetes native when they would be much better as a library. Then you have honest well meaning players who lose customers to self-hosting, because they need on-prem for security reasons, or simply because they want better debugging and logs.
Some varied examples off the top of my head include Docker, Hasura, Redis, Hashicorp, Benthos. My point here is combining small-medium sized businesses with a core FOSS product is full of perils, risk and unhealthy market dynamics. I’d assume the iceberg is also much bigger than these prolific projects, from companies that chose not to do FOSS in the first place.
This is really awesome. On almost every project I’ve worked on, I’ve never been able to trust and truly rely on proprietary services and companies to handle my authentication and authorization. I’ve been forced (i.e., it was already decided) to use Auth0 before and I hated every minute of it. Congratulations on launching Stack Auth and providing a better alternative!!!