Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Better Auth is joining Vercel

better-auth.com

Post reply on HN
Print view View original

41–50 of 95 posts

Re: Better Auth is joining Vercel

#41

Post by andrewstuart2 »

vaishnavsm wrote: post #34
khurs wrote: post #7

Reminder - KeyCloak was donated to CNCF so a safe choice https://www.keycloak.org https://www.cncf.io/blog/2023/04/11/keycloak-joins-cncf-as-a...

I really want to love KeyCloak. I've had really bad experiences with weird uptime bugs and crash loops that kept me from giving it an honest retry over the last couple years. It also really shows its age, imo. The interface is clunky, roles and groups having overlapping responsibilities is confusing, making custom UIs for it makes me feel ancient, etc. I really can't complain though. There is simply no alternative th…

Showing its age is also a pretty significant plus, for such a critical part of one's infrastructure. That means it's been beat up on and run through the ringer for a decade plus at this point and had lots of chances to fix CVEs and other bugs. Not to say there won't be more, but being older and time-proven for an IdP is a major positive.

Re: Better Auth is joining Vercel

#42

Post by aeneas_ory »

jzebedee wrote: post #32
nvegater wrote: post #16

Earlier quoted context omitted.

how is this related to better auth ? In my understanding, keycloak and better auth are fundamentally different. I would compare keycloak more with Ory for example.

It's a good reminder, because in the auth landscape I wish I had just picked up Keycloak and stuck with it. Commercial auth is a bad value proposition and not the kind of infrastructure where you want to have acquisition churn happening often. The self-hosted space is another headache. I wasted so much time trying to make smaller self-hosted auth solutions work, since Keycloak has a reputation for being heavyweight.…

Probably the first time reading that the Ory stack is unfinished! Sorry you had a frustrating time, but there's 10 years of development and many happy customers + adopters who see it differently! Polis / Boxy still works as before, we didn't gut or take away anything.

Open source development needs to be paid by someone - most of the time people complaining about paying for software are working themselves (for money!) in some company making huge bucks, or looking up to "successful (as in money) tech leaders".

For Ory, B2B login is a good value differentiator, because it's required by companies selling to other companies meaning they can spend some money on licenses to further develop software.

Ory powers the largest technology providers, and super small solo projects. It's robust, stable, Apache2 licensed. It's the best CIAM tech out there that's free (!!).

In the end, everyone is entitled to their opinion but the "open source can't make money" train is honestly a bottom tier opinion and I'm tired of reading it on HN, probably written by people making $100K+ a year for writing software and using open source daily (without paying a dime).

It's like the people complaining that Wikipedia is collecting too many donations, while they cheer on Apple or Anthropic or whoever raking in billions of dollars.

Somehow, only if it's open source / non profit it's bad to make money. If it's proprietary nobody gives a damn. Says a lot about society.

Re: Better Auth is joining Vercel

#43

Post by zuzululu »

lackoftactics wrote: post #37
zuzululu wrote: post #33

im amused that people are still relying on third party for handling auth when you can roll your own now with LLMs

It's one of those things you shouldn't trust LLMs to such an extent; that part should be very solid because the consequences of bad practices are getting to front page of hacker news :)

depends what LLM you are using but most frontier models have seen almost every github/doc/best practices its very hard to get something like supabase/lovable type of mess unless you purposely prompt it to be bad without much inner knowledge but even then it is rectifiable with the right prompts

Re: Better Auth is joining Vercel

#44

Post by whalesalad »

mooreds wrote: post #19
whalesalad wrote: post #11

Auth is not hard to roll yourself. Crypto: don't do it. Auth? Easy peasy.

Oh man, it really depends(tm). If you are building a small internal app, sure, but you'd often still be better off leveraging a social provider or employee directory. I work in the auth space (for FusionAuth) and we run into plenty of folks that started out rolling auth themselves. Just username and password right? A bit of hashing, salting and leveraging a built-in crypto library. But then you need to add account re…

This is kinda like the ORM vs no-ORM argument. I think that off-the-shelf auth will accelerate your development for sure (like an ORM) but eventually, you are going to feel constrained by the framework/tool you are using. You will need to work around it. You will find that using it 'correctly' results in poor performance, and so you deviate here and there. Pretty soon you tell yourself, "man I should have just used SQL" or "man, I should have just rolled my own auth". At least ~20 years of software dev has taught me this.

For an MVP or a prototype, I think it's okay to use an off-the-shelf tool. For something serious that will have long-term legs, I would do it myself. I hear all of your concerns and arguments and agree there are a lot of footguns. But again, having spent the better part of my adult life using and interfacing with these tools, I have an innate understanding of how to model auth correctly (separate it from the user, separate users from an 'org' or 'team' entity, etc).

You said it though, 'it depends' is really the right answer here.

Re: Better Auth is joining Vercel

#45

Post by mavelikara »

oooyay wrote: post #29
bekacru wrote: post #23

Bereket Here the team at Vercel has been my biggest inspiration and always reflected many of the reasons we started working on Better Auth. This would allow us to focus more on what made better-auth great in the first place It hasn't even been 2 years since we started but thank you everyone from the open-source community for helping us make an impact in short amount of time. There is a lot to do to improve on open so…

You're saying that BetterAuth will remain 100% free and open source, will continue to be maintained, and unlocked from Vercels ecosystem?

You are asking the wrong person.

Re: Better Auth is joining Vercel

#48

Post by slig »

notatoad wrote: post #22
fnoef wrote: post #20

Ah, here we go again. Glad I decided to roll my own auth rather then using some library. I had a feeling that eventually they will join Vercel.

Yeah, we rolled our own auth as well. Everybody says you shouldn’t, it’s a risk, etc etc. but to me that’s less risk than our auth getting bought by somebody whose business goals don’t necessarily align with mine.

The data lives in your server, everything is yours, if that happens, you just fork or write your own. Not sure what writing yourself first buys here.

Re: Better Auth is joining Vercel

#49

Post by slig »

zuzululu wrote: post #33

im amused that people are still relying on third party for handling auth when you can roll your own now with LLMs

It's not third party, it's a library you use and you store the data. Got tired of it? Write your own, the data is there.

Re: Better Auth is joining Vercel

#50

Post by khurs »

aeneas_ory wrote: post #42
jzebedee wrote: post #32

Earlier quoted context omitted.

It's a good reminder, because in the auth landscape I wish I had just picked up Keycloak and stuck with it. Commercial auth is a bad value proposition and not the kind of infrastructure where you want to have acquisition churn happening often. The self-hosted space is another headache. I wasted so much time trying to make smaller self-hosted auth solutions work, since Keycloak has a reputation for being heavyweight.…

Probably the first time reading that the Ory stack is unfinished! Sorry you had a frustrating time, but there's 10 years of development and many happy customers + adopters who see it differently! Polis / Boxy still works as before, we didn't gut or take away anything. Open source development needs to be paid by someone - most of the time people complaining about paying for software are working themselves (for money!)…

>Open source development needs to be paid by someone - most of the time people complaining about paying for software are working themselves (for money!) in some company making huge bucks, or looking up to "successful (as in money) tech leaders".

There is software that is cutting edge and always changing, and those types of products need to be paid for much more than software that is stable.

With a stable product like Auth (which requires only security fixes and minor features), the 'pay per MAU' model employed across Auth companies is unreasonable

A combination of the people and companies using the product for free or selling its support (like RedHat and IBM for KeyCloak) along with an open license allowing it to be offered as a cloud service should be sufficient?

If you want to pay per monthly active user for the rest of your life, up to you.

Vercel have raised multiple rounds, last one was in 2025 and $300m. So we don't know what the VC's are going to demand for revenue targets. https://en.wikipedia.org/wiki/Vercel

Post reply on HN