Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Better Auth is joining Vercel

better-auth.com

Post reply on HN
Print view View original

71–80 of 95 posts

Re: Better Auth is joining Vercel

#71

Post by sandeepkd »

whalesalad wrote: post #60
sandeepkd wrote: post #26

Earlier quoted context omitted.

Unfortunately its a common misconception, it feels easy, however auth is a lot more harder to do it right, specially when it comes to recovery. A simple example, protocol like TOTP (time based OTP) uses the concept of shared secret and almost every implementation stores the secret as it is in their databases

I gotta say, this is not a very strong argument for not doing auth yourself.

I never suggested not to do, this was not the intention. I was just sharing the fact that its not easy. Also doing auth can have different level of depths too so its highly subjective on goals.

Re: Better Auth is joining Vercel

#72

Post by Natfan »

aeneas_ory wrote: post #63
khurs wrote: post #50

Earlier quoted context omitted.

>Open source development needs to be paid by someone - most of the time people complaining about paying for software are working themselves (for money!) in some company making huge bucks, or looking up to "successful (as in money) tech leaders". There is software that is cutting edge and always changing, and those types of products need to be paid for much more than software that is stable. With a stable product like…

Auth is not stable, it‘s constantly changing and evolving and also a lot of work to keep secure, and scalable. Auth is critical infrastructure and certainly not free. Most companies with homegrown at some point go to a vendor because it is so much work to DIY. I can’t speak for Vercel‘s goals or pricing - but Ory is evidently still open source while many others went other routes!

i'm curious, outside of new models of authn (such as passwordless, totp, hash algos etc) and new models of authz (rbac, zero trust, etc), what else is "constantly changing"?

even the items i mentioned only change every 5 years or so, in my experience. i accept that there will be a lot of work preventing attackers from gaining unauthorized access, but again this feels partially solved by just rejigging the authn flow (rather than username -> password -> totp (leads to password sprays), just do username -> totp -> password)

Re: Better Auth is joining Vercel

#73

Post by Natfan »

vaishnavsm wrote: post #28
nvegater wrote: post #16

Earlier quoted context omitted.

how is this related to better auth ? In my understanding, keycloak and better auth are fundamentally different. I would compare keycloak more with Ory for example.

Keycloak and Better Auth aren't as fundamentally different as you may think! Better auth supports authn/z, being an identity _source_, being an identity provider, being an OIDC/SSO provider (so others can login using better auth), rbac, SAML/SCIM, and a ton more. It's actually really powerful! Most folks found better auth as an alternative to next-auth/auth.js - but better auth does a lot more than those. (some of th…

so better auth would be more analagous to microsoft entra (formerly azuread)?

Re: Better Auth is joining Vercel

#74

Post by jschorr »

kommunicate wrote: post #70
vaishnavsm wrote: post #38

Earlier quoted context omitted.

If you're willing to take the pain of setting up an actual authz model, I've found OpenFGA^ to be really nice. We used it to set up some pretty complex authz involving cross-agent/user/org creation and sharing of data. It's not _simple_, but it is effective. It's Apache 2.0 and a CNCF incubating project. [^] https://openfga.dev/

Thank you. This is very interesting. I'm excited to see an open source project adopt a zanzibar-oriented approach to resource management. This is exciting! Just before I hurl myself at this for several days/weeks -- where were the pain points? I'm usually wary of new projects in this space but OpenFGA looks pretty mature already

The main pain points around using a Zanzibar-like approach (typically called Relationship-based access control) are:

(1) The need to write relationships and keep them updated in the permissions database. Often, this requires writing to both the application database and the permissions database, at the same time. On the SpiceDB side, we provide a Postgres FDW [1] to make this easy IF your application data lives in Postgres

(2) Representing complex permissions in ReBAC schema can be a challenge (at first) if you're coming from an ABAC system - you need a slightly different mental model for ReBAC, where (as its name implies), permissions are reachable via the relationships between objects, rather than attributes on objects.

(3) ACL-aware searching: this is a very hard problem in authz in general and gets slightly harder with ReBAC. The separation of the search index and the permissions database makes it harder to integrate and computing permissions, at scale, is incredibly complex. For SpiceDB, we have Materialize to help solve this problem [2].

[1] https://github.com/authzed/spicedb/tree/e9d636d2b58dd9e92c44...

[2] https://authzed.com/docs/authzed/concepts/authzed-materializ...

Disclaimer: I'm CTO and cofounder of AuthZed and we build SpiceDB (https://spicedb.io), the most scalable OSS implementation of Zanzibar

Re: Better Auth is joining Vercel

#75

Post by jenius »

mooreds wrote: post #19
whalesalad wrote: post #11

Auth is not hard to roll yourself. Crypto: don't do it. Auth? Easy peasy.

Oh man, it really depends(tm). If you are building a small internal app, sure, but you'd often still be better off leveraging a social provider or employee directory. I work in the auth space (for FusionAuth) and we run into plenty of folks that started out rolling auth themselves. Just username and password right? A bit of hashing, salting and leveraging a built-in crypto library. But then you need to add account re…

I work at Clerk - same opinion here. Rolling your own auth is a trap. It's super easy when you are just getting started with your product and I cannot count how many times I have seen developers boast about how they rolled their own auth and now they aren't "locked in" to a vendor and are saving tons of money etc.

But the truth is, if you scale up as a company, it will end up costing you more in engineering salaries to re-create and maintain all the auth features you will need to support like @mooreds mentioned above than just using an auth library/vendor in the first place. And if you don't scale up, you are unlikely to push outside of the cheap or free tiers of any auth vendor you do go with, so it's a wash. Every reputable auth vendor has a pretty generous free tier.

It feels scary to go this direction because what happens if you blow up and then it becomes ultra expensive and now you're "locked in". All the time I see developers put hundreds of thousands, or millions of MAU into an auth vendor's pricing calc then gawk over the projected monthly bill and decide to roll their own. But the reality is that this doesn't happen. By the time you have that many MAU, you're typically paying out many multiples of that in engineer salaries alone, and paying an auth vendor a fraction of a single engineer's salary to handle your auth is substantially better value than hiring a team to build and maintain your own from scratch.

We have churned our fair share of large company customers over the years, as has every other auth vendor. They have all been because they needed feature we didn't have, not because the price was too high.

Re: Better Auth is joining Vercel

#76

Post by tough »

so does anything change or will change for better-auth FOSS consumers? Or not really and that mostly depends on what Vercel imposes as new direction going forward? I guess vercel is a good home for foss projects, at worst they'll make first class adoption on their ecosystem without actively hampering others etc

Re: Better Auth is joining Vercel

#77

Post by tough »

andix wrote: post #67
nightski wrote: post #57

Open source isn't really open any more. It's just pre-acquisition. I'm happy to the creators for their payday but honestly just happy I opted out of BetterAuth building my latest product.

Is it about the license? I see less and less new projects using GPL, and a lot of MIT(ish) licenses. Most complex open source projects like Linux for example have a lot of contributions by corporations. The GPL kind of forces them to participate in open source, instead of just creating internal forks. GPL and even LGPL are tricky for libraries though.

I think it's more about the bait and switch marketing optics of offering a "core" part of your codebase as "FOSS" to get the extra brownie points by doing so, while it's at the same time littered with caveat emptors, and imports from "enterprise licensed" code for the features that business care about.

Also all the "commercial open source" or COSS seems to lean into that, its a valid strategy to monetize open source, but should be done transparently and being very upfront about its bait-y nature to businesses or enterprises imho

Re: Better Auth is joining Vercel

#78

Post by Jnr »

tough wrote: post #77
andix wrote: post #67

Earlier quoted context omitted.

Is it about the license? I see less and less new projects using GPL, and a lot of MIT(ish) licenses. Most complex open source projects like Linux for example have a lot of contributions by corporations. The GPL kind of forces them to participate in open source, instead of just creating internal forks. GPL and even LGPL are tricky for libraries though.

I think it's more about the bait and switch marketing optics of offering a "core" part of your codebase as "FOSS" to get the extra brownie points by doing so, while it's at the same time littered with caveat emptors, and imports from "enterprise licensed" code for the features that business care about. Also all the "commercial open source" or COSS seems to lean into that, its a valid strategy to monetize open source,…

> "features that business care about"

I don't see companies using open source lining up to support the developers. Good for developers to come up with some monetization strategies to keep their software alive.

Re: Better Auth is joining Vercel

#80

Post by [deleted] »

Jnr wrote: post #78
tough wrote: post #77

Earlier quoted context omitted.

I think it's more about the bait and switch marketing optics of offering a "core" part of your codebase as "FOSS" to get the extra brownie points by doing so, while it's at the same time littered with caveat emptors, and imports from "enterprise licensed" code for the features that business care about. Also all the "commercial open source" or COSS seems to lean into that, its a valid strategy to monetize open source,…

> "features that business care about" I don't see companies using open source lining up to support the developers. Good for developers to come up with some monetization strategies to keep their software alive.

[deleted]
Post reply on HN