Posted by bundie 5 days ago
Glazing over, I just wanted to give props and say that whatever good happens to better-auth, it deserves it.
Launch HN: Better Auth (YC X25) – Authentication Framework for TypeScript - https://news.ycombinator.com/item?id=44030492 - May 2025 (106 comments)
Better Auth – Authentication library for TypeScript - https://news.ycombinator.com/item?id=42272707 - Nov 2024 (32 comments)
Show HN: Comprehensive authentication library for TypeScript - https://news.ycombinator.com/item?id=41678652 - Sept 2024 (44 comments)
better auth gives off the same shape. that gets well adopted because it survives scaling without needing a rewrite
same pattern and diff origin place. someone holding the whole stack in their head long enough to ship something
Not saying better-auth is strictly better, but at least you can read the docs and know what you're getting into yourself instead of 12 variations of the same thing
I am also interested on how they plan to monetise it. I love the library and the success story but hope that the weight of this VC money doesn’t impact its awesomeness
There are times when Cognito makes a ton of sense (I wrote about some of them here[0]). There are other times when it doesn't.
What I keep wondering and asking is "why doesn't AWS invest more in Cognito?"[1]
0: https://fusionauth.io/blog/how-to-migrate-from-cognito#when-...
It most certainly will at some point.
Any more I'm missing?
It's almost always part of the box not the chocolates, and so is an excellent candidate for outsourcing. I can see why companies attack this space.
Definitely /s
How is your lack of geographical knowledge relevant to any of this?
It doesn't matter where the country is located on the map. If you happen to be a citizen of a developing country, your opportunities are extremely limited, and that is why I'm curious how he managed to get into the US and make a startup out of something that doesn't make sense to be one.
Do people in the US still think that people living abroad are playing with rocks and sticks all day when they are not hunting for food?
Is YC not super competitive and in order to get in you and your co-founder would have to have graduated from some super prestigious university ala MIT?
The DX is quite nice, even though not well suited for existing projects as it is hard to migrate existing users. There is no easy way to keep existing sessions or do a legacy login, then migrate a user to the new better-auth supplied hashing function.
I found this https://better-auth-ui.com/
But those who hadn't started using better auth more. And now I guess its crazy how I felt as if this would be just a small project like lucia in the sense of its just created for the passion and the art, but now it has raised 5 mill$ , I wonder if the community wanted this to be an artisanal like project like lucia before its end or what the community thinks of this move. Since VC and open source have some inherent compromises with each other and I guess I just wanted to write this to hear more about people who are using better auth in prod and what they think of what this VC funding.
I agree so much with the enshittifcation but like, I never understand why atleast open source projects need VC funding/ if they really want to earn money, might as well bootstrap it and try to get some Business customers for support etc.
But if you are saying that to get business customers, I need vc funding, then I guess it forces some enshittifcation.
I am okay with having a SaaS solution but what I truly don't understand is why we need vc funding.
I truly love developers wanting to earn money with open source. I appreciate them because they are essentially giving us gifts and being altruistic and I want to live in a world where people who can, do support them. But I am not okay with is some corporation now deciding the direction to go for open source (and that corporation doesn't care about the craft or the community, they want money.. they want returns since its just a number to them really) and that force of direction really alienates communities and just forks appear and just tbh it becomes messy.
I am more than curious as to why enterprises want VC funded OSS products. Yes you rely on them for a longer amount of time, but it also increases the chances of rugpull quite significantly imo. I don't think that one should just get VC funding just because entreprises like it. Should they?
Maybe I am so alienated with startup culture but I just want anything I build to not burn piles of cash that I need to rely on someone else, and I'd rather be profitable from (day one?) with my own bootstraped company / basically being a indie hacker like you I suppose. I get why some companies need VC funding and they become startups but I don't think that literally everything should be startup I am not sure.
One of the things that tends to come up is support. Now a small OSS startup with no funding and maybe even no way to pay them gets an automatic no in most cases.
My guess is that it is less about VC money and more about “I know I will have someone to call as long as I am willing to pay” kind of thing. VC money tells the company someone else is confident enough about this so I can be too.
Just my non-expert opinion.
I hope they will also develop a self-hosted standalone service/node which hosts accounts and can support JWTs which I could verify on my own servers so the BetterAuth node would issue JWTs signed with a secret key I provided as an ENV var, then I could verify the JWTs on my own servers. This would be a neat decoupling. Could be offered as a SaaS service as well.
I'm also keeping tabs on https://github.com/stack-auth/stack-auth
It's usually best to verify JWTs using an asymmetric keypair, that way the BetterAuth node can sign the JWT, and your servers can use something like JWKS to get the public key.
Lessens where the secret key needs to be.
The exception is if:
* you control all the nodes and are confident in the security of all of them now and going forward AND * speed is critical (using HMAC to sign JWTs is faster) AND * you've benchmarked and signing speed is a significant portion of response time
* you control all the nodes and are confident in the security of all of them now and going forward AND
* speed is critical (using HMAC to sign/verify JWTs is faster) AND
* you've benchmarked and signing speed is a significant portion of response time