Hacker News Reader

Comment by 2mol | Hacker News Reader

This looks great, however at first peek it doesn't mention anything about auth. Do you have any plans for that? For me this is the topic I most want to just delegate to the service.

Dashboard, realtime stuff, etc are great too. RESTful APIs I can of course get with PostgREST [0], which is insanely excellent, so the value I'm looking for is to have everything managed, from hosting/storage, to security, to all the other annoying nitty-gritty that I'm likely to get wrong.

[0]: https://postgrest.org

View on HN

See my comments on Auth here: https://news.ycombinator.com/item?id=23320443

> We want to nail the auth and we're looking at leveraging Postgres' native Row Level Security. This is a tricky task to "generalize" for all businesses but we have some good ideas (we're discussing in our repo if you want to follow - https://github.com/supabase/supabase)

> RESTful APIs I can of course get with PostgREST

That's what we use! See our supporting libraries:

https://github.com/supabase/postgrest-js

https://github.com/supabase/postgrest-rs

https://github.com/supabase/postgrest-py (coming soon)

Also, I'm a long time user and a huge fan. My previous company is featured on their docs (blog post: https://paul.copplest.one/blog/nimbus-tech-2019-04.html#api-...)

Oh, that's super cool!

I'm even more excited for your project in that case. I hope I can make the time to build a prototype, right now I'm doing the same for retool, and I feel very spoiled for good choices all of a sudden when it comes to backend abstractions.

nice - if you build something and want it featured, let us know: alpha@supabase.io

You might want to look into how Hasura does auth. IMO it's really well thought through. However, it doesn't handle the actual authentication, just the access permissions afterwards. If you could layer firebase-style auth "strategies" (email/password, Facebook, Open ID, etc) on top of that kind of system, while keeping everything accessible directly in the main database, that'd be pretty awsome.

IOW, Hasura does authZ vs authN, right?

For a little more context for those scrolling past, I'm assuming this is around: authentication vs authorization.

Check the person is who they say they are (authenticate), and then check they're allowed to access the thing they want to view (authorize).

The first is quite easy to abstract, the latter is basically custom to most applications (for different definitions of "custom").

Just FYI, making a good auth solution in Supabase will instantly make me a customer.

Just chiming in... Auth, free hosting and SSL is what drove me to Firebase in the first place. DB is the last thing.

Just thought you should know, when I read "Firebase alternative", I got excited about something else.

Good feedback - thanks. Stay excited! It's something we will build and we will make the experience as simple (simpler?) than Firebase

Likewise. Firestore client API is nice and convenient, but it is so limiting on queries. One has to know the limitations and plan ahead on how to model the data around them, or risk the ability to do even some fundamental queries [0]. [0] https://stackoverflow.com/questions/47251919/firestore-how-t...

Are you also using PostgREST in the backend to provide the APIs, or are your REST APIs and hence client libs PostgREST compatible?

Each database gets it's own PostgREST instance, a realtime server, an API proxy, and a Postgres admin api (which we are building) to manage their schema programatically.

We have client libraries for PostgREST, which then gets installed as a dependency in our main client library.

Any thoughts on Auth0?

https://auth0.com/

Love it, used it, mildly dislike the pricing.

But generally I'm of the opinion that auth tightly integrated into the platform has a lot of advantages. My dream is to avoid (almost) all glue between my components, I think Firebase became successful in big part because of that.

I saw this passing by a lot of times, but either I misunderstand the pricing or it is indeed 'enterprise' pricing. Because even small sites I launched have easily 10s of 1000s of users and some have had millions => I cannot see this pricing work at all on any of those without me closing the doors (having margins that are just too small or just making losses) vs making a really good living.

I agree with this. I think Auth0 at one point was building tools for indie devs, but are now focused mostly on enterprises.

What have you used instead of Auth0?

We have a microservice for this which we use. It's internal and was extracted from systems/practices that grew over years. Basically it works like Auth0 many of the bells and whistles, but it's just a service in our network. And, probably not a surprise, TCO (cost of running/maintaining it) is a rounding error (few $100/month) for millions of users.

I have found Cognito to be a similar enough, if not more quirky, offering, but at a fraction of the cost. Auth0 is just too expensive.

Reply on news.ycombinator.com