Comment by DidYaWipe | Hacker News Reader

Comment by DidYaWipe | Hacker News Reader

Parent Full thread

I'm expecting to experience this any day now. I've experienced it before, seeing people make hundreds of millions of dollars on an idea I'd already built (and my employer had fumbled the marketing of) and was actively working to resurrect... but couldn't figure out how to "monetize."

Currently my problem is being a one-man band. I've realized I can't "just ship" a product that relies on a hand-rolled user-authorization scheme that I create with very little experience. So now I've interrupted my whole project to learn Supabase and oh yeah, containers... because I've never used those either and as far as I can tell I'd better use those for deployment and scalability.

And oh yeah, I had to learn SwiftUI (already knew Swift & iOS pretty well) to write the app... and also JavaScript/TypeScript and Deno for the back end. So now I'm entering year two and still trying to vacuum up knowledge fast enough to get this thing out the door before someone else announces it.

I've been thinking that I'd have to hire someone to consult on security and scaling as I finish up actual functionality. But the days go by...

> I've realized I can't "just ship" a product that relies on a hand-rolled user-authorization scheme that I create with very little experience.

Time to ship and get the experience :) It is probably not that bad as you think it is. You can also ask others if they see any obvious security/cryptography fails and you would do better than most including big companies...

> So now I've interrupted my whole project to learn Supabase and oh yeah, containers... because I've never used those either and as far as I can tell I'd better use those for deployment and scalability.

Please don't. Leave it for later if it is truly needed. You can ship without. Don't be lured to the clouds, they're too expensive and you will need to learn and change a lot.

Instead use VPSes and/or dedicated servers from cheap providers such as OVH/Hetzner. Just running your server app on a normal Linux VM is a way simpler than any cloud solution. It can also handle quite a lot, it might surprise you. And you wouldn't get insane invoices for 10-100x overpriced traffic that the clouds have and that kills many ideas even when it would make sense to do them in the cloud otherwise.

Thanks for the advice! I did run a somewhat similar app with essentially no API security on a cheap-ass Linode VPS around 2011. But we only had 10-20K users and those extremely sporadic. But, although users controlled their content, it was totally anonymous. I didn't require a single credential, not even an E-mail address.

One thing about Supabase is that it's supposed to offer user verification through E-mail out of the box, which saves me the time of hand-rolling that.

The reason I want containers is to spin up multiple instances if the thing blows up. Isn't it easier to do that with containerized services?

Depends on the application. I tend to have a single binary, you just need a language runtime and/or database, rarely some other software. You can script installation of this. I don't see how the containers add a value when you can do the same directly.

The last time I've tried Docker to run some application it tried to overtake my testing VM and it failed miserably. Apparently it is not compatible with chroot and it doesn't check for it so it fails somewhere in the middle with various processes and stuff left behind. Doesn't give me a good impression of such software, it lacks both an awareness of a standard feature and an inability to handle failed states gracefully.

If you create a single image you're supposed to be able to spin up new instances at will, on separate VPSes or on cloud providers.

I will depend on Deno, MariaDB, and probably S3 at the least. I was able to make an image with Deno and my code on it and get it working on my machine locally pretty quickly, which was exciting.

I hand-rolled my authn scheme in half a day (backend endpoints only; f/end HTML took a longer). In addition to sign-in with email/password combo, it also does passwordless (i.e. if a user set their profile to password-less, anytime they attempt to sign in it sends a password to their email that is valid for 15m).

It's better (i.e. more secure) than at least two currently-in-use corporate systems I have seen.

And no, I don't store plaintext passwords, and I do use a generated random salt when a password is set, and the crypto functions I use are well-regarded and well-used, not something I wrote myself.

In summary, I don't think it should take two days for a minimal authn/sign-up/sign-in implementation.

Reply on news.ycombinator.com