Hacker Newsnew | past | comments | ask | show | jobs | submit | ekryski's commentslogin

I think a lot of people still haven't seen https://feathersjs.com/. Has been around for a while and offers all of this and more AND is drop in replacement for Express.


Sure, but it's about balance and setting expectations with the users of your open source framework. Being transparent and delegating responsibility. Your project can only scale as well as you can and that is limited by the number of hours in the day. It's called "open source" for a reason and typically the nature of open source is not money but shared knowledge and contributions. If you're looking for money it probably should just be closed source.


I 100% agree but it's only "a problem in open source if you don't recognize the situation". I've been writing about this a bit on Medium. https://medium.com/@ekryski/your-open-source-is-a-product-st...


Thanks, this is a great blog post about the matter.


Exactly. Even at 20 hours a week you're looking $20k/month. As a freelancer that is a great rate with little overhead. There is no doubt that being the author of Hapi is a major reason why he can charge that rate. I get being burned out and/or wanting support but not recognizing the correlation just comes across as entitled.


Definitely an intentionally click-baity headline :). I am in no way affiliated with either company in the at article. Just happen to know the guy that did the VERY thorough detective work.

However if you are spending money on some of the higher end Digital Ocean servers you are getting screwed, as they are massively underperforming even compared to just a couple $5-$10 instances.

I'll also note that I am a big fan of Digital Ocean and have been a customer for quite a while now.


That's pretty smart. Effectively versioning your issued tokens. Way easier than maintaining a blacklist.


You have to be careful that you are not leaking sensitive info though, as the JWT payload is meant to be visible on the client as well.


I agree that's how we treat them with Feathers. You may know this already but JWT's are intended to be decrypted on the client so you shouldn't be be saying "if" it is cracked, more "when". The signature is only good for ensuring that the content hasn't been manipulated. Not that you are, but for others, never store anything inside a JWT that is sensitive, and if it is make sure you encrypt it first before you put it in the JWT payload.


Glad you are liking it. Yes auth needs a bit more love. I'm working on it right now actually. It's getting close to a 1.0.

As far as passwords go, I assume you are referring to passwordless auth? We are working on that right now :). https://github.com/feathersjs/feathers-authentication/issues...


I just saw! That is awesome. Keep up the great work!


Nope. Not intentional. Looks like we had the old URL. Thanks for pointing that out. I've updated the website and the docs.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: