upvote
I see Postgres etc as the builder. Supabase is more like the realtor; a middle man extracting profits and complicating the situation.
reply
Does Postgres talk OpenID connect directly? Does it integrate SAML easily?

Oh you still have to build the auth system yourself? Well maybe a realtor does sound good now.

reply
This comment is more ridiculous than ever in 2026.
reply
If you’re implying that people should __always__ roll their own services and never vendor out non-core parts, the security industry would love to learn where you work.
reply
Yes the analogy doesn't work here because that is much more cost prohibitive and labor intensive.
reply
Because of AI or because hackers are hyper targeting infra clusters?
reply
Emperor, meet clothes.
reply
>that doesn’t mean it’s the best use of your time in all cases

Okay, so… what are those cases? I’m also curious.

reply
> Okay, so… what are those cases? I’m also curious.

If you're willing to make a third party SaaS's uptime the ceiling for your own org, you can delegate auth. Github might not be a good choice for SSO.

If you're not threatened by per-user-per-month fees, you can delegate auth.

If your threat model is compatible with a third party having visibility into your user's network location and the frequency and duration of their activities across your org, you can delegate auth. (Okta will probably not inform your competitor that your main sales guy is in North Carolina this week and has logged in from the conference room wifi of your competitor's main client.)

If you can trust the third party to not allow an interloper to bypass your requirements, you can delegate auth.

reply
This is such an absurd take.

For starters, if I'm a "house builder" by trade, then yeah, I am going to build the house myself. Otherwise, why should the client pay me, and not the guy I'm subcontracting?

Secondly, there is no such thing as a "house builder" profession. It consists of a lot of different trades people, some of them having legal power to sign off your house build (for example an electrician). Now, we could try to push for something similar in software engineering, and say require you to have an "authentication engineering certificate" in order to handle code related to auth, and only a person holding the certificate can allow such code for production use. But I'm pretty sure all the vibe coders and tech bros will cry how unfair and bureaucratic the system is.

But of course the entire SWE profession is based on grifting, and extracting as much money as possible from the customers while cutting the costs. If you are so afraid to save passwords to a database, then at least don't call yourself a software engineer.

reply