Ory Kratos VS Ory Hydra

I was expecting hydra / kratos to show up as an alternative.. but did not see any. Does any have any experience, good or bad about it?

https://github.com/ory/kratos

I think it would be fair to say that kratos was not the priority in 2022 in terms of code you can see not much was commited (https://github.com/ory/kratos/graphs/code-frequency) so I might have had a bad first impression.

A few issues on kratos that I consider relatively important are still missing / nobody from Ory is giving their input so it's hard to make progress and I would not take my time to contribute if I dont know if the owner are going to merge it.

An example that comes to mind is the OAuth email auto-verification or the search of users that is still super basic (we only recently got the filter of identifiers).

Sorry to hear that this has been your experience! What exactly was the issue for you? It’s true that there are lots of open PRs. We’re a small team and often busy with customer requirements which doesn’t allow us to get a some community PRs over the finishing line.

Sometimes, PRs are also not aligning with an architecture or API concept which is when they often go stale.

Saying that the open source is second class is a false accusation in my view:

- Over 1500 PRs merged in Ory Kratos alone: https://github.com/ory/kratos/pulls

Check out the milestone on github: https://github.com/ory/kratos/milestone/15

not sure if that is everything.

An open source solution pre-built from professionals like Ory Kratos or Keycloak saves you a lot of time and pain.

https://github.com/ory/kratos

One might say you wouldn't be surprised. Security practices at start ups have never been good (no regulation, focus on sales) but to see this lack of security awareness in a company protecting PII is shocking. But what do VCs know ...

As always when something like this happens, here are some good open source alternatives with appropriate security policies and bug bounties in place:

* https://github.com/keycloak/keycloak

* https://github.com/ory/kratos

* https://github.com/GluuFederation (potentially dated for some use cases)

OAuth Server - Hydra

For examples of my work see my contributions to Ory Hydra https://github.com/ory/hydra.

I'd be more than happy to talk about how I can bring value to your project. Let's have a conversation!

Another package you might want to consider is ORY Hydra. https://github.com/ory/hydra

> 10k M2M tokens for $250/month sounds like a really bad deal if I can just spin up https://github.com/ory/hydra that can easily handle 10k requests per second.

Spinning one up is easy, sure. Making sure it's production ready, is not so much.

Congrats on the launch, building a product in this space is incredibly difficult. I took a look at the stack, here are a few observations:

- "ISO certified secure auth": What does that mean? I could not find proof of your ISO certification. Can you please share?

- 10k M2M tokens for $250/month sounds like a really bad deal if I can just spin up https://github.com/ory/hydra that can easily handle 10k requests per second.

- Looks like you're using OAuth2 as the primary "login" and "session management". What compelled you to do this?

- It looks like you're using some open source technology under the hood for the OAuth2 flows - which one are you using (out of curiosity)?

Have not tried Dex so can't speak to that.

https://github.com/ory/hydra

Consider Ory's Hydra if you want to authenticate third party clients.

We used hydra (https://github.com/ory/hydra) to build our OAuth provider

Check this out: https://github.com/ory/hydra