←back to thread

134 points miketromba | 1 comments | | HN request time: 0s | source

Hey, I built https://ShadcnThemer.com - a web app for creating and sharing themes for shadcn/ui, made with my some of my favorites, Next.js 15, Tailwind CSS 4, Drizzle ORM, and Supabase.

The goal was to make it easy to visually design shadcn color themes, preview them live across various example UIs, and export them straight into your projects (as CSS or via the shadcn CLI registry command).

I had a bit of experience going into this because I built the Theme Studio for VS Code in the past, but it was fun using a modern stack and leveraging Cursor to help me along the way this time.

GitHub: https://github.com/miketromba/shadcn-themer

Show context
meindnoch ◴[] No.45707186[source]
>Sign in or create an account with your email

Into the trash it goes.

replies(2): >>45707375 #>>45709116 #
slig ◴[] No.45707375[source]
That's unfair. You can browse, preview and get the CSS variables without signing up.
replies(1): >>45707501 #
LoganDark ◴[] No.45707501[source]
Email magic links are dumb. On top of that, forms that don't let you specify whether to login or to create an account are extra dumb. With magic links, one can't log in with just their password manager, and with a stupid combo form, anyone who mis-types or mis-remembers their email address just accidentally created a new account (or a new link that creates an account).
replies(2): >>45707545 #>>45709359 #
devilsdata ◴[] No.45707545{3}[source]
Email magic links are inconvenient for the user, but they're not dumb. They're a pretty good option for a small project by a developer doesn't want to implement a whole auth flow, or pay for an OAuth provider.

It's a tradeoff. If you roll your own password flow, you need to add MFA to be secure. The complexity of what you need to build and maintain goes up.

A simple magic link flow for an app like this, where you are really only likely to log into it once per project you start.

Personally though, I also use a password manager. And I am annoyed enough by email magic links, that any of my personal projects will at least have a passkey implementation.

So I agree they're annoying. But they're definitely not "dumb". They're a tradeoff. This developer has chosen his own time over user convenience; which is a common tradeoff for small developers.

replies(1): >>45707892 #
LoganDark ◴[] No.45707892{4}[source]
The problem with magic links is that the secret is sent with each login attempt. It's just like SMS verification codes - an attacker that controls the email address, or the phone number, can log right in. In this case, probably without even resetting a password. Plus, with no way to verify the account owner other than the email address, if the email address is lost or changed, the account's as good as gone.

Also yes they're super annoying for the user too. It's inconvenient and less secure.

Passkeys are awesome, yeah.

replies(2): >>45708347 #>>45715370 #
1. devilsdata ◴[] No.45715370{5}[source]
We are on the same page about magic links. Email is also not a super-reliable medium of communication. Email can arrive straight into the junk mail, late, or even never. I think magic links should be strongly discouraged for serious projects, businesses, and government. Passwords and application-based MFA (not SMS or Email MFA) or webauthn/passkeys are much better.

This whole discussion started when @meindnoch wrote ">Sign in or create an account with your email. Into the trash it goes.".

I think magic links are acceptable for a small solo developer project. Expecting a solo developer so shoulder the burden of rolling their own auth, paying for an auth service, or self-hosting an containerised auth-service and wiring their application to it is a bit much for a tiny project like this.

Anything more than a small solo project should graduate to a better solution- I hope we can all agree with that.