Live data from Hacker News

Edge-compatible Serverless Driver for Postgres

neon.tech

31–40 of 46 posts

Re: Edge-compatible Serverless Driver for Postgres

#31
post #20

Earlier quoted context omitted.

That I understand. But of course for the user of the driver it might be fine if that is 2 or more HTTP requests. I expect that is how PlanetScale does it in their transaction implementation, https://github.com/planetscale/database-js#transactions , and I know that is how Prisma Data Proxy handles it - the transaction is identified with an ID which is returned to the Client and then included in further requests for th…

> the transaction is identified with an ID which is returned to the Client and then included in further requests for the same transaction. Yes, and there's a catch there that people might not notice: HTTP-based queries utilize this ID to identify which active transaction to use, but this is vulnerable to concurrent HTTP requests on the same transaction ID, thus allowing query injection (early COMMIT, SELECT sleep(100…

[deleted]

Re: Edge-compatible Serverless Driver for Postgres

#32
post #20

Earlier quoted context omitted.

That I understand. But of course for the user of the driver it might be fine if that is 2 or more HTTP requests. I expect that is how PlanetScale does it in their transaction implementation, https://github.com/planetscale/database-js#transactions , and I know that is how Prisma Data Proxy handles it - the transaction is identified with an ID which is returned to the Client and then included in further requests for th…

> the transaction is identified with an ID which is returned to the Client and then included in further requests for the same transaction. Yes, and there's a catch there that people might not notice: HTTP-based queries utilize this ID to identify which active transaction to use, but this is vulnerable to concurrent HTTP requests on the same transaction ID, thus allowing query injection (early COMMIT, SELECT sleep(100…

I am not sure I am following.

We can have either parallel queries in a transaction where the order does not matter, or we can have them serialized - but then the next query will only be sent onto its journey after the previous query returned its data to the app.

What are the attack vectors here? And where would the attacker sit and try to achieve what exactly?

Re: Edge-compatible Serverless Driver for Postgres

#33
post #2

I’m Neon CEO. Happy to answer questions. We also have an interesting roadmap for the driver where we hope to keep driving latency and number of round trips down

Hey Nikita, what are the key differences between neon and Supabase?

I think we innovate on different parts of the stack. Neon is offering separation of storage and compute and serverless. Theoretically you can run Supabase on top of Neon

Re: Edge-compatible Serverless Driver for Postgres

#34
post #33

Earlier quoted context omitted.

Hey Nikita, what are the key differences between neon and Supabase?

I think we innovate on different parts of the stack. Neon is offering separation of storage and compute and serverless. Theoretically you can run Supabase on top of Neon

To elaborate Neon is designed deliberately to plug into the Postgres ecosystem. So all of the ecosystem works out of the box. Supabase seems to be vertically integrated. But Paul should comment on that

Re: Edge-compatible Serverless Driver for Postgres

#35
post #29
post #5

The "How it works" section surprised me - I did not expect to see Websockets there. Other serverless drivers or database APIs (PlanetScale Serverless Driver, AWS RDS Proxy or Prisma Data Proxy) usually use HTTP to replace the stateful TCP connection. The post explains a bit why this might be beneficial (can use existing tools, and use connection state) - but what about the other benefits and use cases of going with H…

Another angle here is compatibility. With our current driver one can use ordinary node-postgres package, as we can substitute TCP-related calls with WebSocket calls during the build time. With that it possible to use all the packages that do require node-postgres like Prisma, Zapatos, etc.

Prisma does not actually use node-postgres, but a Rust PostgreSQL driver. Prisma will not be able to use the Neon serverless driver.

Re: Edge-compatible Serverless Driver for Postgres

#36
post #34
post #33

Earlier quoted context omitted.

I think we innovate on different parts of the stack. Neon is offering separation of storage and compute and serverless. Theoretically you can run Supabase on top of Neon

To elaborate Neon is designed deliberately to plug into the Postgres ecosystem. So all of the ecosystem works out of the box. Supabase seems to be vertically integrated. But Paul should comment on that

I believe most of the tools that Supabase use would work with Neon, with the exception of Realtime. As I understand it, Neon doesn't support Logical Decoding yet[0], which is required so that the Realtime engine can receive updates from the database.

[0] https://community.neon.tech/t/plans-for-logical-replication/...

Re: Edge-compatible Serverless Driver for Postgres

#37
post #35
post #29

Earlier quoted context omitted.

Another angle here is compatibility. With our current driver one can use ordinary node-postgres package, as we can substitute TCP-related calls with WebSocket calls during the build time. With that it possible to use all the packages that do require node-postgres like Prisma, Zapatos, etc.

Prisma does not actually use node-postgres, but a Rust PostgreSQL driver. Prisma will not be able to use the Neon serverless driver.

https://github.com/prisma/prisma/blob/main/packages/client/p...

Re: Edge-compatible Serverless Driver for Postgres

#38
post #37
post #35

Earlier quoted context omitted.

Prisma does not actually use node-postgres, but a Rust PostgreSQL driver. Prisma will not be able to use the Neon serverless driver.

https://github.com/prisma/prisma/blob/main/packages/client/p...

That is only used in tests :) The query engine uses this: https://github.com/prisma/quaint/blob/6532d69b5aec007ad06ac6...

(I work at Prisma, could have mentioned that earlier)

Re: Edge-compatible Serverless Driver for Postgres

#39
post #5

The "How it works" section surprised me - I did not expect to see Websockets there. Other serverless drivers or database APIs (PlanetScale Serverless Driver, AWS RDS Proxy or Prisma Data Proxy) usually use HTTP to replace the stateful TCP connection. The post explains a bit why this might be beneficial (can use existing tools, and use connection state) - but what about the other benefits and use cases of going with H…

HTTP does not (easily) allow for using answers of earlier queries in the transaction. E.g. BEGIN; INSERT INTO my_table (...) RETURNING (id); SELECT count(\*) AS my_count FROM my_table; INSERT INTO historical (new_id, value_derived_from_count, now()); COMMIT; is difficult (or potentially impossible) to do transactionally using single HTTP queries. Sure, you can rewrite your queries to use single-statement queries if y…

Just turn it into a single query using CTEs.

Re: Edge-compatible Serverless Driver for Postgres

#40
post #34

Earlier quoted context omitted.

To elaborate Neon is designed deliberately to plug into the Postgres ecosystem. So all of the ecosystem works out of the box. Supabase seems to be vertically integrated. But Paul should comment on that

I believe most of the tools that Supabase use would work with Neon, with the exception of Realtime. As I understand it, Neon doesn't support Logical Decoding yet[0], which is required so that the Realtime engine can receive updates from the database. [0] https://community.neon.tech/t/plans-for-logical-replication/...

You are right. We will make it work soon
Post reply on HN