31–40 of 130 posts
For people who have some experience in this, what's the best less-code backends? Hasura? Supabase? Prisma? Thin?
i deleted my account immediately after receiving a spam e-mail
this practice is illegal in EU
For people who have some experience in this, what's the best less-code backends? Hasura? Supabase? Prisma? Thin?
Hasura connects to databases and all your other APIs to give a unified GraphQL API (and REST API, if you configure it).
This takes care of your CRUD APIs portion of building your app. With declarative Access Control Rules, you get powerful Authorization. IMO, these two should take care of 70% of your application code that you typically end up writing. The remaining will be custom business logic that you can write in any language or framework of choice and connect it to Hasura.
There’s of course more with the cloud offering to give you caching, rate limiting and monitoring in production. Hasura doesn’t host your database, it just needs the db connection string to get started.
For people who have some experience in this, what's the best less-code backends? Hasura? Supabase? Prisma? Thin?
Thin Backend ( https://thin.dev/ ) is the newest of all of those. Compared to Hasura it offers a nicer schema designer. Compared to Supabase it offers better end-to-end typesafety and a more higher level API that offers optimistic updates. Prisma is more like an ORM, so it's designed to be used by a handwritten backend.
yes please, sign me up !!! /s
For people who have some experience in this, what's the best less-code backends? Hasura? Supabase? Prisma? Thin?
There’s no best really, but in my experience I prefer Hasura. I think their security model makes more sense than row level security and I prefer GraphQl. You should try both and see
As for your preference for Hasura security vs Postgres' native row level security, of course your preference is entirely valid and may also be the best fit for your needs, but consider that RLS works for all database clients, not just Hasura, so if you have a heterogeneous db client environment and you want to enforce one central policy, RLS can do that but a Hasura specific policy checker can't.
Disclaimer: I work at Supabase but not directly on the GraphQL support.
My main critique after trying Google Firestore was: (1) Lack of typed schemas with declarative definitions (2) Read/write permissions and write validation was extremely complex From quick glance at the docs, it looks like they make progress towards the first but not sure about the latter: https://supabase.com/docs/guides/auth/row-level-security
https://github.com/FirebaseExtended/protobuf-rules-gen was the closest we got: declaring types as protobufs (because Google, of course) and then generating both security rules to guarantee validity as well as client types that would match. I wanted to add proto annotations to do additional validity (e.g. add a regex to validate the phone number string was correct, do length checks on strings, etc.), but we never quite got there (not sure proto annotations are a thing externally either).
The short answer is that backend rules engines, either in their own DSL or bolted on to e.g. SQL, are pretty tough to get right, and have a super steep learning curve. IMO, AWS API Gateway with Lambda Authorizers get this most correct: it offers a programming model that people are familiar with (writing code to access external resources to make the authZ decision) with a clear performance tradeoff (ability to cache the result for a period of time).
My main critique after trying Google Firestore was: (1) Lack of typed schemas with declarative definitions (2) Read/write permissions and write validation was extremely complex From quick glance at the docs, it looks like they make progress towards the first but not sure about the latter: https://supabase.com/docs/guides/auth/row-level-security
Even in light of the following critiques, I feel like its one of the simplest ways for an experienced developer to start a new project, and it's now my go to over spinning up a database, Firebase, ORMs, and other database abstractions.
My main critiques are:
- As others have said, default security is way too permissive. They should lock everything down by default. At some point, this is going to cause major problems for some company that decides to build off Supabase.
- Although they have row-level security, RBAC is completely missing. It's not hard to implement yourself through stored procedures and triggers (they have an example repo to copy from), but I don't see a lot of junior devs doing this.
- Stored procedures are more likely to be utilized in the Supabase paradigm, but I haven't felt like they have done much to address the inherent weakness and common critiques of using sprocs instead of application level functions.
- Escape hatches are missing in their fork of GoTrue (why did they fork it in the first place - now there are two competing versions?). It's still not clear to me how to add data to the JWT or get access to the JWT through their SDK.
- Slow dashboard with rendering problems. It doesn't render correctly on my Fedora laptop. And the slow speed becomes pretty annoying almost right away.
- I have experienced data loss when using their SQL editor. So now I copy all the SQL I write to a local file or just do everything through DBeaver.
- Lack of backups on the free tier. They should give this away for free up to a storage limit. Backups are a critical part of development and I don't have full trust in Supabase given that I've already experienced data loss through their UI.
- Misleading marketing. They make implicit claims all over the place on what they offer but then have disclaimers on their code bases about certain features not being production ready.
They clearly have work ahead of them, but I'm optimistic about the potential for Supabase and I look forward to the improvements!
Earlier quoted context omitted.
Thin Backend ( https://thin.dev/ ) is the newest of all of those. Compared to Hasura it offers a nicer schema designer. Compared to Supabase it offers better end-to-end typesafety and a more higher level API that offers optimistic updates. Prisma is more like an ORM, so it's designed to be used by a handwritten backend.
thin.dev Realtime Bandwidth - $2 per GB yes please, sign me up !!! /s
Unfortunately this is the wrong team. I have worked on several Postgres full stack applications over the past few years, and I really wanted Supabase to work, the idea sounded great. The JavaScript SDK, the documentation for getting started, and the user interface are all horrible/half-baked. Instead of speeding up my development, Supabase lead me to waste hours in confusion. It is easier to roll your own auth and se…
> If I were CEO I would shift all resources to fixing the UI and SDK I'm the CEO :) Thanks for the feedback. I would love to hear any specifics - where you got stuck and which parts of the UI/SDK we can improve. My email is in my profile. We know we have a lot more to do, and we love building based on user feedback.