Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Supabase is public if you turn off RLS

skilldeliver.com

Post reply on HN
Print view View original

31–40 of 69 posts

Re: Your Supabase is public if you turn off RLS

#31

Post by jeroenhd »

dmix wrote: post #12
giogio wrote: post #9

My experience with supabase is it does actually warn you constantly if you don't set up RLS

People are using LLMs to generate apps and it's easy for non-technical people to miss this stuff. The blog post mentions https://lovable.dev/ becoming a $300M company, which uses Supabase by default and basically generates React SPA's with no true backend. But random people won't understand this distinction and will want to create full real apps. Doing this serverless is tricky and requires a lot of careful thought t…

LLMs can and often do turn any technology into an insecure heap of shit. I don't see how that's relevant to Supabase specifically.

Re: Your Supabase is public if you turn off RLS

#33

Post by k4rli »

Supabase is great if the goal is insecure, incredibly slow postgres. Selfhosting it is also painful with ~10 separate containers, while supabase's own offering has downtimes that won't appear on their status page.

Only thing it actually makes easier is auth. Other stuff just becomes harder to maintain. A simple springboot Java app, especially with basic boilerplate implemented with llm help, will last a long time, be cheap+simple to host, easily extensible.

Re: Your Supabase is public if you turn off RLS

#34

Post by tonyhart7 »

int0x29 wrote: post #7

Firebase seems to suffer a similar problem of people not setting permissions right. The only major difference is that they seem to steer devs pretty aggressively to Google auth which won't leak password hashes. While in theory your API can be the database it seems like a footgun for the inexperienced and AI.

to be fair, Auth and access control is just "hard" problem in general tbh

we have so many data breach because they lack "common basic" security best practices, we aren't talking about state level hacker here

just public bucket storage and so on

Re: Your Supabase is public if you turn off RLS

#35

Post by dangoodmanUT »

teaearlgraycold wrote: post #30
dangoodmanUT wrote: post #29

One thing I find about these "all in one" platforms is that they tend to lure people into a sense of "wow this is easy to use" such that they forget to check security, assuming it's covered. This is one reason why Firebase was such a gold-mine for security researchers: everyone just forgot about security when they forgot about their backend.

Any time I see a product like Firebase that rolls auth and other major features into a database I roll my eyes.

Convex has been quite good so far

Re: Your Supabase is public if you turn off RLS

#37

Post by satvikpendem »

dmix wrote: post #25
zamadatix wrote: post #20

Earlier quoted context omitted.

> The blog post mentions https://lovable.dev/ becoming a $300B company I had to double take back to the article after reading this - it actually said $330M (raised at $6.6B valuation). AI investment has been crazy enough I would have actually believed it though!

Fixed, thanks

I don't think you did fix it, you say "becoming a $300M company" but it's actually a $6.6B company, for which we'd be looking at valuation not amount raised.

Re: Your Supabase is public if you turn off RLS

#38

Post by SOLAR_FIELDS »

mediaman wrote: post #28

I don't understand this. In supabase, the default is to turn on RLS for new tables. If you turn it on and have no policy set, no user can fetch anything from the table. You have to explicitly create a read-all policy for anon keys, and with no constraints, for people to get access to it. The default is secure. If you turn off RLS, there are warnings everywhere that the table is unsecured. The author goes on to compar…

The situation is more nuanced than your comment implies, and a lot of this due to direct product decisions from the Supabase team themselves: https://github.com/orgs/supabase/discussions/4547

The tldr is that Supabase makes this less secure by default because Security is Hard and they don’t want to scare off new users

Re: Your Supabase is public if you turn off RLS

#40

Post by SOLAR_FIELDS »

stephenlf wrote: post #23

After seeing the responses, I believe that this is more evidence of the fact that Supabase is easy to work with (and thus attracts people who have NO IDEA what they’re doing), and less an issue with Supabase security.

It’s even worse than No Idea what you are Doing. One can, as has been alluded to in other comments, be a completely naive rube who is using Supabase under the hood with v0 or Lovable and not have any idea that you’re even using it or that it exists at all.
Post reply on HN