Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your Supabase is public if you turn off RLS

skilldeliver.com

Post reply on HN
Print view View original

41–50 of 69 posts

Re: Your Supabase is public if you turn off RLS

#41

Post by doctorpangloss »

SOLAR_FIELDS wrote: post #38
mediaman wrote: post #28

I don't understand this. In supabase, the default is to turn on RLS for new tables. If you turn it on and have no policy set, no user can fetch anything from the table. You have to explicitly create a read-all policy for anon keys, and with no constraints, for people to get access to it. The default is secure. If you turn off RLS, there are warnings everywhere that the table is unsecured. The author goes on to compar…

The situation is more nuanced than your comment implies, and a lot of this due to direct product decisions from the Supabase team themselves: https://github.com/orgs/supabase/discussions/4547 The tldr is that Supabase makes this less secure by default because Security is Hard and they don’t want to scare off new users

I’m not sure anyone’s scared off by this. It’s more that it’s more intuitive to declare your user queries (like Meteor did or how GraphQL works) than to reason about RLS.

Re: Your Supabase is public if you turn off RLS

#42

Post by SOLAR_FIELDS »

doctorpangloss wrote: post #41
SOLAR_FIELDS wrote: post #38

Earlier quoted context omitted.

The situation is more nuanced than your comment implies, and a lot of this due to direct product decisions from the Supabase team themselves: https://github.com/orgs/supabase/discussions/4547 The tldr is that Supabase makes this less secure by default because Security is Hard and they don’t want to scare off new users

I’m not sure anyone’s scared off by this. It’s more that it’s more intuitive to declare your user queries (like Meteor did or how GraphQL works) than to reason about RLS.

It’s not about being scared off, I’m simply challenging the notion that Supabase is secure by default. It depends on your definition of secure, since everyone has a different threat model, but the above thread demonstrates that probably a good chunk of people would say No, it’s not actually secure by default. Being scared off would be probably the best possible outcome over the current situation which is “we don’t really have a good story to tell about whether this is secure or not”.

The fact that it takes a whole thread of conversation to even unwrap whether the default approach they took is good enough is a strong signal to me that it isn’t, because that level of complexity in the implementation often implies a model with a large enough attack surface with weaknesses that can be exploited without too much effort

Re: Your Supabase is public if you turn off RLS

#43

Post by _puk »

dmix wrote: post #12
giogio wrote: post #9

My experience with supabase is it does actually warn you constantly if you don't set up RLS

People are using LLMs to generate apps and it's easy for non-technical people to miss this stuff. The blog post mentions https://lovable.dev/ becoming a $300M company, which uses Supabase by default and basically generates React SPA's with no true backend. But random people won't understand this distinction and will want to create full real apps. Doing this serverless is tricky and requires a lot of careful thought t…

Both the free and paid tiers of lovable don't charge for security fixes, and before you can publish it requests you run security audits.

I've found doing this, and regularly asking "did you just make my system massively insecure" help keep it on its toes.

That said, I've seen a few "look what I just made.." that caused a double take.

Re: Your Supabase is public if you turn off RLS

#44

Post by wahnfrieden »

koakuma-chan wrote: post #39

Guys, please, stop using all these Vercel-likes. It won't do you any good. There was an excellent article on self hosting PostgreSQL the other day. https://pierce.dev/notes/go-ahead-self-host-postgres#user-co...

That article is good if you don't care about uptime or incident recovery time.

Yugabyte is the best open source postgres for HA.

Re: Your Supabase is public if you turn off RLS

#45

Post by SOLAR_FIELDS »

teaearlgraycold wrote: post #30
dangoodmanUT wrote: post #29

One thing I find about these "all in one" platforms is that they tend to lure people into a sense of "wow this is easy to use" such that they forget to check security, assuming it's covered. This is one reason why Firebase was such a gold-mine for security researchers: everyone just forgot about security when they forgot about their backend.

Any time I see a product like Firebase that rolls auth and other major features into a database I roll my eyes.

Are you saying that because you fundamentally just don’t believe the db is a good place for auth, or because these low-code frameworks tend to roll it in and as such you see a lot of low quality implementations of auth from these systems simply because using them is within reach of someone who has no idea what they are doing?

To me it’s important to make this disambiguation. One take says that auth in db itself is a problem. The other take says “auth in db is a symptom of low code garbage”

Re: Your Supabase is public if you turn off RLS

#46

Post by cess11 »

dmix wrote: post #12
giogio wrote: post #9

My experience with supabase is it does actually warn you constantly if you don't set up RLS

People are using LLMs to generate apps and it's easy for non-technical people to miss this stuff. The blog post mentions https://lovable.dev/ becoming a $300M company, which uses Supabase by default and basically generates React SPA's with no true backend. But random people won't understand this distinction and will want to create full real apps. Doing this serverless is tricky and requires a lot of careful thought t…

Now, "non-technical people" should not ever by themselves put anything on the Internet that handles things like names and passwords.

It's bad that some folks want to make money on such people doing it anyway, which means they're not very nice and should get help to correct their ways.

Re: Your Supabase is public if you turn off RLS

#47

Post by cess11 »

wahnfrieden wrote: post #44
koakuma-chan wrote: post #39

Guys, please, stop using all these Vercel-likes. It won't do you any good. There was an excellent article on self hosting PostgreSQL the other day. https://pierce.dev/notes/go-ahead-self-host-postgres#user-co...

That article is good if you don't care about uptime or incident recovery time. Yugabyte is the best open source postgres for HA.

Once you have reason to care about that, then you should also be able to afford to hire people that can sort it out for you.

Re: Your Supabase is public if you turn off RLS

#48

Post by brikym »

koakuma-chan wrote: post #39

Guys, please, stop using all these Vercel-likes. It won't do you any good. There was an excellent article on self hosting PostgreSQL the other day. https://pierce.dev/notes/go-ahead-self-host-postgres#user-co...

It can go wrong. I had a horrible experience with StackGres. I read a lot of positive things about CloudNativePG though. I can see where people with startups are coming from not wanting to manage database plumbing so they can focus on real business tasks. I think that's fine as long as there is a path to self-host after some growth. I might do some event-sourcing myself so that databases are effectively materialized views easy to add and remove.

Re: Your Supabase is public if you turn off RLS

#50

Post by ahachete »

brikym wrote: post #48
koakuma-chan wrote: post #39

Guys, please, stop using all these Vercel-likes. It won't do you any good. There was an excellent article on self hosting PostgreSQL the other day. https://pierce.dev/notes/go-ahead-self-host-postgres#user-co...

It can go wrong. I had a horrible experience with StackGres. I read a lot of positive things about CloudNativePG though. I can see where people with startups are coming from not wanting to manage database plumbing so they can focus on real business tasks. I think that's fine as long as there is a path to self-host after some growth. I might do some event-sourcing myself so that databases are effectively materialized…

Hi, StackGres founder here.

We're constantly striving to improve the user experience and the quality of StackGres. Would you mind sharing some feedback as to what made your experience not good with it?

Did you join the Slack Community (https://slack.stackgres.io/) to ask if you were facing some trouble? It always helps, even if it is just by sharing your troubles.

(If you'd like to share feedback and do so privately, please DM on the Slack Community)

Your feedback will be much appreciated.

Post reply on HN