Related to this, I've been wondering how much we should actually be depending on RLS for. There are known timing attacks against it [1].
[1] https://www.cs.tau.ac.il/~mad/publications/sigmod2023-rls.pd...
Your Supabase is public if you turn off RLS
51–60 of 69 posts
Re: Your Supabase is public if you turn off RLS
#52I don't understand this. In supabase, the default is to turn on RLS for new tables. If you turn it on and have no policy set, no user can fetch anything from the table. You have to explicitly create a read-all policy for anon keys, and with no constraints, for people to get access to it. The default is secure. If you turn off RLS, there are warnings everywhere that the table is unsecured. The author goes on to compar…
Ok, we've added "if you turn off RLS" to make the title less misleading. It's still too baity a title for HN, but at least less egregious.
Submitters: baity and misleading titles are against the site guidelines, so please don't post them here.
Re: Your Supabase is public if you turn off RLS
#53Earlier quoted context omitted.
It can go wrong. I had a horrible experience with StackGres. I read a lot of positive things about CloudNativePG though. I can see where people with startups are coming from not wanting to manage database plumbing so they can focus on real business tasks. I think that's fine as long as there is a path to self-host after some growth. I might do some event-sourcing myself so that databases are effectively materialized…
Hi, StackGres founder here. We're constantly striving to improve the user experience and the quality of StackGres. Would you mind sharing some feedback as to what made your experience not good with it? Did you join the Slack Community ( https://slack.stackgres.io/ ) to ask if you were facing some trouble? It always helps, even if it is just by sharing your troubles. (If you'd like to share feedback and do so privatel…
I did try slack. Maybe the problem is it was launched much too early. A certificate expiry issue caught me out because there wasn't an automatic process on this version to roll them over. Ironically a single database instance would have been much much more stable. I upgraded but this didn't bring up the database, restoring through the portal failed, so I had to create a new PG cluster to get my site up and I never ended up recovering the data as the process was very tedious involving PVCs rather than just pointing to my bucket.
The ratio of open to closed issues on the repo is much worse than CNPG so I would simply start there.
Re: Your Supabase is public if you turn off RLS
#54Earlier quoted context omitted.
Any time I see a product like Firebase that rolls auth and other major features into a database I roll my eyes.
Are you saying that because you fundamentally just don’t believe the db is a good place for auth, or because these low-code frameworks tend to roll it in and as such you see a lot of low quality implementations of auth from these systems simply because using them is within reach of someone who has no idea what they are doing? To me it’s important to make this disambiguation. One take says that auth in db itself is a…
I like to separate concerns. Unix philosophy and all that. That was the primary concern on my mind when writing my comment above.
I think the feature is there not necessarily because it’s the best technical idea but instead because of its ability to pull in less educated developers. That makes sense financially because there are fewer people out there with a higher degree of expertise. But from my perspective it shows that it’s not meant for me.
Re: Your Supabase is public if you turn off RLS
#55Guys, please, stop using all these Vercel-likes. It won't do you any good. There was an excellent article on self hosting PostgreSQL the other day. https://pierce.dev/notes/go-ahead-self-host-postgres#user-co...
It can go wrong. I had a horrible experience with StackGres. I read a lot of positive things about CloudNativePG though. I can see where people with startups are coming from not wanting to manage database plumbing so they can focus on real business tasks. I think that's fine as long as there is a path to self-host after some growth. I might do some event-sourcing myself so that databases are effectively materialized…
I think people with startups just don't care. I had an interview with a startup the other day, and the interviewer said they were considering using v0 for their front-end. I really want to be wrong here, but so far it feels like all those startups are there to just take VC money for themselves and die.
Re: Your Supabase is public if you turn off RLS
#56Earlier quoted context omitted.
That article is good if you don't care about uptime or incident recovery time. Yugabyte is the best open source postgres for HA.
Once you have reason to care about that, then you should also be able to afford to hire people that can sort it out for you.
Not really. Maybe for consumer. But there are many kinds of b2b infrastructure businesses that I can build and launch myself where I wouldn't want to expose myself to risk of day-long outages (for either reputational or as competitive disadvantage of having no HA story), such as anything to do with payment gateways, API gateways, AI proxies or other AI infrastructure - anything where client services would experience critical outages if your service goes down... Lots of these businesses are started without VC investment or big money from day 1.
Luckily now with solutions like Yugabyte, we can achieve enterprise-grade HA without high cost or high maintenance complexity.
Re: Your Supabase is public if you turn off RLS
#57Earlier quoted context omitted.
Hi, StackGres founder here. We're constantly striving to improve the user experience and the quality of StackGres. Would you mind sharing some feedback as to what made your experience not good with it? Did you join the Slack Community ( https://slack.stackgres.io/ ) to ask if you were facing some trouble? It always helps, even if it is just by sharing your troubles. (If you'd like to share feedback and do so privatel…
I did try slack. Maybe the problem is it was launched much too early. A certificate expiry issue caught me out because there wasn't an automatic process on this version to roll them over. Ironically a single database instance would have been much much more stable. I upgraded but this didn't bring up the database, restoring through the portal failed, so I had to create a new PG cluster to get my site up and I never en…
Thank you for your feedback. I'm trying to extract possible improvement actions from your comment, and here are my thoughts.
That certificate expiry issue was unfortunate, but was resolved (if I'm not mistaken) a couple of years ago.
StackGres is just a control plane, your database is as stable as a standalone one. StackGres itself may fail and it won't affect your database, it's not on the data plane. Indeed, it has a feature to "pause it" if you need to perform some manual operations (otherwise everything is automated).
There are procedures to reconstruct a database from PVC. It's arguably tedious, but should be much simpler than running a Postgres pod without the help of an operator like StackGres.
As for the ratio of issues: most of the issues that we get are feature and/or extensions requests, and certainly we can't tackle them all. Most, if not all, outstanding issues are addressed within a reasonable time frame. Is there any particular issue that would itch you that is open? I'd be happy to personally review it. Yet, there are as of today more than 2K closed issues, I won't call that a small number.
I'd also weight the importance of issues, like the split brain that CNPG suffers [1] and that apparently won't even be solved. StackGres relies instead on the trusted and reputed Patroni, which is known NOT to risk split brains that could lead to severe data loss.
[1]: https://github.com/cloudnative-pg/cloudnative-pg/discussions...
Re: Your Supabase is public if you turn off RLS
#58My experience with supabase is it does actually warn you constantly if you don't set up RLS
People are using LLMs to generate apps and it's easy for non-technical people to miss this stuff. The blog post mentions https://lovable.dev/ becoming a $300M company, which uses Supabase by default and basically generates React SPA's with no true backend. But random people won't understand this distinction and will want to create full real apps. Doing this serverless is tricky and requires a lot of careful thought t…
I asked claude to build a system that involved parsing some dates and addresses and rather than using a library it wrote hundreds of lines of regexes and term lists ('st', 'street', 'dr', 'drive', 'ave', etc) to match every test case I gave it. Lesson learned.
Re: Your Supabase is public if you turn off RLS
#59Earlier quoted context omitted.
Any time I see a product like Firebase that rolls auth and other major features into a database I roll my eyes.
Are you saying that because you fundamentally just don’t believe the db is a good place for auth, or because these low-code frameworks tend to roll it in and as such you see a lot of low quality implementations of auth from these systems simply because using them is within reach of someone who has no idea what they are doing? To me it’s important to make this disambiguation. One take says that auth in db itself is a…
FWIW firebase auth and firebase DB are two separate things, and you can use them completely separately. However "Firebase" is a PaaS so I see how it gets confusing.
Re: Your Supabase is public if you turn off RLS
#60Earlier quoted context omitted.
Are you saying that because you fundamentally just don’t believe the db is a good place for auth, or because these low-code frameworks tend to roll it in and as such you see a lot of low quality implementations of auth from these systems simply because using them is within reach of someone who has no idea what they are doing? To me it’s important to make this disambiguation. One take says that auth in db itself is a…
FWIW firebase auth and firebase DB are two separate things, and you can use them completely separately. However "Firebase" is a PaaS so I see how it gets confusing.
Fair call out but if I am a firebase customer, as I have been in the past but less frequently so, I treat them as a singular entity. In other words, there’s no situation I would use firebase and not use its auth, because the reason I might use firebase is Because Of the auth, not In Spite Of. There’s no world for me where firebase is the preferred option that doesn’t use auth, the integration like that is literally the only reason I would ever consider ClosedSourceOwnedByGoogle over alternatives