Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Supabase Vault

supabase.com

Post reply on HN
Print view View original

71–77 of 77 posts

Re: Supabase Vault

#71

Post by tmd83 »

michelpp wrote: post #35
byteshock wrote: post #31

Earlier quoted context omitted.

But if they have the decrypted secrets, do they really need the key?

The Vault will not prevent someone who has login access to your database and the right grants (or superuser) from decrypting the data. If someone is in this position they are fully compromised and the Vault is not protection against that (nor is anything else really). In particular if an attacker has a postgres superuser login they can essentially asct as the OS process owner, and could possibly get around the proces…

I wasn't talking just about pgsodium or the vault product but similar products in general.

I understand the point of the database client having access to to the database key and not the key to the secret vault. So in this case other secrets at the vault are essentially protected. But let's say I really have this one secret to protect in which case is the vault fairly pointless?

Is it essentially that if a client using KeyX for some purpose than a compromise of said client will essentially lead to KeyX and there's really no way to protect it?

Re: Supabase Vault

#72

Post by fullstackchris »

sofixa wrote: post #56
fullstackchris wrote: post #52

Earlier quoted context omitted.

It's bullshit like this why I hate boomers and / or stuck up / and / or snobby / and / or ignorant software engineers, who, in the end, maybe aren't actually snobby, but just ignorant. YoU cAn Go YoUr EnTiRe CaReEr AnD nOt UsE iT!!! sure, this is true if: - you don't work for / build / care about apps that have a persistence layer and serve more than about... let's say 20K daily users - you don't care about perfomanc…

> Postgres is one of the BEST (if not THE BEST, bar none) databases currently available. I would certainly expect the best database out there to be relatively straightforward to scale out. Posgres isn't. As a former SRE, redundancy > performance (for the differences we're talking about).

> relatively straightforward to scale out

Is this true for any technology, let alone database technology? I've yet to find one.

Re: Supabase Vault

#73

Post by jononomo »

lghh wrote: post #36
jononomo wrote: post #29

Earlier quoted context omitted.

In my humble opinion, if you're a software engineer in the modern world, then learning Postgres is about as fundamental to your job as learning to dribble would be to a job as an NBA basketball player. It is the just the foundation of almost everything else.

You can go your entire career and never use Postgres. It’s pretty easy to, actually.

I guess you just don't care about the data?

Re: Supabase Vault

#74

Post by chucky_z »

atonse wrote: post #65
chucky_z wrote: post #6

Earlier quoted context omitted.

Hashicorp Vault is always my goto even for small companies. It seems too much but it’s really not. A single instance is scalable enough to handle quite a bit of traffic. Another good alternative if you need something more SAASy is the 1pass API product

I felt the same but it was too hard to find people that knew how to operate Vault and so we abandoned it since it was too risky to have such a critical part of our infra without an abundance of talent out there.

https://learn.hashicorp.com/vault ok then hire some random joe shmoe sysadmin and teach them.

Re: Supabase Vault

#76

Post by lghh »

OJFord wrote: post #43
lghh wrote: post #36

Earlier quoted context omitted.

You can go your entire career and never use Postgres. It’s pretty easy to, actually.

I agree 'software engineer' is too broad, but it'd definitely take non-trivial effort (and perhaps some otherwise pointless resigning) to avoid it in domains/companies/roles that could use it, or similar alternatives.

I doubt a enterprise MS dev company lifer would take much effort to avoid it, as an example.

Re: Supabase Vault

#77

Post by lghh »

armatav wrote: post #57
lghh wrote: post #36

Earlier quoted context omitted.

You can go your entire career and never use Postgres. It’s pretty easy to, actually.

You can't go your entire career without interacting with SQL, though - Postgres just happens to be the best way to do that.

Potentially true on both accounts, but neither invalidate what I said.
Post reply on HN