Live data from Hacker News

Tell HN: Upgrade your Metabase installation

github.com

71–76 of 76 posts

Re: Tell HN: Upgrade your Metabase installation

#71
post #41

One of the better decisions we took at my firm was to not allow direct access to any production DB to analytics visualization tools like Metabase and Redash. Always write your analytics data to a separate DB in a periodically run job. Only store aggregated anonymized data in the analytics DB you expose to internal stakeholders via tools like Metabase.

That's a great idea and it articulates something I have thought about the whole "use boring tech" things (which I support). It doesn't preclude letting people use the shiny new thing. You can always let them plug it in and use it. But the core of the system should be as simple as possible and based on thoroughly understood tech (from the point of view of the team in question/accessible labor market).

I tend to discuss things in terms of the trunk, branch, and leaves.

Mostly in that the leaves of your system (parts that nothing else connects to or builds on) are generally a low risk place to try new things sometimes. If you do run into any intractable issues, it’s also an easy spot to pluck it off and replace it.

Re: Tell HN: Upgrade your Metabase installation

#72

Earlier quoted context omitted.

What kind of tooling do you/people use for that? Or just custom scripts?

Look up OLTP vs OLAP data stores to get an idea. There are a lot of common patterns for the specifics of implementing this. Usually you run a regularly scheduled job that dumps data representing some time period (e.g. daily jobs). There are some considerations for late arriving data, which is a classic DE interview question, but for the most part, big nightly dumps of the last day’s data/transactions/snapshots to dat…

Tangent: I hate OLTP and OLAP as acronyms. They're only one letter/word off and completely obscure the relevant meaning lots of semantic noise. Just say transactional vs analytical processing. (They are still good search key terms because lots of existing literature/resources use the terms)

Re: Tell HN: Upgrade your Metabase installation

#73

Earlier quoted context omitted.

Doesn't look like there is a CVE either: https://www.cvedetails.com/vulnerability-list/vendor_id-1947...

> Will you release any information about the vulnerability? > Yes, we’ll be releasing the patch publicly, as well as a CVE and an explanation in two weeks. We’re delaying release to give our install base a bit of extra time before this is widely exploited. From their blog.

Oh absolutely, but its trivial to get a CVE from the relevant CNA's. A webform or a phone call.

Its a bit silly.

Re: Tell HN: Upgrade your Metabase installation

#74

Earlier quoted context omitted.

Also your production database is optimized for different workloads than your analytics database. Usually production is used for fetching and updating a small number of records at a time (think updating a shopping cart), and has strict latency requirements whereas analytics involves reading a large amount of data in columns (think count group by one or two columns), and can be done in batches where the results can get…

How do you batch write the results (say updating shopping carts) when frontend has to reflect whats in the database?

They're talking about moving data between two different back end databases. Your production database optimized for your application/latency.

Then you have your warehouse database that you updated once a day with information from prod.

Re: Tell HN: Upgrade your Metabase installation

#75

Earlier quoted context omitted.

> Will you release any information about the vulnerability? > Yes, we’ll be releasing the patch publicly, as well as a CVE and an explanation in two weeks. We’re delaying release to give our install base a bit of extra time before this is widely exploited. From their blog.

Oh absolutely, but its trivial to get a CVE from the relevant CNA's. A webform or a phone call. Its a bit silly.

Don't you have to share more details about the exploit then? That seems to be the thing they're trying to avoid for now.

Re: Tell HN: Upgrade your Metabase installation

#76

Earlier quoted context omitted.

Oh absolutely, but its trivial to get a CVE from the relevant CNA's. A webform or a phone call. Its a bit silly.

Don't you have to share more details about the exploit then? That seems to be the thing they're trying to avoid for now.

Negative, you can request a CVE without specific details, CNA's do this all the time until unembargo.
Post reply on HN