Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are moving to General Availability

supabase.com

Post reply on HN
Print view View original

81–90 of 106 posts

Re: We are moving to General Availability

#81

Post by steve-chavez »

TOMDM wrote: post #72
davetron5000 wrote: post #70

I built a toy app using this, with a front-end only app and postgrest + RBS. The app was seriously two forms behind a login. It was a huge pain. RBS is "insecure by default" meaning if you don't set it up right, all users can access all data. And, because it's SQL, it's really easy to write a valid and successful configuration that doesn't work. You have to test it. And for views, you have to do some real heroics to…

A few things, RLS is secure by default, it's postgrest that's insecure by default. RLS disables all operations on a table once enabled and is only operable once there's a passing policy unless you can bypass RLS. When it comes to access control, you should probably always have tests for anything halfway important. Views are a bit of a footgun when it comes to RLS, they bypass it by default. But getting them to play n…

> A few things, RLS is secure by default, it's postgrest that's insecure by default.

What makes you think that? PostgREST delegates all the authorization to PostgreSQL, which is secure by default. You have to explicitly assign privileges to roles for every operation.

Relevant previous discussion: https://news.ycombinator.com/item?id=38689294

Re: We are moving to General Availability

#82

Post by breakingcups »

I've been trying out Supabase for an MVP but while the hosted postgres part is quite nice, the C# SDK recommended (but not maintained) by Supabase falls quite short, leaving me to trace down all sorts of obscure issues that turn out to be a 2-year-old bug in the SDK that's still not fixed. It is kind of nice for a community effort but definitely not good enough at all for professional adaptation by .NET developers.

On paper, Supabase really has all the ingredients I should need to make my application. In practice, I still end up struggling a lot with the development model. I wish there was an easier, safer way to create RLS rules that doesn't need me knowing (to me) obscure Postgres syntax. This is especially grating since the rest of the tooling seems to try to take me away from SQL a lot by using Postgrest.

Re: We are moving to General Availability

#83

Post by throwaway295729 »

williamdclt wrote: post #67
k_vi wrote: post #55

Earlier quoted context omitted.

Tried Supabase but currently only use their Auth. The server to database latency was very high(few hundred ms) whereas Planetscale DB in the same region gives sub 10ms. Still great option for most projects that can do with these issues.

I struggle to imagine projects that can do with a db latency of several hundred ms? Something fully async maybe, any human interaction would be incredibly slow

And functions often have multiple db calls not just one. The latency would be a deal breaker no?

Re: We are moving to General Availability

#84

Post by steve-chavez »

davetron5000 wrote: post #70

I built a toy app using this, with a front-end only app and postgrest + RBS. The app was seriously two forms behind a login. It was a huge pain. RBS is "insecure by default" meaning if you don't set it up right, all users can access all data. And, because it's SQL, it's really easy to write a valid and successful configuration that doesn't work. You have to test it. And for views, you have to do some real heroics to…

> PostGREST is very very basic and far less powerful than just writing SQL. I found it pretty frustrating to use, knowing that SQL would be far simpler.

The PostgREST query grammar is basic on purpose, you're supposed to write SQL on views or functions[1] to extend its capabilities.

[1]: https://postgrest.org/en/v12/references/api/stored_procedure...

Re: We are moving to General Availability

#85

Post by steve-chavez »

breakingcups wrote: post #82

I've been trying out Supabase for an MVP but while the hosted postgres part is quite nice, the C# SDK recommended (but not maintained) by Supabase falls quite short, leaving me to trace down all sorts of obscure issues that turn out to be a 2-year-old bug in the SDK that's still not fixed. It is kind of nice for a community effort but definitely not good enough at all for professional adaptation by .NET developers. O…

> This is especially grating since the rest of the tooling seems to try to take me away from SQL a lot by using Postgrest.

You're actually encouraged to write SQL with PostgREST, see this other comment https://news.ycombinator.com/item?id=40046710

Re: We are moving to General Availability

#86

Post by keeganpoppen »

Takennickname wrote: post #77
Jabbles wrote: post #76

Earlier quoted context omitted.

Why do you not use capital letters in the typical way?

It is a little bit painful to read. Capital letters exist for a reason (to make reading easier)

what exactly do capital letters make easier to read? i dont think readability is why they are used for proper nouns, names, nor the pronoun I. and obviously ALL CAPS isnt a readbility improvement either. presumably just as delineation of one sentence to the next? (forgive my ironic non-use of caps to start sentences haha).

Re: We are moving to General Availability

#87

Post by Takennickname »

keeganpoppen wrote: post #86
Takennickname wrote: post #77

Earlier quoted context omitted.

It is a little bit painful to read. Capital letters exist for a reason (to make reading easier)

what exactly do capital letters make easier to read? i dont think readability is why they are used for proper nouns, names, nor the pronoun I. and obviously ALL CAPS isnt a readbility improvement either. presumably just as delineation of one sentence to the next? (forgive my ironic non-use of caps to start sentences haha).

Correct. The dileneation of one sentence to the next, which is somewhat an indicator of the end of one thought - or fragment of thought - and the beginning of the next.

Re: We are moving to General Availability

#88

Post by lakomen »

I have to say, I tried it but at that time the self hosted offering was too limited, and the good stuff, the useful stuff was behind the cloud subscription paywall.

The initial experience was easy to get going, but the devil was in the details. Much of the logic should be server side also for security reasons and that wasn't possible when I tried it.

People like to hype things that are easy to get started with but don't go much further so the initial impression remains.

I think the appeal is to people who like doing frontend but don't like doing backend.

Re: We are moving to General Availability

#89

Post by benreesman »

kiwicopple wrote: post #2

hey hn, supabase ceo here we just announced GA, after ~4 years of beta. for those who don't know: supabase is a postgres hosting company. we also host other open source "backend" tools that make it easy to get started with postgres (tools like PostgREST for auto-generate APIs [0]) we owe a lot to the HN community. you launched us 4 years ago [1], when we were just a few developers. since then HN has been a staple in…

I’ve just started dabbling so take this with a grain of salt.

Overall, it’s great. I recommend it to people. The high signal part is what I would work on:

- deeper integrations with common OpenID Connect providers, with a pretty foolproof “bail to browser view that looks like Kinde or Clerk”. there’s only so much you can do, but it’s not trivial to get wired up to a bunch of pick-and choose SSOs.

- prisma should be front and center, the auth/public schema split is not a breeze, Prisma slays at being an ORM, Supabase slays at other things. It’s not obvious whether or not to use realtime or Pulse.

- force the env footprint on e.g. next or expo or whatever, it’s a little glue, it’s a lot of people who don’t pop out of the funnel.

- chat / dm is a common enough use case to be in the wizard (like avatars), Postgres handles it fine for small to medium apps, and arguably for big ones

- have a pass through mode for the local deploy that’s easy to toggle, you guys are fast AF, it’s often sane to dev directly against the instance.

- I’m sure you’re already building the kind of anonymized training sets that let you spot bad configs a mile away.

Again, nitpicks on a great product. I love Supabase.

Re: We are moving to General Availability

#90

Post by kiwicopple »

benreesman wrote: post #89
kiwicopple wrote: post #2

hey hn, supabase ceo here we just announced GA, after ~4 years of beta. for those who don't know: supabase is a postgres hosting company. we also host other open source "backend" tools that make it easy to get started with postgres (tools like PostgREST for auto-generate APIs [0]) we owe a lot to the HN community. you launched us 4 years ago [1], when we were just a few developers. since then HN has been a staple in…

I’ve just started dabbling so take this with a grain of salt. Overall, it’s great. I recommend it to people. The high signal part is what I would work on: - deeper integrations with common OpenID Connect providers, with a pretty foolproof “bail to browser view that looks like Kinde or Clerk”. there’s only so much you can do, but it’s not trivial to get wired up to a bunch of pick-and choose SSOs. - prisma should be f…

this is all great, actionable feedback. Thanks for this - really nice list
Post reply on HN