News for hackers. Stuff that matters.

A comment on Supabase – General Availability Week. Parent comment

Re:Supabase – General Availability Week by xytofs on Monday April 15, 2024 @11:26AM (#40041833)
> how are your security teams ok with exposing your PG server to the internet, relying mainly on RLS? And RLS isn't turned on by default, so full tables are exposed to the public internet by default, behind a rather nice REST API.

Tooling is improving constantly and security really is at the top of mind for us. We've got some cool announcements this week that will keep reminding you if you're doing something sketchy!

[ Parent | on HN ]
Re:Supabase – General Availability Week by atonse on Monday April 15, 2024 @01:07PM (#40043116)
Good to hear, thanks.

I really am trying to provide constructive criticism (even if my tone is not great because the pain I'm continuing to feel with the platform is still fresh).

I do think you guys are in a great position to actually improve all that tooling around RLS. Tools that can analyze your policies, that can visually map the recursive nature of policies that run, etc.

[ Parent | on HN ]
Re:Supabase – General Availability Week by omnibrain on Monday April 15, 2024 @01:13PM (#40043171)
An access-simulator where you can check if a user (or anon) has some type of access would be helpful.
[ Parent | on HN ]
Re:Supabase – General Availability Week by kiwicopple on Monday April 15, 2024 @02:12PM (#40043847)
we actually have this:

https://supabase.com/blog/studio-introducing-assistant#user-...

and you can expect to see another related launch this week with some more in-depth tooling:

https://github.com/supabase/splinter

[ Parent | on HN ]