I am taking security very seriously. All sensitive rows are protected by RLS, and I have gone even further by adding random noise to all location data. Locations are locked down, but in the unfortunate event of a hack what would be leaked is location within a 5 or so mile range, not exact location.

If it is possible on Supabase I would like to eventually obscure emails and oauth info.

5 mile range is pretty serious, it narrows someones locations down to a single town in the entire world. Just dont store it at all and you're all good.

You'd need just a little more data to find the individual.

Why even keep location data at all?

One of the main selling points of the app is that you can filter posts by distance, to facilitate people meeting and talking with their community.

So list a city?

I'm wondering if it's more or less safe (from doxxers attacking individual users, or the entire service being compromised) to share location with this app vs. Lex. In any case I chose not to share location yet, and don't know if Lex is any safer (they require location).

I'm sorry, but considering your rapid pace of development and team size, and the extremely sensitive content and vulnerable user base, I have no faith that security and privacy are well-maintained against malicious users and attackers.

This is no disrespect to the quality of the prototype you have built. This is a real-world pragmatic observation.

this is the most insane thread I have ever seen on hn.

"no good deed goes unpunished" comes to mind

That's not an observation. That's speculation.

Fairly valid speculation, I my opinion.

If I were in the US, and particularly in one of the seriously intolerant red states, there's no way I'd want and of my details in their database.

I don't think it's catastrophising to consider there may well be very real risks to being openly trans in the US in the near future. Risks of not only blackhat 4chan hackers, but also from government and legal system attacks on sites like this.

There's nothing new about this, sad though it is. People, particularly insecure people, have tried to suppress minorities since the dawn of time, and they're constantly inventing new ways to do it.

Interesting ... why can't I Vouch for this post?

It's [flagged] but not [dead]. Past explanations:

https://news.ycombinator.com/item?id=39676944

https://news.ycombinator.com/item?id=38918548

email me if you need a code review

Without wishing to appear overly snippy, this is how I would begin hacking such a site.

Offer to do a "code review".

I got an offer of a "code review" like that once for an authentication system and never heard back; it was open source anyway so anybody could have downloaded it and found my rookie mistakes like

  signed_token = content + MD5(secret_key+content)

which doesn't stop anyone from appending to the content (might not have really been exploitable, but any honest review from somebody who knew more than me would have turned it up)

> Without wishing to appear overly snippy

You failed.

"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."

https://news.ycombinator.com/newsguidelines.html

Threat model this shit.

I would dead man switch the storage's Azure instance. Mayybe the whole thing. Mayybe shouldn't be on azure.

Nm assumed RLS as a MS TLA. PGsql has it as well. Comment stands, watch data residency.

> if, say, the community was hacked and private email addresses (or other PII) was leaked.

Or just basic ISP, or other provider, logging domains visited per user.