Hacker News Reader

> Row level security is their "foundational piece", but there is a reason why we moved away from database functions and application logic in database over a decade ago: that stuff in unmaintainable.

Funny. In my experience, application-level authorization checks are very error-prone, easy to accidentally omit, and difficult to audit for correctness."Unmaintainable", I suppose.

Whereas RLS gives you an understandable authorization policy with a baseline assurance that you're not accidentally leaking records you shouldn't be.

RLS is great, but it's not that hard to shoot yourself in the foot or miss stuff. E.g.:

  ALTER TABLE bookmarks ENABLE ROW LEVEL SECURITY;
  CREATE POLICY bookmarks_owner ON bookmarks USING (owner_id = auth.uid());
  CREATE VIEW recent_bookmarks AS SELECT * FROM bookmarks ORDER BY created_at DESC LIMIT 5;

The above may look fine at first glance, but recent_bookmarks actually bypasses RLS.

For that there's security invoker now:

  CREATE VIEW recent_bookmarks WITH (security_invoker=true) AS 
  SELECT * FROM bookmarks ORDER BY created_at DESC LIMIT 5;

Point taken though, it's not the default behavior.

Indeed - one of the great changes in v15. (for any folks on previous versions, you need to change the view owner to a non-superuser role without the bypassrls attribute).

Thanks for all your work on PostgREST, Steve! Do you think we'll see relational inserts in the near future, or is that still a bit down the road?

I agree. I would love to see more articles on pocketbase. It's phenomenal and ganigeorgiev is an animal about responding to bugs and discussions. He's got to be a hybrid human and ChatGPT robot.

What's also really cool is that you can also just use PocketBase as a Go library and just build your app around it like any normal web framework, while still having a great UI for quick prototyping. And when you need more custom behaviour instead of database functions, you just write some Go code while still compiling everything down to a single binary that you can copy over.

"Local development is a massive pain"...that's enough to kill it for me. No need to point out anything else.

I don't use supabase, but am a big postgres fan:

> that stuff in unmaintainable

Wrong. Version your functions and use something like liquibase to apply migrations.

And handwrite xml? No thanks. Again, if I wanted to do any of this management myself, I wouldn't be using a PaaS.

You don't have to use the xml format if you don't want to. Not sure why you wouldn't want to, since the xsd enables autocompletion in your IDE which makes it the most practical format of all.

Anyway, YAML and SQL format are a thing

https://docs.liquibase.com/concepts/changelogs/yaml-format.h...

https://docs.liquibase.com/concepts/changelogs/sql-format.ht...

Or Bytebase if you want a more sophisticated GitLab like experience

Way less friendly than writing code IMO

Far, far more performant though for filtering millions of rows

Developer friendly matters early on, performance and security friendly matters at scale

Could you be more specific what is difficult about local development? I've used it locally and had little difficulty.