3 ms·

Definitely taking all the security measures I can, but you're right, things can go wrong. I do encourage (and would like to enforce) that db credentials provide

Definitely taking all the security measures I can, but you're right, things can go wrong. I do encourage (and would like to enforce) that db credentials provided should have very limited read access to only the tables/columns that the user wants to query. Having said that, it's totally understandable that some orgs won't want do open up their db. The idea with going open source would be that they can host the platform in their VPC so that their data is never leaving the premises. Not against having an SDK or API at all, but I would need to think about would work because the whole syncing issue is one that I'm focused on addressing here.

Exuma 3y ago
I'm not a security expert, but at the very least if I were you make your docs very good for people who dont want to wade through 1000 different documentation to find how to very simply create a read-only user with access to specific table + columns. Or better yet even, how to create a read only view with ONLY the email/name and not any other PII, and then give access to that.
CableNinja 3y ago
You dont need to go open source to allow self hosting, and, youll likely lose money that way. Its entirely possible to allow self hosting without being open source. Plenty of other projects do it. That being said, self hosting doesnt solve all issues. You, and whoever uses this product, will need MANY IPs because of blacklisting and throttling limits applied almost worldwide to all mail servers. Theres a reason why the marketing spam hosts have their own /24 or /25 and have 80% of them cycling through usage as a mail sender. Im not knocking your want to have something better than MailChimp and the like, but i feel like you didnt really dig into the real underlying tech and security before you went to work on this.
- tln 3y ago
  You realize that the sending is done by Amazon SES right?
  - CableNinja 3y ago
    I did not. At that point id just configure SES outright and not even use this solution. Most other services use direct mailing from their own servers

Exuma 3y ago

I'm not a security expert, but at the very least if I were you make your docs very good for people who dont want to wade through 1000 different documentation to find how to very simply create a read-only user with access to specific table + columns. Or better yet even, how to create a read only view with ONLY the email/name and not any other PII, and then give access to that.

CableNinja 3y ago

You dont need to go open source to allow self hosting, and, youll likely lose money that way. Its entirely possible to allow self hosting without being open source. Plenty of other projects do it. That being said, self hosting doesnt solve all issues. You, and whoever uses this product, will need MANY IPs because of blacklisting and throttling limits applied almost worldwide to all mail servers. Theres a reason why the marketing spam hosts have their own /24 or /25 and have 80% of them cycling through usage as a mail sender. Im not knocking your want to have something better than MailChimp and the like, but i feel like you didnt really dig into the real underlying tech and security before you went to work on this.

tln 3y ago
You realize that the sending is done by Amazon SES right?
- CableNinja 3y ago
  I did not. At that point id just configure SES outright and not even use this solution. Most other services use direct mailing from their own servers