5 ms·
Just want to chime in directly against the flow of negative comments re: security and say two things: 1) I too am exactly in your target audience and I'm psych
by nlh 3y ago
Just want to chime in directly against the flow of negative comments re: security and say two things:
1) I too am exactly in your target audience and I'm psyched to check this out (I'm the solo tech operator of an ecom business and this will exactly scratch an itch I have)
2) I'll echo what I wrote in another comment: It is VERY HN to get concerned about exposing databases, and folks who are posting about the security concerns are not wrong, per se, but also, you are going down a path that many other SaaS apps have successfully gone down, and it's a feature users want and will pay for. So while you should absolutely make sure this is done properly and advise your users not just to expose their databases willy-nilly, don't get psyched out by folks telling you it's a hard no to have to connect a DB directly. Users want this, will pay for it, and you're wise for doing it.
- trvz 3y ago> Users want this The customers of those users absolutely do not want this. If I ever find out a company uses something like this, I'll no longer be doing business with them. > So while you should absolutely make sure this is done properly That is simply not possible.
- Vanclief 3y ago> The customers of those users absolutely do not want this. If I ever find out a company uses something like this, I'll no longer be doing business with them. I second this 100% This for me is a major red flag. It could maybe be mitigated if OP would require customers to run their own instance of cc.dev.
- billoneil 3y agoHosted Looker and many other tools are getting direct DB access these days and I'm sure you use products that do it. As an engineer I'm not a fan of it and it can often cause problems so it's best to point them at read replicas but that is not always how companies set them up.
- nlh 3y agoExactly - you beat me to it. Looker is the canonical example. I think folks would be up for a rude awakening if they really understood how many companies use Looker (or similar advanced analytics apps -- Sisense, ThoughtSpot, etc.) and how directly they connect to DBs.
- DrBenCarson 3y agoHow hard is it to have an API with reasonable RBAC? Why does it NEED database access?
- 5Qn8mNbc2FNCiVV 3y agoIt's more about owning your data.
- re-thc 3y ago> Just want to chime in directly against the flow of negative comments re: security I wonder if these are the same people that are pushing things like Planetscale, Neon, Supabase etc. I have nothing against these services but from what I can see most users discussing these are going with the "public" database approach. i.e. if your database is already public, what's the complaint?