5 ms·
Yeah, I've never understood how this concept can work for most applications. In everything I build I always need to do something with the input before writing i
by Kiro 3y ago
Yeah, I've never understood how this concept can work for most applications. In everything I build I always need to do something with the input before writing it to a database. Just security rules are not enough.
What kind of apps are people building where you don't need backend logic?
- amadeuspagel 3y agoMany apps where every user has his own data, which just needs to be synced between devices.
- Falimonda 3y agoCurious as to which apps if there are any you can point to?
- amadeuspagel 3y agoA typical notes app.
- refulgentis 3y agoIt's a really good question context: I have a near-100% naive perspective. Mobile dev whose built out something approximating Perplexity on Supabase. I have to use edge functions for ex. CORS, but by and large, logic is all in the app. Probably because the client is in Flutter, and thus multiplatform & web in one, I see manipulating the input on both the client and server as code duplication and error prone. I think if I was writing separate native apps, I'd push everything through edge functions, approximating your point: better to have that sensitive logic of what exactly is committed to the DB in one place.
- cbsmith 3y agoI think I missed where writing to the database precludes backend logic. Databases have triggers and integrity rules, but beyond that, why can't logic execute after data is written to a database?
- withinboredom 3y agoBecause once it is written to the database, it can be output somewhere before you execute your logic. IE, explicit language, child porn, etc. You generally want to check for that BEFORE you write the data.
- cbsmith 3y agoYou're saying it's impossible to have public write access to a table without also providing public read access? "it can be output somewhere before you execute your logic" is a design choice that is orthogonal from whether you execute your logic before or after input into the database.
- withinboredom 3y agoYou generally don't want to write child porn to disk, if you can help it.
- cbsmith 3y agoFirst of all, most database records couldn't fit child porn, unless it was somehow encoded across thousands of records, in which case you couldn't realize it was child porn until after you've stored 99% of it. Sure though, by putting "child porn" in a sentence, you can make anything seem bad. Tell me this, would you rather your application middleware was in the "copying child porn" business? ;-) Actually, the more I think about it, the crazier this seems. You're going to store all the "child porn" you receive in RAM until you've validated that it is child porn?
- withinboredom 3y agoI don’t get your tone or why you seem shocked that binary data can be stored in a database. Postgres and MySQL both have column sizes for binary data that can hold gigabytes. Second, you generally need to hold the entire image in RAM to create the perceptual hash needed to check that the image is/isn’t child porn.
- abeisgreat 3y agoWriting directly to Firebase is rarely done past the MVP stage. Normally it's the reading which is done directly from the client. Generally writes are bounced through Cloud Functions or a traditional server of some form. Some also "fan out" data, where a user has a private area to write to (say a list of tweets) then they get "fanned out" to follower's timelines via an async backend process which does any verification / cleansing as needed.
- xyzeva 3y agoSadly, most developers don't know this and continue to write from frontend, almost all of the apps and websites we found did this.