4 ms·

> I've realized I can't "just ship" a product that relies on a hand-rolled user-authorization scheme that I create with very little experience. Time to ship an

by jezek2 2y ago

> I've realized I can't "just ship" a product that relies on a hand-rolled user-authorization scheme that I create with very little experience. Time to ship and get the experience :) It is probably not that bad as you think it is. You can also ask others if they see any obvious security/cryptography fails and you would do better than most including big companies... > So now I've interrupted my whole project to learn Supabase and oh yeah, containers... because I've never used those either and as far as I can tell I'd better use those for deployment and scalability. Please don't. Leave it for later if it is truly needed. You can ship without. Don't be lured to the clouds, they're too expensive and you will need to learn and change a lot. Instead use VPSes and/or dedicated servers from cheap providers such as OVH/Hetzner. Just running your server app on a normal Linux VM is a way simpler than any cloud solution. It can also handle quite a lot, it might surprise you. And you wouldn't get insane invoices for 10-100x overpriced traffic that the clouds have and that kills many ideas even when it would make sense to do them in the cloud otherwise.

DidYaWipe 2y ago
Thanks for the advice! I did run a somewhat similar app with essentially no API security on a cheap-ass Linode VPS around 2011. But we only had 10-20K users and those extremely sporadic. But, although users controlled their content, it was totally anonymous. I didn't require a single credential, not even an E-mail address. One thing about Supabase is that it's supposed to offer user verification through E-mail out of the box, which saves me the time of hand-rolling that. The reason I want containers is to spin up multiple instances if the thing blows up. Isn't it easier to do that with containerized services?
- jezek2 2y ago
  Depends on the application. I tend to have a single binary, you just need a language runtime and/or database, rarely some other software. You can script installation of this. I don't see how the containers add a value when you can do the same directly. The last time I've tried Docker to run some application it tried to overtake my testing VM and it failed miserably. Apparently it is not compatible with chroot and it doesn't check for it so it fails somewhere in the middle with various processes and stuff left behind. Doesn't give me a good impression of such software, it lacks both an awareness of a standard feature and an inability to handle failed states gracefully.
  - DidYaWipe 2y ago
    If you create a single image you're supposed to be able to spin up new instances at will, on separate VPSes or on cloud providers. I will depend on Deno, MariaDB, and probably S3 at the least. I was able to make an image with Deno and my code on it and get it working on my machine locally pretty quickly, which was exciting.

by jezek2 2y ago

DidYaWipe 2y ago

Thanks for the advice! I did run a somewhat similar app with essentially no API security on a cheap-ass Linode VPS around 2011. But we only had 10-20K users and those extremely sporadic. But, although users controlled their content, it was totally anonymous. I didn't require a single credential, not even an E-mail address. One thing about Supabase is that it's supposed to offer user verification through E-mail out of the box, which saves me the time of hand-rolling that. The reason I want containers is to spin up multiple instances if the thing blows up. Isn't it easier to do that with containerized services?

jezek2 2y ago
Depends on the application. I tend to have a single binary, you just need a language runtime and/or database, rarely some other software. You can script installation of this. I don't see how the containers add a value when you can do the same directly. The last time I've tried Docker to run some application it tried to overtake my testing VM and it failed miserably. Apparently it is not compatible with chroot and it doesn't check for it so it fails somewhere in the middle with various processes and stuff left behind. Doesn't give me a good impression of such software, it lacks both an awareness of a standard feature and an inability to handle failed states gracefully.
- DidYaWipe 2y ago
  If you create a single image you're supposed to be able to spin up new instances at will, on separate VPSes or on cloud providers. I will depend on Deno, MariaDB, and probably S3 at the least. I was able to make an image with Deno and my code on it and get it working on my machine locally pretty quickly, which was exciting.