5 ms·
I am taking security very seriously. All sensitive rows are protected by RLS, and I have gone even further by adding random noise to all location data. Location
by t4t 2y ago
I am taking security very seriously. All sensitive rows are protected by RLS, and I have gone even further by adding random noise to all location data. Locations are locked down, but in the unfortunate event of a hack what would be leaked is location within a 5 or so mile range, not exact location.
If it is possible on Supabase I would like to eventually obscure emails and oauth info.
- _cenw 2y agoemail me if you need a code review
- etothepii 2y agoWithout wishing to appear overly snippy, this is how I would begin hacking such a site. Offer to do a "code review".
- PaulHoule 2y agoI got an offer of a "code review" like that once for an authentication system and never heard back; it was open source anyway so anybody could have downloaded it and found my rookie mistakes like signed_token = content + MD5(secret_key+content) which doesn't stop anyone from appending to the content (might not have really been exploitable, but any honest review from somebody who knew more than me would have turned it up)
- _cenw 2y ago> Without wishing to appear overly snippy You failed.
- dang 2y ago"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- 2muchcoffeeman 2y agoWhy even keep location data at all?
- t4t 2y agoOne of the main selling points of the app is that you can filter posts by distance, to facilitate people meeting and talking with their community.
- 2muchcoffeeman 2y agoSo list a city?
- nyanpasu64 2y agoI'm wondering if it's more or less safe (from doxxers attacking individual users, or the entire service being compromised) to share location with this app vs. Lex. In any case I chose not to share location yet, and don't know if Lex is any safer (they require location).
- alt227 2y ago5 mile range is pretty serious, it narrows someones locations down to a single town in the entire world. Just dont store it at all and you're all good.
- mmooss 2y agoYou'd need just a little more data to find the individual.
- gowld 2y ago[flagged]
- whalesalad 2y agothis is the most insane thread I have ever seen on hn. "no good deed goes unpunished" comes to mind
- otterley 2y agoThat's not an observation. That's speculation.
- bigiain 2y agoFairly valid speculation, I my opinion. If I were in the US, and particularly in one of the seriously intolerant red states, there's no way I'd want and of my details in their database. I don't think it's catastrophising to consider there may well be very real risks to being openly trans in the US in the near future. Risks of not only blackhat 4chan hackers, but also from government and legal system attacks on sites like this.
- otterley 2y agoThere's nothing new about this, sad though it is. People, particularly insecure people, have tried to suppress minorities since the dawn of time, and they're constantly inventing new ways to do it.
- mmooss 2y agoInteresting ... why can't I Vouch for this post?
- dang 2y agoIt's [flagged] but not [dead]. Past explanations: https://news.ycombinator.com/item?id=39676944 https://news.ycombinator.com/item?id=39676944 https://news.ycombinator.com/item?id=38918548 https://news.ycombinator.com/item?id=38918548