6 ms·
Firebase let's anyone get started in 30 seconds. Details like proper usage, security, etc. Those are often overlooked. Google isn't to blame if you ship a paid
by 999900000999 2y ago
Firebase let's anyone get started in 30 seconds.
Details like proper usage, security, etc. Those are often overlooked. Google isn't to blame if you ship a paid product without running a security audit.
I use firebase essentially for hobbyist projects for me and my friends.
If I had to guess these issues come about because developers are rushing to market. Not Google's fault ... What works for a prototype isn't production ready.
- bastawhiz 2y ago> Google isn't to blame if you ship a paid product without running a security audit. Arguably, if you provide a service that makes it trivial to create security issues (that is to say, you have to go out of your way to use it correctly) then it's your fault. If making it secure means making it somewhat less convenient, it's 100% your fault for not making it less convenient.
- 999900000999 2y agoWhat if I need to hack together a POC for 3 people to look at. It's my responsibility to make sure when we scale from 3 users to 30k users we take security seriously. As my old auto shop teacher used to say, if you try to idiot proof something they'll build a better idiot. Even if Google warns you in big bold print "YOU ARE DOING SOMETHING INSECURE", someone out there is going to click deploy anyway. You're arguing Google disable the deploy button, which I simply disagree with.
- prophesi 2y agoI think that's throwing the baby out with the bathwater; sane defaults are still an important thing to think about when developing a product. And for something as important as a database, which usually requires authentication or storing personal information, let your tutorials focus on these pain points instead of the promise of a database-driven app with only clientside code. It's awesome, but I think it deserves the notoriety for letting you shoot yourself in the foot and landing on the front page of HN. Author also found a similar exploit via Firebase for the Arc Browser[0] I have a similar qualm with GraphQL. [0] https://kibty.town/blog/arc/ https://kibty.town/blog/arc/
- cdmyrm 2y agoAny purported expert who uses software without considering its security is simply negligent. I'm not sure why people are trying to spin this to avoid placing the blame on the negligent programmer(s).
- misiek08 2y agoWeak programmers do this to defend this group making crap software. I agree that defaults should be secure and maybe there should be request limit on admin, full access token - but then people will just create another token with full access and use it.
- Eisenstein 2y agoAnd if it is the programmer's fault, what can we do about it? People are trying to avoid finding a solution that isn't throwing their hands up in the air. We either need to solve the problem in a place that is effective with the situation as it is (the tools) or we need to solve the situation such that it has consequences for doing the wrong thing on the part of the developer. Which shall it be?
- ImPostingOnHN 2y agoSince those are only 2 options, and there are many more options, I'll pick option 3: convince people to value and fund universal education more from preschool on, building a better foundation for engineers and other professions in the decades following. In addition to that, it'd be cool if the blameless postmortems were made public, so everyone could learn from them. As for the other 2 options of restricting freedom, and extremely blameful postmortems, I reject both.
- Eisenstein 2y agoYes, being held accountable for your decisions is a restriction on your freedom.
- 2y ago
- IshKebab 2y agoThen you should have to click a big red button labelled "Enable insecure mode". Defaults should be secure. Kind of blows my mind people still don't get this.
- withinboredom 2y agoI’ve seen devs deploy production software with the admin password being “password”. I don’t think you are listening when they are saying “they’ll build a better idiot”.
- IshKebab 2y agoRight because nobody ever makes a mistake. That's why we don't have seatbelts of safety harnesses or helmets or RCDs. There's always going to be an idiot that drives without a seatbelt so why bother at all right?
- turtlebits 2y agoWhen you drive without a seatbelt, it only affects you. If you drive in a way that affects the safety of others, there are generally consequences.
- bell-cot 2y agoLegal Dept: +10, Favorite Marketing Dept: -10, Flag
- jbverschoor 2y agoOh they are. Just like mongo and others. It’s a deliberate decision to remove basic security features in order to get traction. Remove as much hurdles to increase adoption.
- cdmyrm 2y agoShould we outlaw C because it lets you dereference null pointers, too?
- IshKebab 2y agoErm yes! Even the White House has said that. The only reason we didn't for so long was because we didn't have a viable alternative. Now we do, we should absolutely stop writing C.
- withinboredom 2y agoThe white house recently said a lot of things. But of all things, I don’t think they’re even qualified to have an opinion about software, or medical advice, or… well, anything that generally requires an expert.
- ameliaquining 2y agoThis is referring to a report issued in 2024, under the previous administration. It has nothing to do with anything currently in the news.
- bastawhiz 2y agoI've never paid a company for C
- pcthrowaway 2y agoTo be fair, Cursor does this quite handily also.