5 ms·

Skype has had from the beginning the requirement that all database access must be implemented through stored procedures. That presentation starts with hard vio

Skype has had from the beginning the requirement that all database access must be implemented through stored procedures. That presentation starts with hard violence.

Tostino 2y ago
If the database team designed a thoughtful API with stored procedures, this can actually be a quite nice way to interact with a database for specific uses. Being 100% hard and fast on that rule seems like a bad idea though.
- dboreham 2y ago
  Fashionable 20 years ago but thankfully everyone who had that bee in their bonnet seems to have retired.
  - Kinrany 2y ago
    It'll make a comeback once stored procedures can be easily written in real programming languages using standard tools.
    - sgarland 2y ago
      You already can [0]. C, PL/Perl, PL/Python, and PL/Tcl exist out of the box, in addition to PL/pgSQL, which I assume you were implying isn’t a “real programming language.” [0]: https://www.postgresql.org/docs/current/server-programming.html https://www.postgresql.org/docs/current/server-programming.h...
      - Kinrany 2y ago
        Sure, even PL/Rust is available. But what does the deployment pipeline look like, from version control to a live instance?
        sgarland 2y ago
        That is described in the link, in section 36.18, albeit for C. If you have another language, i assume you get to figure out how to make it work. [0]: https://www.postgresql.org/docs/current/extend-pgxs.html https://www.postgresql.org/docs/current/extend-pgxs.html
      - fulafel 2y ago
        Few people seem to be using these. At a guess the dev experience is not great.
        sgarland 2y ago
        Frankly, I think devs need to stop being such primmadonnas about DX. Not everything has a slick UI that does most of the work for you. Take Linux, for example: you have to email your PR as a patch, inline as plaintext to a mailing list. Yet somehow, they manage, and it had an incredibly active community.
        fulafel 2y ago
        Alternative programming languages are all about DX. PL/pgsql is turing complete after all.
        sgarland 2y ago
        It is indeed, but I’ll be the first to admit it’s a bit clunky to use beyond a few variables and actions. Sorry for snapping. I’m exhausted with devs complaining that some older and well-established piece of tech (Postgres, HAProxy, nginx to name a few) isn’t easy enough to use, and then using something demonstrably worse, or writing their own terrible version of it. Work trauma.
    - deleted 2y ago
      [deleted]
  - tomnipotent 2y ago
    I think it's a perfectly fine approach in 2025 now that that CI/CD have proliferated and you're less likely to run into a human DBA arbitrarily blocking deployments. It was always the feudal lord mentality of DB operations that made relying so much on stored procedures undesirable.
sgarland 2y ago
I would much rather this than letting devs write their own queries, ORM or not. But then, I own the DBs, and I am constantly dealing with the result of poor schema and query decisions.
fmajid 2y ago
Righteous violence. One of the benefits of stored procedures they don't mention is SECURITY DEFINER, which is like setuid. You can for instance have a user table with login and hashed password, have a stored procedure that can verify login and password, without giving SELECT access to the user table to the database user your application use. Stored procedures also block SQL injection attacks.

Skype has had from the beginning the requirement that all database access must be implemented through stored procedures. That presentation starts with hard violence.

Tostino 2y ago

If the database team designed a thoughtful API with stored procedures, this can actually be a quite nice way to interact with a database for specific uses. Being 100% hard and fast on that rule seems like a bad idea though.

dboreham 2y ago
Fashionable 20 years ago but thankfully everyone who had that bee in their bonnet seems to have retired.
- Kinrany 2y ago
  It'll make a comeback once stored procedures can be easily written in real programming languages using standard tools.
  - sgarland 2y ago
    You already can [0]. C, PL/Perl, PL/Python, and PL/Tcl exist out of the box, in addition to PL/pgSQL, which I assume you were implying isn’t a “real programming language.” [0]: https://www.postgresql.org/docs/current/server-programming.html https://www.postgresql.org/docs/current/server-programming.h...
    - Kinrany 2y ago
      Sure, even PL/Rust is available. But what does the deployment pipeline look like, from version control to a live instance?
      - sgarland 2y ago
        That is described in the link, in section 36.18, albeit for C. If you have another language, i assume you get to figure out how to make it work. [0]: https://www.postgresql.org/docs/current/extend-pgxs.html https://www.postgresql.org/docs/current/extend-pgxs.html
    - fulafel 2y ago
      Few people seem to be using these. At a guess the dev experience is not great.
      - sgarland 2y ago
        Frankly, I think devs need to stop being such primmadonnas about DX. Not everything has a slick UI that does most of the work for you. Take Linux, for example: you have to email your PR as a patch, inline as plaintext to a mailing list. Yet somehow, they manage, and it had an incredibly active community.
        fulafel 2y ago
        Alternative programming languages are all about DX. PL/pgsql is turing complete after all.
        sgarland 2y ago
        It is indeed, but I’ll be the first to admit it’s a bit clunky to use beyond a few variables and actions. Sorry for snapping. I’m exhausted with devs complaining that some older and well-established piece of tech (Postgres, HAProxy, nginx to name a few) isn’t easy enough to use, and then using something demonstrably worse, or writing their own terrible version of it. Work trauma.
  - deleted 2y ago
    [deleted]
- tomnipotent 2y ago
  I think it's a perfectly fine approach in 2025 now that that CI/CD have proliferated and you're less likely to run into a human DBA arbitrarily blocking deployments. It was always the feudal lord mentality of DB operations that made relying so much on stored procedures undesirable.

sgarland 2y ago

I would much rather this than letting devs write their own queries, ORM or not. But then, I own the DBs, and I am constantly dealing with the result of poor schema and query decisions.

fmajid 2y ago

Righteous violence. One of the benefits of stored procedures they don't mention is SECURITY DEFINER, which is like setuid. You can for instance have a user table with login and hashed password, have a stored procedure that can verify login and password, without giving SELECT access to the user table to the database user your application use. Stored procedures also block SQL injection attacks.