4 ms·

I'm curios - my naive understanding that instead of using backend which will allow limited subset of actions/validate input, there is some 3rd party DB ( Fireba

I'm curios - my naive understanding that instead of using backend which will allow limited subset of actions/validate input, there is some 3rd party DB ( Firebase ?) which works via some sort of per-user API keys to allow fetch directly by frontend devs?

Anduia 2y ago
Firestore's quick setup uses "test mode", which is free and unrestricted. The "locked mode" recommended for production blocks all reads and writes until you set up the rules. So I don't know if they had the site in test mode, or they simply set a rule to allow everything (I've seen that happen) instead handling access based on user permissions.
- ForTheKidz 2y ago
  Wait, firebase allows full access to http connections accessible from a browser? Wtf? Why would you want to give the user direct access to a database to begin with? Is firebase built around the idea of not running your own servers or something?
  - sunbum 2y ago
    Firebase is not a db, its an entire platform as a service. So you don't really create much a backend, it handles it all for you.
  - johnecheck 2y ago
    Pretty much. Google manages everything. It handles Auth, which ties into the rules for accessing Firestore (the db), and you've got Functions for any code that needs to run server-side. All with libraries in a lot of languages to make it easy. Pretty solid product with a cohesive experience and a generous free tier. Naturally, you'll pay an exorbitant amount once you start to scale and realize you've been locked in.
    - ForTheKidz 2y ago
      Huh! I just spent an hour diving in and I see now. Crazy giving up that much control of your product to a third party. I can definitely see the appeal to spike realtime/chat projects, though—they really leaned into that api design well. Selling out to google was a mistake.
    - koakuma-chan 2y ago
      Aren't firebase apps notorious for having really stupid vulnerabilities?
      - johnecheck 2y ago
        Wouldn't surprise me, but this isn't really google's fault. As a product with a ton of appeal to the least experienced developers, lots of mistakes happen. My understanding is that (assuming you trust google) there's no reason you can't build a secure application on firebase.
  - reportgunner 2y ago
    Yeah you can't really run it on-site so you just debug in the open.
- pfg_ 2y ago
  In this case they had permissiona set up - but your application status was stored in the same object as the rest of the info you could modify, and you were allowed to read and write to it.

Anduia 2y ago

Firestore's quick setup uses "test mode", which is free and unrestricted. The "locked mode" recommended for production blocks all reads and writes until you set up the rules. So I don't know if they had the site in test mode, or they simply set a rule to allow everything (I've seen that happen) instead handling access based on user permissions.

ForTheKidz 2y ago
Wait, firebase allows full access to http connections accessible from a browser? Wtf? Why would you want to give the user direct access to a database to begin with? Is firebase built around the idea of not running your own servers or something?
- sunbum 2y ago
  Firebase is not a db, its an entire platform as a service. So you don't really create much a backend, it handles it all for you.
- johnecheck 2y ago
  Pretty much. Google manages everything. It handles Auth, which ties into the rules for accessing Firestore (the db), and you've got Functions for any code that needs to run server-side. All with libraries in a lot of languages to make it easy. Pretty solid product with a cohesive experience and a generous free tier. Naturally, you'll pay an exorbitant amount once you start to scale and realize you've been locked in.
  - ForTheKidz 2y ago
    Huh! I just spent an hour diving in and I see now. Crazy giving up that much control of your product to a third party. I can definitely see the appeal to spike realtime/chat projects, though—they really leaned into that api design well. Selling out to google was a mistake.
  - koakuma-chan 2y ago
    Aren't firebase apps notorious for having really stupid vulnerabilities?
    - johnecheck 2y ago
      Wouldn't surprise me, but this isn't really google's fault. As a product with a ton of appeal to the least experienced developers, lots of mistakes happen. My understanding is that (assuming you trust google) there's no reason you can't build a secure application on firebase.
- reportgunner 2y ago
  Yeah you can't really run it on-site so you just debug in the open.
pfg_ 2y ago
In this case they had permissiona set up - but your application status was stored in the same object as the rest of the info you could modify, and you were allowed to read and write to it.