Posted by skilldeliver 1 day ago
You have to explicitly create a read-all policy for anon keys, and with no constraints, for people to get access to it.
The default is secure.
If you turn off RLS, there are warnings everywhere that the table is unsecured.
The author goes on to compare this with PocketBase, which he says you "have to go out of your way" to make insecure. You have to go out of your way with Supabase, as well!
I wonder if the author tested this? I do agree that some third party website builders who use supabase on the back end could have created insecure defaults, but that's not supabase's fault.
Submitters: baity and misleading titles are against the site guidelines, so please don't post them here.
The tldr is that Supabase makes this less secure by default because Security is Hard and they don’t want to scare off new users
The fact that it takes a whole thread of conversation to even unwrap whether the default approach they took is good enough is a strong signal to me that it isn’t, because that level of complexity in the implementation often implies a model with a large enough attack surface with weaknesses that can be exploited without too much effort
Yep: https://supabase.com/docs/guides/auth/managing-user-data
> For security, the Auth schema is not exposed in the auto-generated API. If you want to access users data via the API, you can create your own user tables in the public schema.
Lovable is not going to tell them to use a proper auth service or fully secure their data. One Lovable project I looked at had generated an entire custom JS Markdown parser instead of using react-markdown, for example.
I had to double take back to the article after reading this - it actually said $330M (raised at $6.6B valuation). AI investment has been crazy enough I would have actually believed it though!
to ask it to use a library,
if that’s what you intend for your codebase?
Assume LLMs and AI products are a rockstar junior dev until proven otherwise. Act accordingly!
I've found doing this, and regularly asking "did you just make my system massively insecure" help keep it on its toes.
That said, I've seen a few "look what I just made.." that caused a double take.
It's bad that some folks want to make money on such people doing it anyway, which means they're not very nice and should get help to correct their ways.
eg I was trying to help her set up a webhook listener, and it undid our efforts.
These tools seem incapable of building software in the hands of users who don't understand security already.
These tools are for augmentation of skills, not for wholesale "imma a programmer now", which a lot of people seem to think. And to be honest, lots of companies are selling that "experience" too, even though they know it isn't true, a bit shit.
My colleague now understands why unit tests, after watching subsequent development regularly break previous work. Lovable doesn't support them. And I don't want to touch this codebase because I don't want to own it.
But what the docs don't cover is the provided Users table. Missing documentation is why I gave up on Supabase; and the Users table was one of the first problems I encountered. I could find no details on what to expect in each column at any given time.
Upon creating a new user, values get set in this table for no apparent reason. So if your application depends on knowing the verification status of a new user (for example), good luck... Supabase claimed every user was verified upon creation.
These have gotten much less annoying to use now that it’s controlled through the config.toml.
Read this for a high level overview useful for HN: https://community.qbix.com/t/streams-plugin-access-control/2...
Only thing it actually makes easier is auth. Other stuff just becomes harder to maintain. A simple springboot Java app, especially with basic boilerplate implemented with llm help, will last a long time, be cheap+simple to host, easily extensible.
[1] https://www.cs.tau.ac.il/~mad/publications/sigmod2023-rls.pd...
Yep. Probably the most relatable tech friend thing to do. I send my projects to friends and get a list of improvement suggestions, it's always fun!