It's kinda shocking that the same Supabase RLS security hole we saw so many times in past vibe coded apps is still in this one. I've never used Supabase but at this point I'm kinda curious what steps actually lead to this security hole.
In every project I've worked on, PG is only accessible via your backend and your backend is the one that's actually enforcing the security policies. When I first heard about the Superbase RLS issue the voice inside of my head was screaming: "if RLS is the only thing stopping people from reading everything in your DB then you have much much bigger problems"
My thought exactly. Is this standard practice with using Supabase to simply expose the production database endpoint to the world with only RLS to protect you?
I think the media is attributing too much to the bats. I was at the Yankees game, and the wind was blowing straight out and hard. Many of the home runs I saw hit would have been fly outs on a day with more normal wind.
Anecdotally, Apple Music has deteriorated exponentially for me. iTunes was such a stable, usable piece of software, but I can't get reliable use out of Apple Music for the life of me. It _feels_ like a shoddy Electron app. But that's not fair to the actual Electron (or similar) apps that actually work. For all its many design and product flaws, Spotify actually works.
I canceled my Apple Music subscription a few years ago after leaving the app open for long times would heat up my computer and use 100% of the cpu. It no longer feels like they have the "it just works" feeling they used to in all of their software.
In every project I've worked on, PG is only accessible via your backend and your backend is the one that's actually enforcing the security policies. When I first heard about the Superbase RLS issue the voice inside of my head was screaming: "if RLS is the only thing stopping people from reading everything in your DB then you have much much bigger problems"