staticassertion

7 ms·

271.
by staticassertion 6mo ago
Of course. But why would that matter if Python can't get there to begin with? You're not going to hit NIC bottlenecks with Python, not without a ton of work and tradeoffs at least.
272.
by staticassertion 6mo ago
I have never suggested that there's something wrong with RLS nor that RLS and an application should be mutually exclusive, as I've pointed out multiple times now.
273.
by staticassertion 6mo ago
I think the conversation is suffering from trying to solve a problem that's underspecified, which is going to just lead to a lot of "what if" questions. I've explained my concern with relying on a single boundary, which
274.
by staticassertion 6mo ago
I think a missing piece here is that you think that Rust won't download a file faster than Python but it absolutely can. This seems to just be a misconception people have about IO, like "download a file" is a thing that exist
275.
by staticassertion 6mo ago
> Correct, but you have yet to mention any other solution where there is more than one boundary at the data access layer. Because there really isn't any. I have. I gave the example of using RLS where users still provide the token to
276.
by staticassertion 6mo ago
Why would I need to invalidate claims made with no support that seem obviously incorrect? Certainly I won't accept them.
277.
by staticassertion 6mo ago
> IO is executed by kernel, file system or network drivers. IO performance is not dependent at all on which language makes the syscalls. I think your posts on this topic can not possibly be worth responding to if you're coming to th
278.
by staticassertion 6mo ago
It sounds like DDOS is the tool they had available. I'm currently ambivalent on using user traffic to perform a DDOS.
279.
by staticassertion 6mo ago
I'm not sure where this "it's always one layer" thing is coming from, that's just not true. Nor do I see where I've said you should toss out RLS for a bespoke system - I see myself saying the opposite a few tim
280.
by staticassertion 6mo ago
> Either your app has all the data access and you put your access control there, or you do the access control in the database. There really aren't other options here. That's odd, I just clearly delineated an option in which thi
281.
by staticassertion 6mo ago
> Your SSO system is a lot of pressure on one control too. Nobody seems to have problems with Azure or Okta or whatever SSO system you use having every key to the kingdom. Some do, which is why they want MFA on the target side as well as
282.
by staticassertion 6mo ago
> I don't think you thought this through? Well I'm not designing some arbitrary system. Don't expect a full spec. > The problem with the app being constrained to RLS is you have User A and User B accessing your API, how
283.
by staticassertion 6mo ago
> What would be your method? I don't know because I don't know your use case. At minimum, direct db access means that every postgres CVE something I'd have to consider deeply. Even just gating access behind an API where th
284.
by staticassertion 6mo ago
Well, I think we basically agree? My suggestion is merely that a database holding financial data should have more than a single layer of security. Granting direct access to a database is a pretty scary thing. A simple example would be that
285.
by staticassertion 6mo ago
Just to be clear, I am extremely pro-RLS.
286.
by staticassertion 6mo ago
I don't have strong feelings about that one way or the other, honestly.
287.
by staticassertion 6mo ago
I don't know their use case enough to understand what would or would not be an appropriate mitigation. For example, with regards to financial data, you could have client side encryption on values where those keys are brokered separatel
288.
by staticassertion 6mo ago
I don't think you have any idea what you're talking about, certainly you don't know what I'm talking about.
289.
by staticassertion 6mo ago
Right, RLS is great. What they are saying is this: > every employee can access our main financial/back office SQL database This means that there is no access gate other than RLS, which includes financial data. That is a lot of pre
290.
by staticassertion 6mo ago
> At the end of the day with all data that is colocated you're trusting that some permission feature somewhere is preventing you from accessing data you're not supposed to. Right but ideally more than one. > But it's al
291.
by staticassertion 6mo ago
Of course it's designed for security... that has nothing to do with my statement. No single boundary is "absolutely reliable", that's my entire point.
292.
by staticassertion 6mo ago
I'd be so uncomfortable with this. It sounds like you're placing the full burden of access on a single boundary. I mean, maybe there's more to it that you haven't spoken about here, but "everything rests on this one
293.
by staticassertion 6mo ago
I think this is a weak framing. Lots of things are moral or immoral under specific circumstances. We should protect people from being murdered. I think murder is usually wrong. But we also likely agree that there are circumstances in which
294.
by staticassertion 6mo ago
They're terrible for not wanting to be dox'd?
295.
by staticassertion 6mo ago
> I'm saying that the Rust might execute in 50ms and the Python in 150ms. Okay, so the Rust code would be 3x as fast. Feels arbitrary, but sure. > You are the one not making sense, we are talking about application performance, wh
296.
by staticassertion 6mo ago
That literally makes no sense. 100ms... out of what? Is it 1ms vs 100ms? 100000ms vs 100100ms? Anyway, dubious claim since a Python interpreter will take 10s of milliseconds just to print out its version. Do you have any evidence? I can poi
297.
by staticassertion 6mo ago
Vague. What's pretty close? I mean, even for IO bound tasks you can pretty quickly validate that the performance between languages is not close at all - 10 to 100x difference.
298.
by staticassertion 6mo ago
My experience has been that performance bugs show up in lots of places and I'm very lucky when it's just a bug. The far more painful performance issues are language and runtime limitations. But, of course, profiling is always step
299.
by staticassertion 6mo ago
> our constant claims that quality and security matter I'm 13 years into this industry, this is the first I'm hearing of this.
300.
by staticassertion 6mo ago
It doesn't come off as unintuitive by my read. They had a bug that led to a massive performance regression. Rewriting the code didn't have that bug so it led to a performance improvement. They found that they had fewer bugs in Pyt

More ›