Hacker Newsnew | past | comments | ask | show | jobs | submit | giogio's commentslogin

My experience with supabase is it does actually warn you constantly if you don't set up RLS


People are using LLMs to generate apps and it's easy for non-technical people to miss this stuff. The blog post mentions https://lovable.dev/ becoming a $300M company, which uses Supabase by default and basically generates React SPA's with no true backend. But random people won't understand this distinction and will want to create full real apps. Doing this serverless is tricky and requires a lot of careful thought to do right.

Lovable is not going to tell them to use a proper auth service or fully secure their data. One Lovable project I looked at had generated an entire custom JS Markdown parser instead of using react-markdown, for example.


> The blog post mentions https://lovable.dev/ becoming a $300B company

I had to double take back to the article after reading this - it actually said $330M (raised at $6.6B valuation). AI investment has been crazy enough I would have actually believed it though!


Fixed, thanks


I don't think you did fix it, you say "becoming a $300M company" but it's actually a $6.6B company, for which we'd be looking at valuation not amount raised.


Now, "non-technical people" should not ever by themselves put anything on the Internet that handles things like names and passwords.

It's bad that some folks want to make money on such people doing it anyway, which means they're not very nice and should get help to correct their ways.


Both the free and paid tiers of lovable don't charge for security fixes, and before you can publish it requests you run security audits.

I've found doing this, and regularly asking "did you just make my system massively insecure" help keep it on its toes.

That said, I've seen a few "look what I just made.." that caused a double take.


I asked claude to build a system that involved parsing some dates and addresses and rather than using a library it wrote hundreds of lines of regexes and term lists ('st', 'street', 'dr', 'drive', 'ave', etc) to match every test case I gave it. Lesson learned.


What was the lesson,

to ask it to use a library,

if that’s what you intend for your codebase?

Assume LLMs and AI products are a rockstar junior dev until proven otherwise. Act accordingly!


LLMs can and often do turn any technology into an insecure heap of shit. I don't see how that's relevant to Supabase specifically.


Why should we care about what non-technical people do wrong in a technical domain?


My experience is watching a colleague use lovable which will mostly ignore security. Sure, if you prompt it the system will do something which seems correct, but it will also happily undo that as well.

eg I was trying to help her set up a webhook listener, and it undid our efforts.

These tools seem incapable of building software in the hands of users who don't understand security already.


> These tools seem incapable of building software in the hands of users who don't understand security already.

These tools are for augmentation of skills, not for wholesale "imma a programmer now", which a lot of people seem to think. And to be honest, lots of companies are selling that "experience" too, even though they know it isn't true, a bit shit.


It's definitely pushed as not needing an engineer.

My colleague now understands why unit tests, after watching subsequent development regularly break previous work. Lovable doesn't support them. And I don't want to touch this codebase because I don't want to own it.


You assume people read. :)


Spend less time on social media, and the internet in general


But I /love/ the Internet, I've been here since the very beginning. It's like seeing your home town get run down and turned into a dumpster.


> But I love the Internet, I've been here since the very beginning.

You've been using the Internet since the 1970s?


This was funny; since a /long/ time ago. Didn't get access to that sweet 3-university intranet hahahaha


I think you and OP are both right.

You are right because it does feel like shit. I'm not experiencing it with AI, but I did experience it several times with technology already. Not a good feeling!

And OP is right because that's what you can actually do - moving on. The thing you like, in the form you liked it, is already gone forever. What you can do on a human level is to take this experience, grieve for what has been lost to you, and later find a way to move on. What I can say is that I always something that ignites that spark in me, no matter how many times I have felt that I have lost it.


That's not your home town tho, you have no right to say what people should or should not enjoy using. And from other people's view, you are just an old person complaining the past was better.


Then do your due dilligence and delve deeply into the concept of dumpster-diving in cybernetic contexts.

(SCNR)


Yeah Federighi made it pretty clear. I'm a little surprised Eddie Cue didn't seem to realize how significant giving up imessage exclusivity could be. But I'm guessing in 2013 there were bigger differences in iPhones vs Android phones, wasn't as clear that eventually it would be a significant reason why someone might choose one over the other. Giving up iMessage in 2013 would be different than giving it up today


All shopify based stores are down


Yep - I have a Shopify app that uses Cloudflare, and was just about to panic when I saw this post.

Turns out no one will notice, as all of Shopify is down anyway ¯\_(ツ)_/¯


looks like lot of sites being impacted by this one


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: