I am several hundred opossums in a trench coat

  • 1 Post
  • 48 Comments
Joined 2 years ago
cake
Cake day: July 1st, 2023

help-circle


  • I agree that this is ultimately a problem with developers lacking security knowledge and general understanding, but my issue with Firestore specifically is that it is a powerful tool that, while it can be adopted as part of a carefully considered tech stack, lends itself most naturally towards being a blunt force instrument used by these kinds of developers.

    My main criticism of Firestore is that it offers a powerful feature set that is both extremely attractive to amateur or constrained developers while simultaneously doing a poor job of guiding said amateurs towards creating a secure and well designed backend. In particular, the seemingly expected use case of the technology as something directly interfaced with by apps and other clients, as evidenced by the substantial support and feature set for this use case, is the main issue. This no-code no-management client driven interaction model makes it especially attractive to these developers.

    This lack of indirection through an API Gateway or service, however, imposes additional design considerations largely delegated to the security rules which can easily be missed by a beginner. For example:

    1. Many examples of amateurs take an open-by-default approach, only applying access and write restrictions where necessary and miss data that should be restricted
    2. Some amateurs deploy databases with no access or write restrictions at all
    3. There is no way to only allow a “view” of a document to a request, instead a separate document and security rules containing the private fields needs to be created. This can be fairly simple to design around but seems to be a bit of a “gotcha”, plus if you have similar but non identical sets of data that needs to be accessible by different groups it must be duplicated and manually synchronized.
    4. Since there is no way to version data models, incompatible changes require complicated workarounds or an increasingly complicated deserialization process on the client side (especially as existing clients continue to write outdated models).
    5. Schema validation of data written by clients to the database is handled by security rules, which is seemingly unintuitive or missed by many developers because I’ve seen plenty of projects miss it
    6. If clients are writing data directly, it can become fairly complex to handle and subsequently maintain their contributions, especially if the aforementioned private data documents are required or the data model changes.

    All of these pitfalls can be worked around (although I would still argue for some layer of indirection at least for writes), but at this point I’ve been contracted to 2 or 3 projects worked on by “professionals” (derogatory) that failed to account for any of these issues and I absolutely sick to death of it. I think a measure of a tools quality is whether it guides a developer towards good practices by design and I have found Firestore to completely fail in that regard. I think it can be used well, and it is perfectly appropriate for small inconsequential (as in data leaks would be inconsequential) single developer projects, but it almost never is.


  • I absolutely despise Firebase Firestore (the database technology that was “hacked”). It’s like a clarion call for amateur developers, especially low rate/skill contractors who clearly picked it not as part of a considered tech stack, but merely as the simplest and most lax hammer out there. Clearly even DynamoDB with an API gateway is too scary for some professionals. It almost always interfaces directly with clients/the internet without sufficient security rules preventing access to private information (or entire database deletion), and no real forethought as to ongoing maintenance and technical debt.

    A Firestore database facing the client directly on any serious project is a code smell in my opinion.













  • Welcome to the party! You have a lot of choices ahead of you, and the best part is that you get to make them. I don’t know where you live, but if it’s a large, reasonably progressive city, there is a good chance there will be some kind of local transgender advocacy and education organisation. They’ll be able to provide support and recommend trans-positive therapists, doctors, etc in your local area, and you should absolutely talk to them. On the odd chance you live in Canberra, shoot me a DM and I can give you recommendations directly!

    If you want to medically transition, you want to look into Spironolactone (which blocks testosterone) and Estradiol (girl juice). Medical transition is popular, and I personally love how it has changed my body, but it isn’t required. You aren’t more or less of a girl because of it. There are also options like Laser to remove unwanted body hair or, on the longer term, as well as various gender affirming surgeries. Socially, you don’t owe anyone a coming out. Do it on your own terms and at your own speed. Just be mindful that it can get pretty exhausting to live two lives.

    Early in transition was pretty scary for me. I am not a very confident person, and transitioning requires bucket loads of it, even more so when you’re a new to the whole thing. It gets easier though, especially as you build up a community around yourself and your transition helps you feel more comfortable socially. Nowadays I’m happier than I have ever been! I went from a boy who had suffered from severe depression, anxiety, and social disconnection his whole life, to a woman who loves herself and looks forward to the future. That’s my favourite part of it to me. I have so much agency over my future, and I am happy in a way I never thought possible. And I have great tits!