undefined | Better HN

0 pointsCableNinja2y ago0 comments

Going open source will not solve your problems. The issue is that youre asking customers to open database access to you/your company. The reason why the method youve chosen isnt already out there is because of all the implications it has.

You better have one hell of a security team to ensure youre locked down tighter than a ducks ass. Look at how many data breaches there have been, even in the past year.

The solution is to either make an SDK or API as already suggested by others, and giving customers endpoints to manage their lists.

0 comments

5 comments · 2 top-level

kashnote2y ago· 3 in thread

Definitely taking all the security measures I can, but you're right, things can go wrong. I do encourage (and would like to enforce) that db credentials provided should have very limited read access to only the tables/columns that the user wants to query.

Having said that, it's totally understandable that some orgs won't want do open up their db. The idea with going open source would be that they can host the platform in their VPC so that their data is never leaving the premises.

Not against having an SDK or API at all, but I would need to think about would work because the whole syncing issue is one that I'm focused on addressing here.

CableNinjaOP2y ago

You dont need to go open source to allow self hosting, and, youll likely lose money that way. Its entirely possible to allow self hosting without being open source. Plenty of other projects do it.

That being said, self hosting doesnt solve all issues.

You, and whoever uses this product, will need MANY IPs because of blacklisting and throttling limits applied almost worldwide to all mail servers. Theres a reason why the marketing spam hosts have their own /24 or /25 and have 80% of them cycling through usage as a mail sender.

Im not knocking your want to have something better than MailChimp and the like, but i feel like you didnt really dig into the real underlying tech and security before you went to work on this.

tln2y ago

You realize that the sending is done by Amazon SES right?

1 more reply

Exuma2y ago

I'm not a security expert, but at the very least if I were you make your docs very good for people who dont want to wade through 1000 different documentation to find how to very simply create a read-only user with access to specific table + columns. Or better yet even, how to create a read only view with ONLY the email/name and not any other PII, and then give access to that.

samstave2y ago

A self hosted AMI/container - with a config UX. Simple solve.

j / k navigate · click thread line to collapse