(we maintain OrioleDB) Mostly because the TAM API isn't mature enough yet. Hopefully we can upstream more patches so that it's possible

> undo-based MVCC storage engine project stall?

From what I could gather, it ran out of steam simply because of the difficulty of the task. There is a lot of work involved to get the requisite patches into core and the community are (correctly) cautious

Comments URL: https://news.ycombinator.com/item?id=46910466

Points: 9

# Comments: 7

I’m sure there could be questions, given the brevity of this blog post. I’m happy to answer anything specific

I’ve been chatting to Dennis for a long time now and our product-ideas were very aligned. We will share more about this project in a few ShowHN’s over the coming months

> The danger is when apps expose the service_role key (or the new sb_secret_... format)

Fwiw, the new secret keys are automatically revoked if they are pushed to github, and github is progressively rolling out push protection - to prevent them getting pushed in the first place. Of course, not everyone uses github

People disabling RLS, or making RLS a simple pass-through, is a battle we are constantly fighting. We have made good strides here over the past 12 months:

https://supabase.com/blog/supabase-security-2025-retro

- event triggers to enforce RLS on all tables

- lints to scan for insecure rules

- ai to write secure policies (if they are too lazy or confused to do it themselves)

- big red labels when a table is exposed

- weekly emails with security alerts

- dashboard alerts and security advisors

- contractually requiring Vibe coding platforms to expose our Security Advisors if they are integrating with us

- red teaming customers that have egregious issues (this has been surprisingly effective, just harder to scale up)

I appreciate you creating this tool - as you can see we are also “tooling up” as much as we can. If there are any other things that you think we are missing let me know and we will prioritize it

We will be introducing new AuthZ patterns this year so I’m hoping that will also help

Our CH wrapper is actively maintained, with push down, parameterized views, and async streaming: https://supabase.github.io/wrappers/catalog/clickhouse/

We see a lot of companies choosing CH with PG - it’s fantastic

The goals:

- Generic: Works with any Iceberg REST Catalog implementation, not tied to any specific vendor

- Minimal: Thin HTTP wrapper over the official REST API, no engine-specific logic

- Type-safe: First-class TypeScript support with strongly-typed request/response models

- Fetch-based: Uses native fetch API with support for custom implementations

- Universal: Targets Node 20+ and modern browsers (ES2020)

- Catalog-only: Focused on catalog operations at this stage

Although Iceberg is becoming very popular, we were surprised that the developer tooling is so nascent. This library is our contribution back to the ecosystem. The goal is to keep it minimal and well-maintained, so that developers can manage their warehouse from any JS server.

We are using it with AWS's new "S3 Tables". If it doesn't support other REST catalogs we'd welcome contributions

Comments URL: https://news.ycombinator.com/item?id=46203840

Points: 5

# Comments: 0

https://github.com/supabase/wrappers

It is compatible with the Iceberg REST catalog and S3 Tables (AWS S3's latest offering). Currently it supports SELECT and INSERT operations.

You can map an entire Iceberg namespace into your Postgres database like this:

    import foreign schema "warehouse"
    from server iceberg_server 
    into "my_iceberg_warehouse";

    select * from warehouse.my_table where id = 42;

    create foreign table new_table (
      id bigint,
      name text
    )
    server iceberg_server
    options (
      table 'warehouse.new_table',
      rowid_column 'id',
      create_table_if_not_exists 'true'
    );

Comments URL: https://news.ycombinator.com/item?id=46057877

Points: 1

# Comments: 1

feel free to reach out to me on twitter (same username) to discuss this if you want. we are starting to think of realtime in the context of gaming so if you have feedback it would help us shape the pricing

Comments URL: https://news.ycombinator.com/item?id=45876667

Points: 2

# Comments: 0

we are working on a challenge which is somewhat like a homomorphic encryption problem - I'm wondering if OpenPCC could help in some way? :

When developing websites/apps, developers generally use logs to debug production issues. However with wearables, logs can be privacy issue: imagine some AR glasses logging visual data (like someone's face). Would OpenPCC help to extract/clean/anonymize this sort of data for developers to help with their debugging?

> Raft improved accessibility but remains a monolithic algorithm that's risky to modify. This has effectively limited our flexibility in adapting consensus systems to modern cloud architectures.

The series begins here: https://multigres.com/blog/generalized-consensus

Comments URL: https://news.ycombinator.com/item?id=45802276

Points: 4

# Comments: 1

  1. someone created an website using supabase with email logins (and possibly edited the template / opt-out link)
  2. someone signed you up to that service - you received an email from that app 
  3. you sent us an email (to support@supabase.io or similar) to report abuse
  4. we emailed a few months later with the generic email you posted

I'm be the first to acknowledge that this is something we want to improve. Unfortunately that will take time and iterations - you are experiencing our support (i hope) at it's worst. We sent an email to the backlog of unanswered free-plan emails just to acknowledge and redirect them somewhere we can offer more support

For security/fraud, we have a slightly different process: https://supabase.com/.well-known/security.txt

This process is to ensure that we _don't_ miss emails, like we did with yours.

You post here is helpful for us to figure out the areas that we need to improve. Again, I'm sorry that we didn't give you a good impression the first time - all we can do is iterate based on feedback like yours. If you want to share more my email is in my profile

> your current AWS situation

I think the assessment here is accurate:

https://x.com/theo/status/1979271205279666586

> Looked into this a bit. I don’t think “downtime” is a fair way to report on this. No existing databases are affected. Amazon is literally out of boxes in eu-west-2, so Supabase can’t provision NEW DBs in that one specific region

I want to own the fact that we can be multi-cloud, and that we can work with AWS on their capacity planning (note: this is not a typical request for an increase on a soft limit). We are working through both of these options. That said, the Reddit poster classifying this as days of downtime is not entirely fair, and it makes it harder to for us to over communicate with our community. Throughout this period we had days where there was free of capacity on AWS and we chose to leave the status up until we have finalized our conversations with AWS.

I also want to acknowledge that there is a broader AWS issue today in us-east-1 which affects us (and most other companies today) that is unrelated

https://news.ycombinator.com/item?id=45640838

> our technological choices are quite different; everything we use is open source; and wherever possible, we use and support existing tools rather than developing from scratch.

I understand that people get frustrated when there is any commercial interest associated to open source. But someone needs to fund open source efforts and we’re doing our best here. Some (perhaps non-obvious) examples

* we employ the maintainers of PostgREST, contributing directly to the project - not some private fork

* we employ maintainers of Postgres, contributing patches directly

* we have purchased and open sourced private companies, like OrioleDB, open sourced the code and made the patents freely available to everyone

* we picked up unmaintained tools and maintained them at our own cost, like the Auth server, which we upstreamed until the previous owner/company stopped accepting contributions

* we worked with open source tools/standards like TUS to contribute missing functionality like Postgres support and advisory locks

* we have sponsored adjacent open source initiatives like adding types to Elixir

* we have given equity to framework creators, which I’m certain will be the largest donation that these creators have (and will) ever receive for their open source work

* and yes, we employ the maintainers of Vitess to create a similar offering for the Postgres ecosystem under the same Apache2 license

https://news.ycombinator.com/item?id=45196771