Hacker News new | past | comments | ask | show | jobs | submit login

> This article is trying too hard to dress the author's limited experience up as absolute truth.

Sure you're not doing the same thing? As Vivekseth writes below, the author wrote psycopg2.

--- Allowing the DB user that the web app uses to have schema modification privileges is a massive security hole. If you're not hacked, someone will eventually drop the production database.

So, migrations in anything but SQL are a Bad Idea.




But... you don't have to use the same user for migrations as you do for your webapp. Like, at all.

`manage.py migrate --settings=my_super_secure_settings.py`

Just only run this from a super-secure location during a deployment with a completely different set of credentials.


Yes, you’ll notice that I’m not saying his ideas have no place but that they’re not universally applicable. For example, the security “hole” is trivially avoidable by using a different settings file to do migrations on a separate server/container which doesn’t get normal web traffic.

If you want SQL, you can also generate it from your migrations and send it over to someone else to run. This is not uncommon in enterprise IT.


To reiterate the point of the GP, you said:

> This article is trying too hard to dress the author's limited experience

Saying the author has “limited experience” is condescending and untruthful given his career and accomplishments so far.


Limited does not mean he hasn’t accomplished anything, only that he’s not speaking for the entire community and wording his post that way doesn’t add anything to it.

He’s obviously very proficient, which is going to shape your perspective of what’s easy and how much control you want just like the scale of the projects you work on and the number and skill levels of your team.

There’s nothing wrong with his opinion - my objection is the overly broad framing. It would have been just as good as “here are some things which worked for us” and letting the reader decide whether they are in the same situation.


> Allowing the DB user that the web app uses to have schema modification privileges is a massive security hole

> So, migrations in anything but SQL are a Bad Idea.

Those two points have nothing to do with each other.


Or just the all orm thing.. why I can't use a using(field) when I need to query a Django dB? How many applications are poor modeled because the orm?




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: