new | show | ask | jobs Github

traceroute66 13 hours ago

> The last thing a startup has time to do is stored functions

If they have time to write SQL queries, they have time to write stored functions.

Its really not that difficult and it certainly does not take a substantial amount of time.

▲

raverbashing 13 hours ago | parent [-]

They have the time to write SQL queries in their code

They don't have time to (or better, shouldn't) materialize them as a stored function in the DB

"Oh but your CI/CD should automatically..." Let me stop right there

The time they spend with this can be better used to ship and to improve their SW to customers, not with yak shaving

▲

traceroute66 13 hours ago | parent [-]

> They don't have time to ...

Which is why they end up spending time on mea-culpa "we take your data security seriously, but clearly not seriously enough" emails when they inevitably get pwned by a completely predictable and avoidable SQL injection attack.

The sort of startups you describe are jokes that barley take security seriously, let alone know what a pen-test or code audit is, let alone actually do them on a regular basis.

	▲	euiq 12 hours ago \| parent \| next [-]
		You can do safe parametrization with PREPARE, you don't need CREATE FUNCTION. Don't most PostgreSQL libraries handle such concerns for you, anyway?
	▲	raverbashing 12 hours ago \| parent \| prev [-]
		You don't need a stored procedure to use parameters with the query lol