Hacker News new | ask | show | jobs
by JustUhThought 3592 days ago
That is correct. It is among the super-biggest-huge no-nos to give end users direct access to a d.b. in any form like this.

Even if this has zero bugs and so will never need to change and there are zero security issues and it is sufficiently usable for the end users purposes, just you wait until you need to change the db schema and some user created a report for the ceo based o this and never told anyone about it and now the report is broke and the ceo and cfo are breathing down your neck to "fix it now" because they have a meeti g and need these number (which, now that you are looking at these numbers, they don't even match the numbers in hour db because they derived some of the metrics themselves from raw data rather than using the metric fields from the db, but they did it wrong, so even if you "fix it" you have to break the news that it's still broken and shouldn't be used for their meeting...)

So, correct, this should not be a thing for end users in many cases.