[ForTheKidz]

Wait, firebase allows full access to http connections accessible from a browser? Wtf? Why would you want to give the user direct access to a database to begin with? Is firebase built around the idea of not running your own servers or something?

[sunbum]

Firebase is not a db, its an entire platform as a service. So you don't really create much a backend, it handles it all for you.

[johnecheck]

Pretty much. Google manages everything. It handles Auth, which ties into the rules for accessing Firestore (the db), and you've got Functions for any code that needs to run server-side.

All with libraries in a lot of languages to make it easy. Pretty solid product with a cohesive experience and a generous free tier.

Naturally, you'll pay an exorbitant amount once you start to scale and realize you've been locked in.

[ForTheKidz]

Huh! I just spent an hour diving in and I see now.

Crazy giving up that much control of your product to a third party. I can definitely see the appeal to spike realtime/chat projects, though—they really leaned into that api design well. Selling out to google was a mistake.

[koakuma-chan]

Aren't firebase apps notorious for having really stupid vulnerabilities?

[johnecheck]

Wouldn't surprise me, but this isn't really google's fault.

As a product with a ton of appeal to the least experienced developers, lots of mistakes happen.

My understanding is that (assuming you trust google) there's no reason you can't build a secure application on firebase.

[reportgunner]

Yeah you can't really run it on-site so you just debug in the open.