Dan Draper

Today we're launching the CipherStash + Supabase integration. Developers can now build privacy-first PostgreSQL applications without giving up the features they expect. What you get: * Search encrypted data (equality, range, ordering & full-text) * Encrypt sensitive fields before they ever reach Postgres * Keep keys under your control with ZeroKMS * Add data-level access control tied to identity * Works natively with Supabase and TypeScript This is about making strong security the default—not something that slows developers down. Learn more: cipherstash.com/supabase Docs: cipherstash.com/docs/integrati… Thanks to the @supabase team for partnering with us. Looking forward to seeing what everyone builds next.

This is the one I've been waiting to share. Searchable encryption on @supabase is live! Encrypt your columns and keep querying them. WHERE, LIKE, ORDER BY, JOIN, GROUP BY, even JSON. Basically, zero code change and < 10ms overhead for most queries.

I pointed Claude Fable at a major update of one of our crypto libs over night. It more than quadrupled encrypt performance and found an obscure encrypt-side timing security flaw that exists in our scheme as well as all of the current published ORE schemes in the literature. Mind blown. ...and now Fable has been disabled.

I love this! Great move from the @prisma team

Doors five and six: backups (a complete copy of your database with none of its access controls) and unapplied patches (a door you know is open, and so does everyone else). Work through the doors in order. The attacker will. Runnable commands for all six: dev.to/cipherstash/se…

The fix: encrypt in the application, so Postgres never holds plaintext or key material. The catch was always search. WHERE email = ? dies on random ciphertext. Encrypted indexes solve it: the planner uses them like any other index. A pg_dump shows ciphertext. Nothing else.

Most Postgres hardening guides are checklists in no particular order. Attackers don't probe in no particular order. Here's how to secure a Postgres database in the sequence an attacker would actually work through it 🧵

Field-level encryption in JavaScript without shooting yourself in the foot 👀 cipherstash.com/blog/orm-field…

I've been a big Prisma fan for years. Prisma Next looks like a genuine step up. And to have @cipherstash directly integrated is *Next* level.

In the long run I think software gets more secure out of necessity, but the in between is a scary time period where everyone is just CONSTANTLY getting hacked

I tried to make sense of the backdoor mechanism this time and summarized it in a one-page overview. 😵‍💫 There's obviously more technical detail to uncover, but you'll get a general understanding of the complexity and the stealthy mechanisms used to remain undetected. 🧐 Thanks to @AndresFreundTec for his insight into this and a shoutout to these researchers if you want to learn more about the backdoor 🙏👇 - gist.github.com/smx-smx/a6112d… by SMX - bsky.app/profile/filipp… by @FiloSottile - github.com/amlweems/xzbot by @amlweems - github.com/karcherm/xz-ma… by Karchem - research.swtch.com/xz-script by Russ Cox - github.com/0xlane/xz-cve-… by 0xlane And of course, all the others previously mentioned and those who contributed to the analysis. #xz #infosec

@rayn_ong Patent if the strategy is to be acquired for a big sum. Plenty have done it but revenue preferred in almost all cases!

Founders, what would you choose? - Startup Events vs Customer Calls. - Patent vs Unstoppable Sales Motion. - Awards vs Revenue. - NDA vs Trust Rayn because he’s good 😜.

@madzadev Safe memory management in C

Give this book a coding-related title 👇👇

In the wake of FTX, SVB, Medibank and Optus data hacks, how do we move forward? Join @RaajRayat (Investment Manager, AirTree) as he discusses best practice for treasury management and cyber security with a panel of experts from the AirTree family 🌳 🎟️: intersektfestival.com/registration/

@phoozle If I was Microsoft I’d have just made a special edition of Postgres with hooks into AD. Still could have charged a bunch for support and add ons. 🤷

@danieldraper Microsoft’s $10b investment didn’t get em much…

Trying to do some tricky stuff in SQL server so I asked ChatGPT. It recommended that I use PostgreSQL. Can't say I disagree!