This is a great point. I did bring up the relationship exercise in the post, but admittedly I didn't give it enough respect.
In college, my database teacher told us to design a database with at least 50 tables and 100 relationships by the end of the lecture. "It will be easier than you think", he said. And it was! And I thank him for that, because that lecture alone probably got me through more progress in product design discussions than anything else.
Something I'm really good at is ending my articles with half-baked ideas :) so thank you for challenging it
Regarding "entities", totally understand. I like to write in ways that my mom would understand- not the HN community. In fact, I have a post called "Everything is a Spreadsheet", where I explicitly defined that Entity<->Noun relationship. Should have linked it!
Back to the Saaspocalypse... my startup is reckoning with this like all others. My next blog post will be titled "What's Preventing Me from Building Your App in a Weekend?". The ultimate "what's your moat" question. I think every SaaS should be forced to answer this on their marketing site. Thinking aloud, I'm considering good answers companies can say to this question... I think a perfectly legitimate answer is still "our prompts are better than your prompts". There are some companies where I simply believe the founders/engineers when they say they understand the problem better than I, because they've explored it more deeply. This is kinda what I was hinting at at the end... softwares that go mega-vertical in one or two nouns accrue more subject matter expertise than I ever will. Thus, that gives me more reason to trust their infrastructure, their configurations, and their prompts. This is not new but rather an extension of what created the SaaS economy in the first place.
I will definitely check out your profile- thank you for the thoughtful reply!
I used to write 5 things to be happy about on a whiteboard outside my dorm room every day. I wanted to get back into it! So I built a site purely for that purpose.
The coolest part is the "Bonus". Anyone online can contribute to the Bonus Thing. What's there at midnight will be saved permanently (unless I think it's inappropriate).
I built this with Vercel, Convex, Vite, and Blocknote.
We do have a single-tenant DB. That’s one of my architecture challenges- how to handle permissions and clean up the schema a bit to entities that only my users need.
Possibly achieve that with some views or w/e the equivalent is in your database, and database accounts that can only access those views.
Another option might be to let them ingest their data directly into the existing BI tools they use where they can do whatever they want, cool thing about that is it can entrench you into their infrastructure and it offloads a lot of this complexity you're dealing with.
Okay- just spent the whole day tinkering wit this:
1) I create a baseline set of views I want my customers to have
2) For each new customer, I’ll run a script that create a replica of those views- filtered by their customer ID
3) I’ll allow my customers to write pure SQL- limiting them to only SELECT queries and a couple niche business rules, as well as masking any DB-level errors, because that just feels wrong
I think the main thing you're missing is creating an account in the DB that only has access to those views, so for each customer you'd do something like:
CREATE USER customer_xyz WITH PASSWORD 'foo';
CREATE VIEW customer_xyz_data AS SELECT * FROM data_stuff WHERE customer_id=x;
GRANT SELECT ON customer_xyz_data TO customer_xyz;
So then two things are happening, SELECT-only is being enforced by the view itself no matter what, and their account is categorically unable to touch anything outside of that view too, so as long as you run their queries through that account it will always be sandboxed.
You can enforce all of that yourself but ultimately if they're using an account that can read/write other tables you will always have to be careful to make sure you are sanitizing their input not just to selecting but like, limiting joins and nested queries too.
Gotcha. Yeah- I was thinking of working with my engineers to figure out a permissions layer, but I understand enforcing that at the DB-level would guarantee security.
Dumb question- is creating a set of Views for each customer even efficient for my MySQL database? I could realistically see us having ~12 customer-facing views- is having 12*N views a smart and scalable way to architect this?
A view is just a query that pretends to be a table, so it will come down to the complexity of that query. Each time you're querying the view it will be running the combination of the user's query against the view's query so the performance comes down to whether your DB is optimized around basically "SELECT field1, field2, field3 FROM (SELECT * FROM data_stuff WHERE customer_id=x)". Whether you execute that query as a view or as ad-hoc SQL doesn't make a difference itself.
"Your side" of this can be optimized easily enough, but the user-submitted queries are likely to be inefficient or miss indexes, which is why one database per customer can be better since they each have their own resources.
You can create the views and accounts as needed and destroy them when sessions end rather than keeping them permanently too, so when the user signs in you create the view and account, after the session or some period of inactivity you remove them.
Makes sense. The fact that my SQL Editor puts tables and views in the same section on its left sidebar was the main reason I did a double-take.
The idea of deleting and recreating views is an interesting one. I see that as a really cool approach- considering we can go without it as a v1 then include it as we scale.
Thank you for all your advice so far! This has been truly helpful.
Finding a co-founder, plus making those first few hires, is easily the most challenging part. You're going to realize you can't solve every problem, and you'll need help. Finding your team is like finding a life partner- a great one that complements your strengths and weaknesses could set you up for life. The wrong one will result in mismatched effort, finger-pointing, and time spent away from the customer.
It's one thing to ask a user to give you $20/mo. It's another thing to ask another human to wake up with you every day and spend their prime working on your vision in opportunity cost of working on something else. It's going to be the most important sell of your life!
Given two Goodreads accounts, BookBlend uses a combination of web scraping, data analysis, and LLMs to calculate a blend score from 0-100. It shows you shared books, authors, and genres, as well as recommends books for the two to read together!
It's 100% free, and the source code is available on the "info" modal in the top right.
reply