Post

Peter Thiel has ruined counting for me

😂 sorry

First off - congrats. But whenever I looked at zero, I am puzzled by the security story: What gets synced to the browser? (not all in the db should be shared to the client) And how is the local data secured? (because a userId isn't really a security boundary in IndexDB)

This is a great question. Real-world permissions was a core motivation for Zero. The short answer is Zero security works just like traditional web app security. Reads flow through your server, and your server controls the queries that sync. See zero.rocicorp.dev/docs/auth#pe...

But you need strong column based security - not just row based. And that still does not cover some other scenarios as this means raw data instead of rendered data makes it to the client.

This does not mean that Zero is perfect or done. There is still so much to do. What it does mean is that we fully support Zero for appropriate workloads without caveat. See zero.rocicorp.dev/docs/when-to... for guidance on applications that are a good match for Zero.

Concurrent with this release we have also begun offering an SLA to the Pro and Managed levels of our hosted service. See zero.rocicorp.dev#pricing for information.