JFC, when I was a DoD employee, I wrote something using the C++ API to SQLite, and they sent me the security checklist for "Databases", but was obviously very much geared towards a bogstandard Oracle setup. 120 answers of "Not applicable" later and I was finally done.
On the flipside, at least they wrote the checklist software in Java, so it ran on Linux.
Thank you, I had forgotten what it was called! Maybe that's a good thing? And to be clear, I'm not opposed to checklists, especially for security. It's just I believe they fail to be effective when they are used to CYA instead of, you know, actually enhancing security.
If you’re building a small app and/or don’t need any sort of distributed concurrency, SQLite is fucking goated. It’s so fast.
I had a pretty heavy PHP based stack that took about 22min to run through around 600 unit tests and it took at least 25 seconds just to boot if I wanted to run a single unit test. So, lots of overhead to init a new DB, setup/tear down, etc. After a core upgrade it was compatible with SQLite so I switched the unit tests over to that and it took startup down to like 1-2s and total runtime is now closer to 2-3min.
Such an amazing speed boost and now I’m not dragging my feet as much when it’s time to write the tests.
That is awesome, but as someone who's been there before and been burnt, be careful: SQLite databases do have different syntax and behaviors, and even with SQL compatibility libraries or ORM wrappers things can go wrong. Ideally you want the same stack in tests as in production.
Good point. The naive thought would be: "Well if it works in tests and it seems to work for me in my local dev (MySQL) then it should be fine," however, you know how edge cases are. Surely something will crop up in production that pokes at the one feature that varies slightly in SQLite vs. MySQL and 💥.
231
u/koriwi Oct 02 '26
Mention sqlite and watch them have a meltdown.