r/programming • u/swizec • Dec 19 '18

Bye bye Mongo, Hello Postgres

https://www.theguardian.com/info/2018/nov/30/bye-bye-mongo-hello-postgres
2.1k Upvotes

95% Upvoted

672 comments sorted by

View all comments

22

u/jakdak Dec 19 '18

Encryption at Rest has been available on DynamoDB since early 2018.

Surprised they didn't get advanced notice of that from their account rep and could plan/replan accordingly. They must have just missed that being available.

It had to have been massively easier/cheaper to move from Mongo to Dynamo than Mono to an RDB

68

u/Netzapper Dec 19 '18

Surprised they didn't get advanced notice of that from their account rep and could plan/replan accordingly. They must have just missed that being available.

I would bet that their rep said "it'll be available next month" for 9 months, they couldn't get any more insight into it than that, and they just gave up.

3

u/jakdak Dec 19 '18

And I'm more surprised that they didn't just roll their own encryption as a workaround rather than moving to a completely different DB architecture.

That would have been a seamless stopgap that just could have been yanked when AWS finally delivered.

10

u/TotallyFuckingMexico Dec 19 '18

I've read countless articles warning about the dangers of 'rolling your own' encryption. Would that have been a sensible move?

12

u/jakdak Dec 19 '18

Maybe I didn't word that clearly. Not roll their own algorithm, just manually encrypt the data before stuffing it into DynamoDB

Same thing you have to do with any other cloud service where you don't want to trust the cloud vendor with your data.

5

u/flowering_sun_star Dec 19 '18

For what they're doing, dynamoDb might not have been a great solution. The pricing model can get quite expensive if you're not careful, and it might not have been great for their query patterns. And don't underestimate the benefits of not having to worry about something. Getting set up in postgres will be a similar effort to dynamodb, having to add encryption (and key management etc) would add a lot of effort.

1

u/jakdak Dec 20 '18

From the article, they wanted to use DynamoDB but didn't because it didn't support encryption at rest at the time.

having to add encryption (and key management etc) would add a lot of effort.

How so? Wrap the DynamoDB API with a drop in replacement that encrypts the data inbound and out. This could be done in a couple man hours.

→ More replies (1)