Hacker News Reader

I don't really see how people are supposed to connect to databases without SSH tunnel support. Are you supposed to be connecting to your development localhost database or be inside corporate network where direct connection to the database is allowed?

View on HN

Most people use a VPN of some sort when connecting to remote databases

Our DB servers don’t have any ports listening on the internet, not even SSH.

TLS can be enforced for DB connections (both pg and mssql support this), but that’s still prone to credential stuffing and the client machine isn’t usually authenticated. Lots of regulations generally require some extra security layer protecting connections to the DB.

My assumption is that they were building for MSSQL Server first, where AD/Windows Authentication is still the most popular authentication scheme.

Reply on news.ycombinator.com