工具与资源github.com
PostgREST：为任意 PostgreSQL 数据库自动生成 REST API
PostgREST: REST API for any Postgres database
2020 — 2024，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
PostgREST 是一个把任意 PostgreSQL 数据库直接暴露为 RESTful API 的开源工具：它根据数据库的表、视图和函数自动生成接口，并把权限与业务逻辑交给 PostgreSQL 自身的行级安全（RLS）和函数来实现。项目在 Hacker News 上多次被讨论，Supabase 等平台也基于它构建后端服务。
为什么经久不衰：它用数据库原生能力替代大量重复的 API 样板代码，思路简单却经得起时间检验，今天仍是快速搭建数据接口的经典方案。
HN 评论精选
Supabase 全线依赖 PostgREST，并全职资助其维护者，生态和功能持续发展。
Supabase 上的每个项目都使用 PostgREST。它是个了不起的工具，尤其和行级安全（Row Level Security）结合时。我们为 JavaScript、Rust、Python、Dart 等语言构建了客户端库，这要感谢社区维护者。Supabase 雇佣了 PostgREST 的维护者 Steve，他全职投入这个项目，接下来还有更好的 JSONB 和 PostGIS 支持。（注：我是 Supabase 联合创始人）
kiwicopple查看英文原文
Every project on https://supabase.io uses PostgREST. It's an amazing tool, especially when combined with Row Level Security. We have built client libraries for Javascript, Rust, Python, Dart, and a few more on the way thanks to all the community maintainers. Supabase employs the PostgREST maintainer (Steve), who is an amazing guy. He works full-time on PostgREST, and there are a few cool things coming including better JSONB and PostGIS support. We recently benchmarked PostgREST for those interested: https://github.com/supabase/benchmarks/issues/2 nb: i'm a supabase cofounder
这类工具能省去胶水代码，但数据库内逻辑的版本控制和测试仍是痛点。
我用 Postgraphile（类似项目，但面向 GraphQL）好几个月了。这种构建系统方式的好处是不用花时间写胶水代码，只专注真正的业务逻辑。但维护数据库代码很痛苦，比如函数的版本控制：没有合适的 linter，测试也不能针对 PostgreSQL 函数做，只能在 GraphQL 层测试。用这类工具能省下几个月开发时间，不过我也同意有些系统不适合这样实现。
ErunamoJAZZ查看英文原文
I have been using Postgraphile (similar to this one but for GraphQL) for many months. The great thing about this way to create systems is that you don't expend time doing glue code, just in the real business logic. But a big pain is to maintain your database code, by example the version control of your functions. There are not suitable linters, and testing can't be done over postgres functions but must be done over GraphQL instead. Using things like this will save you months of development time!, Even if I agree there are some systems that will not be good idea to implement in this way.
PostgREST 配合数据库原生逻辑能显著提速，且兼容 OpenAPI 便于生成客户端和文档。
PostgREST 很棒，确实减少了构建 REST API 的样板代码。它建议用 PostgreSQL 原生特性（行级安全、函数等）实现访问规则和额外业务逻辑，一旦理解了这个思路，开发速度会快很多。我们 Splitgraph 内部运行了一个 PostgREST 分支，为平台上的每个数据集生成只读 API，而且兼容 OpenAPI，可以直接获得代码和 UI 生成器。
mildbyte查看英文原文
PostgREST is great and really reduces the boilerplate around building REST APIs. They recommend implementing access rules and extra business logic using PostgreSQL-native features (row level security, functions etc) but once you get your head around that, it really speeds things up! If you're interested in playing around with a PostgREST-backed API, we run a fork of PostgREST internally at Splitgraph to generate read-only APIs for every dataset on the platform. It's OpenAPI-compatible too, so you get code and UI generators out of the box (example [0]): $ curl -s "https://data.splitgraph.com/splitgraph/oxcovid19/latest/-/rest/epidemiology?and=countrycode.eq.GBR,adm_area_3.eq.Oxford)&limit=1&order=date.desc" [{"source":"GBR_PHE","date":"2020-11-20", "country":"United Kingdom", "countrycode":"GBR", "adm_area_1":"England", "adm_area_2":"Oxfordshire", "adm_area_3":"Oxford", "tested":null, "confirmed":3079, "recovered":null, "dead":41, "hospitalised":null, "hospitalised_icu":null, "quarantined":null, "gid":["GBR.1.69.2_1"]}] [0] https://www.splitgraph.com/splitgraph/oxcovid19/latest/-/api-schema
PostgREST 并非要取代一切，也不不安全；它统一了数据库层的权限，消除了大量 API 样板工作。
每次 HN 讨论 PostgREST 都会出现一些误解。有人以为要用它完全替换现有技术栈、把所有事情都塞进 SQL，这不对：你不会在 SQL 里发邮件，也不会在 HTTP 请求里跑几 GB 的 ETL。如果要触发外部处理，就把任务插入队列表，再像以前一样在带外消费队列。另一个误解是说 PostgREST “不安全”。反过来看，它其实最安全，因为它用 PostgreSQL 原生安全系统执行访问控制，而且这套控制不仅作用于 API，也作用于数据库的所有其他客户端，等于统一了安全。PostgREST 让你不必再花几个月把一小勺一小勺数据从表搬到前端——这些全是样板工作。
michelpp查看英文原文
There's always this confusion that comes up whenever PostgREST is discussed on HN, which is many times at this point. There is the misconception that arises that you use PostgREST to remove your existing stack entirely and you do everything in SQL. This is not true, you're not going to send emails from SQL or run entire multi-GB ETL reductions during an http request. If you want an API call to kick off some external processing, then insert that job into a queue table and do the same thing you always did before, consume the queue out of band and run whatever process you want. Another one that comes up is that somehow postgrest is "insecure". Of course, if you invert the problem, you see that postgrest is actually the most secure because it uses postgres' native security system to enforce access. That access is enforced onto your API, and you know what, it's enforced on every other client to your DB as well. That's a security unification right there. That's more secure. What PostgREST does is let you stop spending months of time shuttling little spoonfuls of data back and forth from your tables to your frontend. It's all boilerplate, install it in a day, get used to it, and move onto the all those other interesting, possibly-out-of-band, tasks that you can't get to because the API work is always such a boring lift.
历次讨论
同类还值得读
直接在浏览器中启动 Linux 内核
Boot a linux kernel right inside your browser.
Fabrice Bellard 的 JSLinux 页面，用 JavaScript 在浏览器里启动一个 Linux 内核，并提供一个可交互的终端环境。
工具与资源上首页 5 次 · 2011–2025bellard.orgHacker News 未公开功能与行为清单（2018）
A List of Hacker News's Undocumented Features and Behaviors (2018)
数据科学家 Max Woolf 整理的 Hacker News 未公开功能与行为清单，涵盖投票机制、排名算法、账号惩罚等社区运作细节。
工具与资源上首页 5 次 · 2019–2025github.comMapSCII：在终端中用盲文和 ASCII 渲染地图
MapSCII – Braille and ASCII map renderer for the console
MapSCII 是一个在命令行终端里渲染地图的开源工具，用盲文字符和 ASCII 字符把地理数据画成可交互浏览的字符地图。
工具与资源上首页 5 次 · 2017–2025github.com顶尖大学的免费在线课程
Free Online Courses from Top Universities
Open Culture 整理的一份免费在线课程合集，汇集了全球顶尖大学（如 MIT、斯坦福、耶鲁等）向公众开放的网络课程资源，涵盖音频、视频等多种形式。
工具与资源上首页 5 次 · 2010–2022openculture.com淘气字符串：容易引发用户输入问题的字符串清单
Naughty Strings: A list of strings likely to cause issues as user-input data
一个 GitHub 仓库，收录了大量容易让程序出问题的用户输入字符串，如特殊字符、emoji、SQL 注入片段、系统命令等，供开发者用于测试输入处理逻辑。
工具与资源上首页 4 次 · 2015–2020github.com