[MUSIC PLAYING]
RACHEL MYERS: I talked to your producer,
and this is going to be an interview with the sock puppet.
With me.
DOUG STEVENSON: Oh, OK.
Well, that's great.
Yeah.
RACHEL MYERS: If it's about me, I don't want to do this.
I want it to be about the sock puppet.
DOUG STEVENSON: Hello, Louise.
Welcome to the show.
RACHEL MYERS: Thank you.
DOUG STEVENSON: What do you want to talk about today?
RACHEL MYERS: I want to talk about Firebase rules.
I'm over here.
DOUG STEVENSON: OK.
Yeah, but I never--
RACHEL MYERS: Doug.
DOUG STEVENSON: I've never done something like this
before, so just--
RACHEL MYERS: Why is this so hard for you?
My eyes are over here, Doug.
DOUG STEVENSON: Sure, but I've never really talked
to a sock puppet before.
I don't know how to address--
RACHEL MYERS: It's just like talking to anybody else.
DOUG STEVENSON: Well, not exactly.
It's not a human face.
What I'm usually accustomed to.
RACHEL MYERS: What are you trying to say, Doug?
DOUG STEVENSON: Well, I'm saying this is--
I just want to make sure you're comfortable with this,
because this is my first time--
RACHEL MYERS: I'm very comfortable with this.
DOUG STEVENSON: OK, fine.
We'll do it this way.
RACHEL MYERS: It seems like you're not comfortable.
DOUG STEVENSON: No, I'm not terribly comfortable.
But I just want to make sure this goes smoothly.
RACHEL MYERS: I think that's not happening.
DOUG STEVENSON: OK.
Well, let me shift my attention to Louise.
RACHEL MYERS: Where's your producer?
I think I had a conversation.
We talked about this.
DOUG STEVENSON: Fine.
Whole show just like this.
Fine.
[MUSIC PLAYING]
Hey, everybody.
Welcome to #MeetFirebase, the show
where you get to meet the Googlers that
make Firebase happen.
My name is Doug Stevenson, and on the show with me
today is Rachel Myers.
[CLAPPING]
Rachel.
Thanks for being on the show.
RACHEL MYERS: I'm glad to be here.
DOUG STEVENSON: And welcome to the Firebasement.
RACHEL MYERS: It's very nice.
DOUG STEVENSON: What do you think of the place?
RACHEL MYERS: I like the decor.
DOUG STEVENSON: Yeah, yeah.
It's cutting edge, right?
RACHEL MYERS: Yeah.
It feels like it has a vibe.
DOUG STEVENSON: It does.
We had some advice about how to work things differently,
but I like it the way it is.
RACHEL MYERS: OK.
I think you should keep it.
DOUG STEVENSON: So Rachel, tell me,
what do you do with the Firebase team?
RACHEL MYERS: I work on security rules.
And then I have one foot that lives in cloud,
and I work on events and policy.
DOUG STEVENSON: OK.
So security roles meaning what exactly?
RACHEL MYERS: The configuration that you
can put into the backend product from Firebase
to configure who can access it.
DOUG STEVENSON: OK.
So that's real-time database Firestore.
RACHEL MYERS: Firestore and Storage.
DOUG STEVENSON: And Storage.
OK, yeah.
So they're very important.
I think it's kind of understated how important security
rules are, because of the way that Firebase
backend services work.
What are some of the things that you think every developer needs
to know about security rules?
RACHEL MYERS: Wow.
OK, here's the first thing.
If you have two security rules that both match a path,
those rules are ORed together, not ANDed together.
So if one grants access and the other denies access,
access is granted.
That's something that I think is--
we say it in the docs, but I think
if you're just using your rules, you might assume the other way.
You might assume that they're ANDed,
and all these things have to be true in order to access.
I think that's like the primary message to get out.
DOUG STEVENSON: OK.
So if you're looking at some rules that reject access,
you could very easily have some other rule somewhere else
that allow access unexpectedly.
RACHEL MYERS: That's exactly right.
Yeah.
DOUG STEVENSON: OK.
And so that could be a problem if you're trying
to lock down per user access.
RACHEL MYERS: You have to read all your rules.
DOUG STEVENSON: Yeah.
Yeah.
Is there anything we can do to help with that?
Because it seems like that could be something
that's very easy to trip up.
RACHEL MYERS: So we have a simulator
in both Firestore and real-time database.
And you can try a path, and it will show you
all the lines that match.
DOUG STEVENSON: OK, OK.
So if you have multiple rules that all match,
it will show you each and every one of them [INAUDIBLE]..
RACHEL MYERS: It will highlight all of them for you.
DOUG STEVENSON: OK, OK.
RACHEL MYERS: The caveat to that is, if it's at the very top,
then I think it short circuits it.
So that, we can improve.
DOUG STEVENSON: Mm.
Yeah, we can improve it.
RACHEL MYERS: I just talked myself into future [INAUDIBLE]..
DOUG STEVENSON: [CHUCKLES]
Right.
I'll log a bug for that after this.
We're looking out for developers.
We're going to fix all this.
And anything else about security rules
that you think people should know?
RACHEL MYERS: Oh gosh, there's a lot.
Let's see.
I think the most important thing is to not
think of it as an afterthought.
To think about security rules when
you're structuring your data.
To think about security rules as an essential part of your app.
DOUG STEVENSON: Mm-hm.
Mm-hm.
So this is something I fall into a lot,
is that when you create a new database,
you're asked now that it's been changed whether or not
you want to start in open mode, or in locked mode.
And it's really easy to just want to start in open mode.
Like I start all of my little side projects in open mode
because I don't want to mess with it at the beginning.
It feels like it slows things down.
But then I forget later.
So how can we help people remember
to go back into a locked mode where you're actually using
some form of authentication?
RACHEL MYERS: So we want to work on things
that will remind people.
But before those things are out, we just want to tell people,
before it goes out to users, it's
important to go back and lock them down.
I do the same thing.
When I create a new project, I start off in open mode
because I don't know what my data's going to look like.
It doesn't make sense to write rules
if I'm going to move my data around.
DOUG STEVENSON: You're just playing around.
RACHEL MYERS: Exactly.
DOUG STEVENSON: Iterating quickly.
RACHEL MYERS: Yeah.
So I start in open mode, but as soon
as I know what kind of shape my data's going to live in,
I immediately jump back in.
And as I'm designing how my data should look, I'm also thinking,
OK, I want this to be separate because I want it to have
separate access controls.
DOUG STEVENSON: Right, right.
So it sounds like what you're talking about
is some form of organization within your rules.
Because I know that sometimes-- and this gets asked a lot.
Say you have some user data, and you want some of it
to be public, and some of it to be private.
And you can't have within, say, Firestore, one document.
You can't protect some fields in a document to be public
and some to be private.
RACHEL MYERS: Right.
It's best to write rules at a document level.
So it might be--
yeah, you need to write rules at the document level.
So if you have two things that you
want that are like, say, a user profile, some of it's private,
some of it's public, two different documents,
have a public profile and a private profile.
DOUG STEVENSON: So you probably need two collections for that.
RACHEL MYERS: Yeah, I would do a subcollection.
DOUG STEVENSON: Yeah, or a subcollection.
RACHEL MYERS: I'd probably--
I don't know.
It depends what else you're doing,
but you could do a subcollection of private data.
DOUG STEVENSON: But there is some organization
that's required.
So you have to think through that.
RACHEL MYERS: Yeah.
Think about how you want to both pull your data back
to the user, and then also think about how
you want to protect it.
That's what I'd do.
DOUG STEVENSON: So speaking of organization
in a very general sense--
that's kind of a big deal for you
in your personal life, right?
RACHEL MYERS: Oh, my gosh.
I love to organize everything.
DOUG STEVENSON: OK.
Tell me about that.
RACHEL MYERS: My favorite stores are Muji and Container Store,
because--
DOUG STEVENSON: I've never heard of Muji.
What's that?
Sorry to interrupt, but I want to know what that is.
RACHEL MYERS: It's the store that has not very fancy things,
but very practical things.
It works really well for small spaces.
And I live in San Francisco, so I have a small space.
DOUG STEVENSON: Yeah, not a whole lot of space.
Yeah.
RACHEL MYERS: Exactly.
I don't live in a shoe box anymore.
I moved up.
So I have like a--
I don't know-- a medium sized box.
DOUG STEVENSON: A boot box?
RACHEL MYERS: Yeah, exactly.
I live in a boot box.
DOUG STEVENSON: You got to step up.
So what kind of tips do you have for people
to get their homes organized?
RACHEL MYERS: So I went [? full-on ?] on Marie Kondo,
and I got rid of everything that didn't bring me joy.
And it's really funny.
If you do that seriously, you end up
with such a weird set of stuff.
So I got rid of all of my jeans.
I had to go buy all new jeans, because apparently,
none of my jeans brought me joy.
But all of my socks brought me joy.
DOUG STEVENSON: OK.
That's good.
RACHEL MYERS: I didn't have a lamp after I did that.
I went out and bought a lamp that has--
it's a ceramic bulldog with a lamp shade on top of it,
which is absurd, but I'm so happy every time I
turn the light on.
Now I use my lamp every day, because I love to--
DOUG STEVENSON: OK.
So you have a--
it's practical, and it brings you joy.
RACHEL MYERS: It's practical in that it's a lamp.
It's not practical-- nothing else about it is practical.
It's absurd, and I love it.
DOUG STEVENSON: But it brings you joy, right?
So it fills two roles.
It's not just-- it's utilitarian and.
RACHEL MYERS: Happy-making.
DOUG STEVENSON: Yeah.
RACHEL MYERS: Yeah.
DOUG STEVENSON: That's important, right?
RACHEL MYERS: Yeah.
DOUG STEVENSON: So changing gears a little bit.
One of the things we do from time to time on the Firebase
team is hold something called a Hack Week,
where we split off into teams and work
on something of maybe personal interest,
or whatever you want to work on.
You enjoy that, right?
RACHEL MYERS: I love it.
DOUG STEVENSON: OK.
OK.
So tell me, what kind of things do you build for Hack Week?
RACHEL MYERS: So I work on security rules,
and I like to build things for Hack Week that make it easier
to use security rules.
So for the first Hack Week, I was at--
we made a-- it's a version history of all of the rules
that you've previously published.
It only shipped for Firestore.
We'd like to get it out to the other backend services soon,
but there are some reasons we can't do it.
So the reason I love this is because it was really common
for me to make a mistake in my rules, to not realize
that I had made a mistake, and to hit publish.
And then only after I realized a few days later
that I had this flaw in my rules, I tried to go back.
If I hadn't put it in version control, it was just lost.
DOUG STEVENSON: Right, right.
RACHEL MYERS: So we shipped a feature in one week
where we gave you a sideboard that
has all of the different versions of rules
that you've ever published.
You can go back to any of them.
You can highlight, and you can pull it back into--
you can compare it with whatever's current so--
DOUG STEVENSON: Oh, so you get a diff
to see exactly what changed.
RACHEL MYERS: Exactly.
The diff is a really nice feature.
That was a "nice to have" for me,
and I love it now that it's in.
DOUG STEVENSON: OK, yeah.
For those of us who, again, are just hacking around,
maybe we don't put our rules in source control.
It's like having source control built into the product.
RACHEL MYERS: Exactly.
DOUG STEVENSON: So you probably know
that I travel a lot for work.
And you travel a lot for work.
And we've traveled to some of the same places.
Is that something you always imagined yourself doing?
RACHEL MYERS: So when I was like 15,
there was a school-organized trip,
which was great for the parents that are like, oh, my god,
get rid of my teenager for the summer.
And I loved it.
So there were like 30 of the kids,
and I was by far the most into it.
I was like--
I wanted-- I was reading books on the ride over.
I was like, I want to know about this place.
So I've always enjoyed traveling.
I've enjoyed seeing new places, learning new things.
DOUG STEVENSON: OK.
So what do you enjoy outside of Firebase?
So I heard you like campy pop music.
Is that true?
RACHEL MYERS: Yes.
DOUG STEVENSON: OK.
What do you listen to?
RACHEL MYERS: Oh, gosh.
I listen to some really terrible thing.
So I still listen to Spice Girls for fun.
DOUG STEVENSON: So one last question.
What is your biggest ambition in life?
That's kind of a broad question.
RACHEL MYERS: To quote Beyonce, to be happy.
DOUG STEVENSON: [CHUCKLES]
Well, that's fair.
What makes you happy?
What's your pursuit that makes you happy?
RACHEL MYERS: Let's see.
My ambition in life.
I want to make cool things.
I want to do good work.
I want to--
I enjoy-- one of the reasons that Hack Week really
appeals to me is that I like making things happen.
And working in a large company like Google,
sometimes it can be really hard to push things forward
at a quicker pace.
So I love chances where there's a little bit,
or where the waves just part a little bit,
and you can just push things.
So before I joined Google, I started
a company called Opsolutely.
And it was really fun, because you could just do--
there was nothing in your way.
You could just try lots of things.
It was frustrating for other reasons.
Like, we have a lot more resources here,
so we have a lot of things we can try.
So getting to do things, and try things,
is really something that I find really motivating.
DOUG STEVENSON: Yeah, yeah.
I'm kind of a startup guy too.
In fact, I came from a startup.
That's how I landed at Google.
There's little bits of me that looks at things like Hack Week
and, ooh, I can do whatever I want.
I can use Google resources to play with something.
RACHEL MYERS: Exactly.
DOUG STEVENSON: So yeah, I dig that.
So speaking of Hack Week, you have a sock.
RACHEL MYERS: I do.
DOUG STEVENSON: Not just any sock.
RACHEL MYERS: So this is sock puppet.
Should I-- let me see.
Let's get his eyes on straight here.
Her eyes on straight.
Hi, Doug.
DOUG STEVENSON: Hi, sock puppet.
RACHEL MYERS: My name's Louise.
DOUG STEVENSON: Oh, hi Louise.
[CHUCKLES]
This feels very awkward.
I feel like I should be talking to a sock puppet?
RACHEL MYERS: Why not?
What do you mind?
What's wrong?
DOUG STEVENSON: Because I can see her mouth
moving with the sock puppet.
That's why.
RACHEL MYERS: Don't look at her.
DOUG STEVENSON: [LAUGHS]
Can't help it.
RACHEL MYERS: OK.
So the story behind the sock puppet
is that, so for Hack Week, we went to try to demon--
so we were presenting what we made for Hack Week.
And we went to try to show the problem that developers could
have that we're solving by showing the rule history,
for example.
We wanted to tell a little story.
If we acted-- that was the quickest way to do it.
It's boring to say, sometimes, you
commit a bad rule change, blah, blah, blah.
That would be very boring.
So instead, we put our socks on our hands.
They were clean, I think.
DOUG STEVENSON: I hope.
You wouldn't want to use a dirty sock for a sock puppet.
RACHEL MYERS: We might have.
We had post-it notes and pens, so we
drew eyes on post-it notes and stuck that to our socks.
And then we acted out the problem.
And it's really great, because a sock puppet
can have some over-the-top emotions that we probably
wouldn't express if it's just us.
DOUG STEVENSON: I see, I see.
RACHEL MYERS: As humans, we're a little bit more
emotionally even-keeled.
A sock puppet can go crazy!
DOUG STEVENSON: Yeah, yeah, yeah.
RACHEL MYERS: So it's kind of fun and dramatic.
It's a fun way to demonstrate things.
DOUG STEVENSON: I see, I see.
RACHEL MYERS: And then we had another Hack Week,
and we also demoed it with our sock puppets.
So it's just become a thing now that, when
I'm going to demo something, I just
put a sock on my hand, and I--
DOUG STEVENSON: Go nuts with it?
RACHEL MYERS: Yeah.
This is who presents the problem.
And then we can step in with the solution.
DOUG STEVENSON: Is the sock puppet developer persona?
Is that what you've done?
RACHEL MYERS: So normally, I have
a polka dot sock that is my sock puppet developer persona.
That one was in the laundry today,
so I had to bring-- this is like my backup developer persona.
DOUG STEVENSON: So you wear your socks
and then use them as sock puppets.
OK.
Now I understand why your socks bring you so much joy,
as you said earlier.
You wear them, and then you play with them.
RACHEL MYERS: Yeah, exactly.
DOUG STEVENSON: That's beautiful.
RACHEL MYERS: Yes.
Double duty.
DOUG STEVENSON: Well, I'm glad you have fun at Hack Week.
And I do too.
And your first presentation with the sock puppet,
I don't know if I told you this, but I saw it on screen
but I couldn't hear it because there
was a problem in the video for our room here in Mountain View.
So I remember seeing these sock puppets on screen.
I had no idea what was going on.
And I didn't even know it was you there.
So thanks for giving me the insider view of that.
RACHEL MYERS: So you just got to see some puppets.
DOUG STEVENSON: I just saw this.
All I saw was sock puppet.
And we could hear nothing.
We could see some things, but that was it.
It was kind of frustrating, yeah.
RACHEL MYERS: That's a terrible experience.
I'm sorry.
DOUG STEVENSON: Yeah, yeah.
Well, maybe next time.
RACHEL MYERS: OK.
DOUG STEVENSON: Well, Rachel, thanks for being on the show.
And-- oh, I'm shaking a sock puppet hand.
Thanks for being on the show.
RACHEL MYERS: It was great.
DOUG STEVENSON: And thank you for tuning in.
If you want to subscribe right here on the Firebase channel,
you can get more great video content just like this.
More #MeetFirebase, more #AskFirebase,
more video tutorials.
And I'll see you here next time.
Thanks for watching.
[MUSIC PLAYING]
[CLAPPING]
RACHEL MYERS: I see you looking at Rachel a lot,
and it's making me self-conscious.
I'm over here.
Doug, you're being a weirdo.
DOUG STEVENSON: [CHUCKLES]
RACHEL MYERS: Why can't you just be normal?
DOUG STEVENSON: This is not normal for me, I'm sorry.