Stop reaching for the TEXT column

I came across the announcement of Buzz and, out of curiosity, started looking at the code. I had a hunch, and it turned out to be correct after looking at the schema: quite a lot of columns use TEXT as their data type.

This isn't an isolated case. It's across the board in many open source projects, and it's worse when those projects are in the security domain.

Choose the type and the length

I constantly tell my teams not to use TEXT in SQL databases unless they really have to. In 99% of cases, no one needs it. It's worth spending a bit more time choosing the data type and a practical length carefully.

A TEXT column in PostgreSQL can hold up to 1 GB. Imagine how few requests it would take to bring down the database.

What's been safeguarding us so far

1. Validation in code. Development teams used to spend time on data types, and the code itself had text size validations. That kind of code barely exists anymore; it's treated as verbose. That guard is gone from most new code.

2. The browser. Most client-server interactions went through browser UIs, whose forms and input fields kept payloads small in practice. That stops being true when agents call the APIs directly from a CLI.

3. Framework defaults. The only safety mechanism left is the default request size limit in language frameworks and application servers. Those limits are in megabytes, though, and a few thousand requests are still enough to bring down your database.

Disclaimer: this isn't about Buzz or anyone in particular. It's a safety practice I felt needed highlighting.