GraphQL is an open source query language for APIs and a runtime for executing those queries.

It was developed by Facebook to address the problem of overfetching or underfetching data,

which is a common issue with traditional rest APIs.

Matt Bessie is a principal engineer and software architect.

Earlier this year, Matt wrote a blog post titled,

Why, after six years, I'm Over GraphQL. The post put

words to many users' frustrations with the technology, and it went viral on hacker news. Matt joins the show

today to talk about GraphQL, the problems it solves, its security vulnerabilities, and why it

might not be a good fit for back-end engineering today. You can find a

link to Matt's blog post in our show notes. Gregor Vand is a security focused technologist and is the

founder and CTO of MailPass. Previously, Gregor was a CTO across cybersecurity, cyber insurance,

and general software engineering companies. He has been based in Asia

Pacific for almost a decade and can be found via his profile at vand.hk.

Hi, Matt. Welcome to Software Engineering Daily.

Hello.

Yeah, so Matt, we're excited to have you on today.

So what sort of caught our attention at SE Daily was a what ended up becoming a very popular hacker news article, you know, that surfaced

that you wrote, you know, and the sort of topic was GraphQL today. And sort of, you know,

you've been working with it for about six years and this was sort of your analysis of where

things were at today. It's a topic I've been following for a little while,

and I think just when your article popped up, that was the time that I thought, yeah,

I think it's not just me thinking some things, there's some other people thinking some things,

...