One of the things I find most dangerously lacking in the tech community today is imagination.

Send everything or use DTOs is a false dichotomy. The author has provided three alternatives in this article alone. There are others as well.

And I hear that "it's not wise" to reveal the underlying structure of your data all the time, but it typically turns out that the person raising this concern just heard it somewhere else. When pressed, they can never tell me *why*.

If the client is ours (web site, mobile app, etc), and the back end is ours, and all communication between clients and the back end is encrypted, what's the risk?

And if that's not the case, there are reliable, performant ways to filter the data set appropriately that don't involve creating and maintaining the heavy, duplicative layers of DTOs, etc.

Dare to dream! ;)