3 ms·

Ouch. The API designer inside me is shivering at that monstrosity. > You might ask why the Messenger API expects a JSON string inside a JSON string inside a JS

Ouch. The API designer inside me is shivering at that monstrosity. > You might ask why the Messenger API expects a JSON string inside a JSON string inside a JSON string inside an HTML form. You would have a very good question. Probably multiple layers of tooling and encapsulation to get to the real backend, or just unpaid tech debt. Also, first the author discovers a GraphQL endpoint. I thought great, just introspect the schema instead of blindly poking around! But no, the GraphQL API seems to only be used to transfer project LightSpeed payloads which are server generated JS snippets meant to be blindly executed to update the UI. Rough.. I know GraphQL originates at Facebook but I don't think that was the intended usage... Also, the author's python script seems to be opening a new session on every invocation. This might have triggered the account suspension, since login endpoints are certainly amongst the most heavily monitored for suspicious behavior.

pocket_cheese 4y ago
My experience at FAANG was that every major service had like 9 layers of abstraction or had to traverse several hops to do the actual thing. I've kinda become jaded and feel like most things that make money are ugly. Whether it's a giant plate of spaghetti served up by some start-up trying to be the first to market, or a lovecraftian horror that is only exceeded in scale by it's unknowability - like what OP posted. The end result is the same... 40 api calls to submit a form :'''(