4 ms·
This article doesn’t make good on its claim to explain why this “Rails convention” is bad. It’s probably actually good. I wouldn’t have clicked on it otherwise.
by wilg 3y ago
This article doesn’t make good on its claim to explain why this “Rails convention” is bad. It’s probably actually good. I wouldn’t have clicked on it otherwise. Rude, IMO.
- gaogao 3y agoIt's pretty common outside of rails too, like https://facebook.com/4 https://facebook.com/4 Some main weaknesses, if I recall correctly, is that's incremental ids make scraping pretty easy, or guessing content outside of a URL given explicitly by the service (like here).
- david_allison 3y agoThey also leak metrics (#of registered users)
- simlevesque 3y agoAlso, competitors can analyze your growth more easily.
- cartothemax 3y agoYep, you're correct. Panera had an issue where folks could scrap every user profile due to sequential profile ids. The bigger part of the exploit was they just openly exposed user data but making the profiles ids sequential made it really easy to scrap https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/ https://krebsonsecurity.com/2018/04/panerabread-com-leaks-mi...
- splitstud 3y ago[dead]
- WendyTheWillow 3y agoIt's "good" if you're enumerating a potential target! Otherwise, you typically either want to make your URLs intuitively discoverable or not discoverable at all. An incrementing ID like this is neither, so it sits in a weird middle ground that probably satisfies nobody (except those trying to get things done who don't care, I guess).
- thrownblown 3y agoIncrementing a URL can (and has) get you prison time. https://www.wired.com/2012/11/att-hacker-found-guilty/ https://www.wired.com/2012/11/att-hacker-found-guilty/
- WendyTheWillow 3y agoThe incrementing itself wasn't the issue! It's all the other stuff around their scraping and apparently their provable desire to harm AT&T that got them convicted.
- thrownblown 3y agoDefinitely not going to argue with you on that. But it did all start with the simple addition to the URL.
- pests 3y agoOdd they didn't use his handle. I figured it was weev but never knew his real name.
- ric2b 3y agoIn the same way that squeezing on a hunk of metal that some may call a "trigger" can get you convicted for murder.
- deleted 3y ago[deleted]
- anuraaga 3y agoI believe this convention was used widely outside of Rails too so it's less a Rails convention and more a late 90s early 2000s convention. Even now I suspect many articles with good SEO will give table creation SQL using auto increment instead of uuid so maybe just software convention.