3 ms·

I don't know that there's a way you can pitch your reasoning to me where I would agree. The two statements sound equivalent to me. API rate limits are just that

I don't know that there's a way you can pitch your reasoning to me where I would agree. The two statements sound equivalent to me. API rate limits are just that- rate limits. This is not akin to hacking and a software engineer I doubt would ever confuse it with hacking of any kind. What would be an example of "exploiting a rate limiting bug"? Either the server limits/throttles requests, or it doesn't.

justinclift 3y ago
> What would be an example of "exploiting a rate limiting bug"? All sorts of possibilities spring to mind for that. :) Here's a hypothetical example. Lets say you discovered a logic bug in the API limit code along these lines: "So, it turns out if you have an `X-Forwarded-For` header in the request, then the request is processed properly except it isn't counted towards the limit. Effectively a bypass." Exploiting this one would of course be trivial, as you'd just need to set that header for all your requests.