3 ms·
People do run HTTPS clients on AWS, though. Web APIs tend to [1] require exactly that. [1] Lala people never send sensitive data over plain HTTP I'M NOT HEARIN
by JoachimSchipper 14y ago
People do run HTTPS clients on AWS, though. Web APIs tend to [1] require exactly that.
[1] Lala people never send sensitive data over plain HTTP I'M NOT HEARING YOU.
- Dylan16807 14y agoSure, they might use HTTPS, but how often do they load arbitrary pages with uncontrolled javascript?
- JoachimSchipper 14y agoPretty much never. How often do they make requests that are at least partially attacker-controlled, though? (Note that variants on https://www.someapi.com/...?username=foo https://www.someapi.com/...?username=foo contain attacker-controlled data...)