3 ms·
Practically speaking, discovering that fact and taking advantage of it, is already "hacking".
by coldtea 2mo ago
Practically speaking, discovering that fact and taking advantage of it, is already "hacking".
- tossandthrow 2mo agoWe are used the interfaces being web interfaces. But say that the underlying api exposes some endpoint discoverability capabilities (eg. Exposing an openAPI spec), then arguably the action was invited: the actions was documented along with the auth model.
- TeMPOraL 2mo agoUnfortunately normies tend to treat APIs like "staff only" stickers on doors.
- coldtea 2mo agoIf you forget a slip of paper writing "the door is open + your alert shutdown pin" on a sticker outside your house, is it not still an issue if someone enters who you didn't invite?
- Ekaros 2mo agoI don't think that argument would go down very well if the API allowed transferring money from company to yourself. Clearly there is at least on some level expectations what is and what is not allowed.