tasn

37 ms·

1. 421.▲
   by tasn 5y ago

   Hehe, perfect timing with your post, and thanks for the shutout! :) Yeah, API uptime is crucial (and we spend a lot of time on just that). Though I think it's not just for us, but rather for almost all of the external APIs and services
2. 422.▲
   Launch HN: Svix (YC W21) – Webhooks as a Service

   117 points by tasn 5y ago|63 comments
3. 423.▲
   by tasn 6y ago

   I think companies DDOSing endpoints is one of the least talked about issues with some webhooks implementations. Every time I tell people we offer it with Diahook[1] they look like it's the first time they even considered this... [1] h
4. 424.▲
   by tasn 6y ago

   I don't think they can. They do notifications for users, but website visitors are anonymous. It doesn't make sense to add it to the landing page. With that being said, I think a live demo is a great idea and would go a long way!
5. 425.▲
   by tasn 6y ago

   Thank you. :)
6. 426.▲
   by tasn 6y ago

   That's a fair assessment! We are indeed a startup, and definitely have limited resources. What I meant is that this is one of our top concerns that we constantly think about and deploy (our limited) resources on! We are definitely not
7. 427.▲
   by tasn 6y ago

   Thanks for all of the feedback, definitely a lot of gems I plan to act on! > Nice. These are very useful feature and I can see myself subscribing for these. May I suggest you highlight these as the main features and demote, remove or re-
8. 428.▲
   by tasn 6y ago

   Hehe, I know this story too well, I've been there before! Feel free to reach out (email: tom @ the domain) if you have any questions or need any help! Oh, and please share feedback.
9. 429.▲
   by tasn 6y ago

   We have the ability to audit and inspect past calls. We don't yet scrub PII, though we have a few features down the pipeline that will enable just that. Thanks for your comment!
10. 430.▲
    by tasn 6y ago

    Oh yeah, I forgot about undraw! I thought he was talking about the layout.
11. 431.▲
    by tasn 6y ago

    Same creator (me), but otherwise no. :)
12. 432.▲
    by tasn 6y ago

    Not sure I follow. Could you please elaborate?
13. 433.▲
    by tasn 6y ago

    Yeah, YC W21!
14. 434.▲
    by tasn 6y ago

    Ah I get what you mean now! Interesting way to ensure they are actually doing the right thing! I think the ping with the bad signature to check they are actually verifying the webhook is much lighter weight, and almost solves the same probl
15. 435.▲
    by tasn 6y ago

    I just skimmed through the post (it's late here, haha). It looks like Centrifuge is cool and is a part of what a webhook systems needs, but not all of it. Check out the landing page for some of the other things we provide. Thanks for s
16. 436.▲
    by tasn 6y ago

    Thanks a lot! And yeah, I'm familiar with hookdeck, your co-founder already commented in this thread. :)
17. 437.▲
    by tasn 6y ago

    We already protect against reply attacks (we have a signed timestamp as part of the webhook), and I'm not sure what you mean by challenge-response checks. Do you mean things to protect against SSRF? If so, yeah, we also sign the webhoo
18. 438.▲
    by tasn 6y ago

    This is very cool! I'll take a better look at what you do tomorrow!
19. 439.▲
    by tasn 6y ago

    Hey, thanks for the feedback! We don't claim 100% SLA, as you said, it's impossible. I already replied to this a few times in this thread. I think the same can be said on every other API company, including Stripe, Sendgrid, Twilio
20. 440.▲
    by tasn 6y ago

    Thanks a lot!
21. 441.▲
    by tasn 6y ago

    Yeah, it's one of the thing that people miss when implementing webhooks naively, and I bet it's one of the things people miss when consuming them!
22. 442.▲
    by tasn 6y ago

    I'm the developer of Diahook (we do webhooks as a service), and I agree. It's just so annoying that we have to implement signing ourselves instead of just using client TLS certificates. Though the problem is that there are so many
23. 443.▲
    by tasn 6y ago

    Yeah we do. Only for Python and JS (TypeScript) at the moment, but we will add more. Both for the sending part (it's really just a REST API under the hood for now), and the consuming (verifying signatures).
24. 444.▲
    by tasn 6y ago

    Thanks! Feel free to reach out tom @ the domain. :)
25. 445.▲
    by tasn 6y ago

    Thanks for asking: 1. Exponential backoff. We don't notify clients, but we notify you with a webhook. We actually don't have it implemented yet, but will have in the next week or two. 2. Yes, and libraries for some languages (more
26. 446.▲
    by tasn 6y ago

    Cheers, thanks!
27. 447.▲
    by tasn 6y ago

    Thanks for the feedback! Happy to chat with them directly (email: tom @ the domain). 1. Ah, maybe. We are still new and trying to figure it out. Thanks for the feedback. 2. We already offer them, including libraries for some languages to ea
28. 448.▲
    by tasn 6y ago

    Thank you, I'd love to chat if you are willing! My email is tom @ the domain. Is there a way I could reach you? Thanks!
29. 449.▲
    by tasn 6y ago

    Thanks for the kind words! Yeah, there is no magic (well, there is some), it's just the product of experience and hard work. We make it so you don't have to earn this experience the hard way, and not have to waste your time on doi
30. 450.▲
    by tasn 6y ago

    Yeah, they share a lot of the same challenges as they are both unlike the rest of the web stack (which is just request -> response). There are a lot of similarities, but a lot of different challenges too.