Re:Uber CLI
by jaebradley on Thursday February 23, 2017 @07:19PM
(#13719402)
It's an NPM package that people download - how would you store it outside the repo such that people that download the package can reference the token? Can't really use an environment variable at that point, right? There probably has to be some HTTP request to some service that ends up forwarding the request to Uber with the token. Maybe I'm over-thinking this...
[ Parent
| on HN ]
$ uber time '123 anywhere st'
No API key found. Please create one using the
instructions at <site> and call 'uber set-key <key>'
$ uber set-key <key> # writes <key> to a file in home dir or a .gitignore location in the repo
Well done!
$ uber time '123 anywhere st' # reads <key> from file, works as you have it
...I think the idea is that you implement some interface for interested users to supply their own API keys.
Re:Uber CLI
by jaebradley on Thursday February 23, 2017 @08:51PM
(#13720130)
Gotcha - ok, that certainly makes sense. Though makes for a slightly less friendly (but certainly more secure) service.
A friend of mine accidentally pushed his Heroku or New Relic API key to a toy repo which was public and that information was immediately scraped and used. He was billed a non trivial about which he disputed but cost some time and headache.
Enforce best practices and don't do that even if it's for something trivial and won't have real world consequences.
So if I clone this repo I can now access your API account? Might want to pull this repository from Github......
Re:Uber CLI
by jaebradley on Thursday February 23, 2017 @10:33PM
(#13720695)
You would have access to my server token, certainly. But I checked the documentation and in order to request rides, I think you would need other pieces of information that I did not expose. Additionally, there are various scopes that Uber grants regarding the API exposure that any application has.
I think / hope that the worst damage that can be done is hitting Uber's rate limit.
Definitely not defending my decision to include the server token, but I don't think it's the end of the world (just terrible practice).
until they launch a new API endpoint and forget to enforce something...
I guess it might be better to disable the api key...
How does Google Maps get this information? They probably have their middleware, right?