Re:API responses should be signed
by adrianmonk on Monday January 20, 2020 @02:49AM
(#22097148)
The author seems to have written this article in a very web-centric way, as if "API" could only possibly refer to web service APIs that go over the open internet.
But of course sometimes (you might even say often) APIs don't go over a network at all and don't cross the sort of boundaries that require signing.
For example, the Linux kernel has an API that applications can use. There's no need for the response to open(2) to be signed. If you can't trust the result, you can't trust anything else that is happening either since you are at the mercy of the kernel.
Re:API responses should be signed
by edent on Monday January 20, 2020 @03:01AM
(#22097214)
The author primarily works with web APIs. But, for example, the Kernel's USB API may want to verify that it is communicating with a specific device. And, for audit purposes, log the signed input.
But of course sometimes (you might even say often) APIs don't go over a network at all and don't cross the sort of boundaries that require signing.
For example, the Linux kernel has an API that applications can use. There's no need for the response to open(2) to be signed. If you can't trust the result, you can't trust anything else that is happening either since you are at the mercy of the kernel.