I've fuzzed parts of the GitHub API. Here are my findings

Re:I've fuzzed parts of the GitHub API. Here are my findings by londons_explore on Wednesday November 30, 2022 @09:36AM (#33801293)

Doing this sort of thing to a live webservice is a good way to get a perma-ban...

[ Parent | on HN ]

Re:I've fuzzed parts of the GitHub API. Here are my findings by ludovicianul on Wednesday November 30, 2022 @09:43AM (#33801377)

Author here. There are no major security issues and it's also compliant with the API rate limiting restrictions.

[ Parent | on HN ]

Re:I've fuzzed parts of the GitHub API. Here are my findings by masklinn on Wednesday November 30, 2022 @10:54AM (#33802506)

Including the new secondary rate limits? They’re quite annoying.

[ Parent | on HN ]

Re:I've fuzzed parts of the GitHub API. Here are my findings by bobleeswagger on Wednesday November 30, 2022 @11:33AM (#33803198)

It's a fine line, if Github wanted to I'm sure they could write up a convincing cease and desist. I think they spoke up about it because your article gives the impression that this sort of thing (fuzzing APIs) is okay, which I wouldn't exactly say is positive.

[ Parent | on HN ]

Re:I've fuzzed parts of the GitHub API. Here are my findings by ludovicianul on Wednesday November 30, 2022 @01:44PM (#33805533)

True. This is why I run it only for one path. I also run it against Kubernetes API and some of the payloads resulted in timeouts which I submitted to the security team.

[ Parent | on HN ]