How Bad Rails Conventions Got Me a Weekend Stay with the CEO of Airbnb

Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by gaogao on Wednesday November 08, 2023 @04:40PM (#38197494)

It's pretty common outside of rails too, like https://facebook.com/4

Some main weaknesses, if I recall correctly, is that's incremental ids make scraping pretty easy, or guessing content outside of a URL given explicitly by the service (like here).

[ Parent | on HN ]

Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by david_allison on Wednesday November 08, 2023 @04:49PM (#38197593)

They also leak metrics (#of registered users)

[ Parent | on HN ]

Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by wilg on Wednesday November 08, 2023 @06:04PM (#38198528)

I think this is the only downside.

[ Parent | on HN ]

Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by pests on Wednesday November 08, 2023 @08:43PM (#38199923)

ALTER SEQUENCE "seq_user_id" RESTART WITH 5000000000

Wheres my billion dollars

[ Parent | on HN ]

Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by simlevesque on Wednesday November 08, 2023 @04:50PM (#38197599)

Also, competitors can analyze your growth more easily.

[ Parent | on HN ]

Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by cartothemax on Wednesday November 08, 2023 @05:04PM (#38197775)

Yep, you're correct. Panera had an issue where folks could scrap every user profile due to sequential profile ids. The bigger part of the exploit was they just openly exposed user data but making the profiles ids sequential made it really easy to scrap

https://krebsonsecurity.com/2018/04/panerabread-com-leaks-mi...

[ Parent | on HN ]