News for hackers. Stuff that matters.
Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by WendyTheWillow on Wednesday November 08, 2023 @05:02PM (#38197746)
It's "good" if you're enumerating a potential target!

Otherwise, you typically either want to make your URLs intuitively discoverable or not discoverable at all. An incrementing ID like this is neither, so it sits in a weird middle ground that probably satisfies nobody (except those trying to get things done who don't care, I guess).

Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by thrownblown on Wednesday November 08, 2023 @05:09PM (#38197827)
Incrementing a URL can (and has) get you prison time.

https://www.wired.com/2012/11/att-hacker-found-guilty/

Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by ric2b on Wednesday November 08, 2023 @05:40PM (#38198245)
In the same way that squeezing on a hunk of metal that some may call a "trigger" can get you convicted for murder.
Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by WendyTheWillow on Wednesday November 08, 2023 @05:18PM (#38197949)
The incrementing itself wasn't the issue! It's all the other stuff around their scraping and apparently their provable desire to harm AT&T that got them convicted.
Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by thrownblown on Wednesday November 08, 2023 @06:01PM (#38198493)
Definitely not going to argue with you on that. But it did all start with the simple addition to the URL.
Re:How Bad Rails Conventions Got Me a Weekend Stay with the ... by pests on Wednesday November 08, 2023 @08:45PM (#38199938)
Odd they didn't use his handle. I figured it was weev but never knew his real name.