ShowHN: dweet.io – Twitter for machines

Re:ShowHN: dweet.io – Twitter for machines by jheising on Friday February 07, 2014 @07:08PM (#7199656)

Agreed, in the code-readability sense it's a little on the strange side, but I wouldn't call it completely nonsense either. My thinking behind the design was that developers are a lot easier to deal with than end-users/laypeople who you might rely on to help debug things. Besides, it's easy enough to write wrapper functions or use DEFINE (in the case of C/C++) to make the code more code-readability-friendly.

Nothing is perfect for everyone, and I think the response is probably the least important aspect of HAPI. The biggest bang for the buck in my mind is self documenting URLs and support for only HTTP-GET verbs. Just my $0.02 :)

[ Parent | on HN ]

Re:ShowHN: dweet.io – Twitter for machines by sunir on Friday February 07, 2014 @07:59PM (#7199829)

I don't understand why you insist changing operations like create, update and delete should be HTTP GET. That is a security nightmare.

[ Parent | on HN ]

Re:ShowHN: dweet.io – Twitter for machines by IanCal on Saturday February 08, 2014 @07:35AM (#7201028)

It depends on what you want to support. I've done similar as I was working on platforms that didn't actually support POST/PUT/DELETE. However you then have to contend with misbehaving caching too.

[ Parent | on HN ]

Re:ShowHN: dweet.io – Twitter for machines by jheising on Saturday February 08, 2014 @11:40AM (#7201631)

Seriously? Look at the HTTP protocol and tell me you really believe that.

Their way:

DELETE /something HTTP/1.1

My way:

GET /delete/something HTTP/1.1

Do you really think one is more secure than the other?

[ Parent | on HN ]

Re:ShowHN: dweet.io – Twitter for machines by sunir on Saturday February 08, 2014 @11:43AM (#7201642)

Yes because browser implementations do not allow casual DELETE requests. There is a reason the standard says not to use GET for destructive changes.

[ Parent | on HN ]

Re:ShowHN: dweet.io – Twitter for machines by jheising on Saturday February 08, 2014 @11:54AM (#7201689)

So let's not a call it a security issue then. Let's call it an "it's too easy to delete" issue. And if that's the case, then that's what we're going for— easy. Remember, if you were truly protecting something that was secure then you would require a security token parameter— which BTW is something we're planning in the next rev, for people who want to protect their machines.

If I was phishing to get you to click on a link to delete a resource, then I would need to know that token, and if I knew that token, then I could just delete it myself. Note that the HAPI spec discourages the use of cookies (which I agree could allow a phishing attack if you were using cookies as a security mechanism).

[ Parent | on HN ]

Re:ShowHN: dweet.io – Twitter for machines by carbocation on Saturday February 08, 2014 @01:56AM (#7200538)

It also limits the request size to something like 4K.

[ Parent | on HN ]