News for hackers. Stuff that matters.

A comment on Announcing rkt v0.5, featuring pods, overlayfs, and more. Parent comment

Re:Announcing rkt v0.5, featuring pods, overlayfs, and more by vacri on Wednesday April 01, 2015 @09:21PM (#9308117)
Not at all. If I have a private repo "foo" and a public repo "bar" and no others, given an unauth'd request:

    > request "foo" => 403
    > request "bar" => 200
    > request "baz" => 403
    > request "qux" => 403
The unauth'd requester can't tell that foo exists and baz and qux do not.
[ Parent | on HN ]
Re:Announcing rkt v0.5, featuring pods, overlayfs, and more by jsprogrammer on Thursday April 02, 2015 @04:12AM (#9309241)
Right, but if someone requests:

    > request "lkj3fla3kjf1ljf3jf"
Which doesn't exist anywhere, it makes no sense to return 403.
[ Parent | on HN ]
Re:Announcing rkt v0.5, featuring pods, overlayfs, and more by jacques_chester on Friday April 03, 2015 @10:12AM (#9315950)
Now you're breaking 403, which is not meant to signal the non-existence of a resource. That's what 404 is for.

The "hiding the existence of resources" purpose has to be carried by something. The RFC says it's carried by 404, and that's that.

[ Parent | on HN ]