buildmaster
Re:Show HN: Hoist – Zapier for Developers (scripting done in Node.js)
on Monday October 12, 2015 @08:59PM (#10377835)
I should also add that we don't use the URL for any kind of security/lookup. we rely on other information for that. as such the aim is to give readable canonical urls to your application, much like most apps use a /{username} slug
Re:Show HN: Hoist – Zapier for Developers (scripting done in Node.js)
on Monday October 12, 2015 @08:57PM (#10377829)
thanks for the link, I agree it's bad practice if there's any kind of lookup/security based on the slug. We have a few other mitigations against looking up anything security wise from the slug itself. but will take it into consideration as I agree it increases guess-ability of the slugs and could leave us open in future.
Re:Show HN: Hoist – Zapier for Developers (scripting done in Node.js)
on Monday October 12, 2015 @05:54PM (#10377172)
also you can get hold of us in app using the intercom speech bubble in the bottom right of the app. That way we can track back to your user account and see what's up.
Re:Show HN: Hoist – Zapier for Developers (scripting done in Node.js)
on Monday October 12, 2015 @05:50PM (#10377152)
I'm not sure what you mean by "your database" and what was wiped clean?
Re:Show HN: Hoist – Zapier for Developers (scripting done in Node.js)
on Monday October 12, 2015 @05:49PM (#10377146)
it's not user id but actually just a random number. it's unrelated to your ID (which are actually more complex than just integers). The random number is there just to ensure we don't get collisions on slugs.