News for hackers. Stuff that matters.

ricberw

ricberw on Hacker News

Ask HN: How do you enforce least-privilege when an API token has full access?

Posted by ricberw on Saturday March 14, 2026 @02:28PM
from the ask-hn dept.

Curious how people handle least-privilege access when integrating third-party APIs that only offer a single coarse permission scope (or limited scopes that are still over-provisioned for a specific use case).A lot of services expose APIs where the token basically grants everything the integration can do (read/write/delete across the entire account), making it hard to enforce the principle of...

( Read More... | 2 comments | 2 points | on HN )
Re:Tornado Warning for SF on Saturday December 14, 2024 @08:56AM (#42417161)
We’re just getting all the things now…
Re:Real-Time Brainwave Visualization: Integrating Muse EEG with Python on Monday May 27, 2024 @02:06PM (#40493092)
Found this while looking for resources to track NREM vs REM sleep per night at home and thought it was pretty ridiculously cool — anyone have experience with a sleep tracking headband that can do this and summarize results?
Re:Coding at Applebees (Date with Django) on Wednesday January 17, 2024 @10:35AM (#39029133)
It occurred to me that some in the HN community might actually jump on this and use it to kick-start a new project -- a consistent location to eat and code at a ridiculously low price.

I take zero responsibility for any negative health outcomes that might come from your Date with Django happening over Applebees food, though.

Re:Ask HN: What is your new year's resolution for 2024? on Friday December 29, 2023 @11:36AM (#38806859)
I feel like I need to go back to the basics: build great things.
Re:GM Cruise cofounder, senior exec Dan Kan quits day after CEO exit on Monday November 20, 2023 @05:41PM (#38355955)
It is somewhat amazing that because of the OpenAI debacle, significant news like this isn’t making the first page cut.
Re:Yup, that was an earthquake outside SF on Friday October 27, 2023 @11:18PM (#38046794)
Same here —- was shorter than the last one this year though.
Re:Yup, that was an earthquake outside SF on Friday October 27, 2023 @10:21PM (#38046492)
Even at this 3.9ish we had a few things fall off shelves :)
Re:Show HN: OpenAPI DevTools – Chrome ext. that generates an API spec ... on Wednesday October 25, 2023 @11:06AM (#38013617)
This is awesome!

I'll second/third the feature request for auto-including auth headers/calls (as many of the sites I'm trying to understand/use APIs from use persistent keys, and scraping these separately is just unnecessary extra time).

On that same note, I'd greatly appreciate keeping the initial request as a "sample request" within the spec.

I'd also greatly appreciate an option to attempt to automatically scrape for required fields (e.g. try removing each query variable one at a time, look for errors, document them).

Thanks for this :)

Re:Acidic water with zero alkalinity now being pumped to SF Sunset and... on Monday October 02, 2023 @11:48PM (#37747751)
https://sfpuc.org/programs/water-supply/groundwater

The map says so. They must’ve recently changed the mix.

Acidic water with zero alkalinity now being pumped to SF Sunset and Richmond

Posted by ricberw on Monday October 02, 2023 @11:34PM
from the self-post dept.

Disappointed native San Franciscan here, hoping to find solace in other locals who are also experiencing the same challenge that I am now facing.Last week, around Thursday, we noticed a significant flavor change in our water. More chlorine-y.That day, I started having the acidic heartburn feeling for the first time in a while. The feeling has continued since then, and I’ve been taking a Tums at...

( Read More... | 4 comments | on HN )
Re:Emoji Generator with AI on Friday September 08, 2023 @10:55AM (#37434303)
Tons of fun :) thanks for the laugh!
Re:Ask HN: Shopping for yourself or someone else online? on Sunday September 03, 2023 @11:13AM (#37371065)
They do ask for the message when I check the box :)
Re:Ask HN: Shopping for yourself or someone else online? on Sunday September 03, 2023 @10:59AM (#37370944)
Good point -- if you're shipping it direct to the recipient, yes, it might be pretty easy to identify "for someone else" -- but that's a post-purchase nugget of knowledge.

When you buy as a gift though, you probably ship to yourself first in many cases, right?

Re:Ask HN: Shopping for yourself or someone else online? on Sunday September 03, 2023 @10:50AM (#37370884)
Do you feel like a single prompt at the start of your shopping journey would turn you off/be a blocker?

E.g. "Are you shopping today for yourself or someone else?" as an entry gate.

Re:Ask HN: Shopping for yourself or someone else online? on Sunday September 03, 2023 @10:41AM (#37370805)
I'll start: usually shop for myself, plus shop for gifts for others.

I do, however, share links with friends and family when I find something that is an amazing product/service at a good value.

I'd love to tell websites who I am shopping for if it means I'll get better recommendations/have a smoother experience.

Re:MLS cyberattack halts entire US real estate market on Tuesday August 15, 2023 @09:17PM (#37141596)
Fair, not entire market.
Re:MLS cyberattack halts entire US real estate market on Tuesday August 15, 2023 @08:43PM (#37141314)
Posted this based on an agent I know mentioning that she’s effectively taken the last four days off because the lack of MLS makes her job “nearly impossible to do properly.” She said many at her agency are doing the same.

I wouldn’t be surprised if this shows up in major economic indicators this month.

Older »