@ConorMancone I'm not in a bug bounty situation. I work for the creator of the app. But I had hoped to get some input on this. I didn't just want to tell them 'I don't like the way you built that', obviously. Unfortunately instead of thinking about the way the API works, almost everyone immediately jumped on the 'idempotency' part

(which I DO STILL mean in the sense that requesting a specific resource - which is required here - should always lead to the same result, the same outcome: returning that same particular resource - even if THAT resource changed in between -, not different ones, not an arbitrary one. I stated multiple times that I understand that the GET request IS http idempotent in the sense of that it doesn't MODIFY the server state in itself, from the very beginning. This is obvious.)

Requesting a particular resource MUST always return that particular resource. Even if the content changed. This is not the case here. While browsing about idempotence I found this example: "When you ask someone for the time, the actual time that gets returned will always be different. BUT it will always be the same resource, in the sense of it's always the 'current time'."

If someone tells you the current Japan time instead, then that's an issue.

And that's what is happening here.

Or rather "could happen", that is the threat that is bugging me.

My bad for not explaining what exactly I meant with "the request is not idempotent". But I also stated in my original question, that that was only ONE example of why I think that this is a corrupt design.

(Or rather, it will be the same 'format', in the sense of: it's always the 'current time'.)

What the actual fuck is wrong with people these days?

A guy on the bus was not wearing a mask, and some older guy walked up to him and just started screaming at him that he is going to die if the guy doesn't wear a mask

I feel like Corona is getting into people's heads...

Help I do not know how to Google

What's the most polite way to ask someone to fuck off?

@MartinFürholz I wasn't worried personally worried about the idempotence issue here, nor does it matter that you are working directly with the app owner. My point still remains though. To quote yourself, it help for you to go back and say, "I don't like the way you built that". This is a weird edge case, so you just need an exploit to figure out if there is an actual problem. Because that's what it comes down to: is there an actual problem?

yo where do blackhats hangout and chat?

Sure, the behavior is weird. But: Can an attacker inject themselves into the flow to get a different response returned to someone else? And if so, can they get the system to return a response that causes actual harm or benefits the attacker?

If the answer to either of those questions is no then the most you can say is, "This endpoint violates the principle of least surprise, so it may be smart to change the way it works to minimize problems later". There is something to be said for that after all. Even if there isn't an obvious issue, having things that operate contrary to norms is how you get yourself in trouble, because the harder it is to understand a system, the easier it is to make a mistake

The trouble is that those kinds of points are typically much harder to convince business people of...

@MechMK1 People are getting crazy. At risk of sounding like a cliche, fear and lack of knowledge are a terrible combination.

@VipulNair Twitter

@ConorMancone I mean, sure, it's shitty to be on the bus without mask, but damn...

I once got cursed at for accidentally walking in the exit of a store. It wasn't even as obvious of a boneheaded mistake as it sounds - the store had a connected-but-separate store that was under the same roof but just outside the main doors, so I wasn't actually entering so much as coming back in from outside.

(I was outside the main doors but inside the main entrance where all the signs about "Exit only" were placed)

why twitter?

@MechMK1 That's... quite the question.

@VipulNair I dunno. That's just where they all hang out

are you fucking with me?

No, I'm actually serious

alright.i believe you

Thanks much for your input @ConorMancone, I really appreciate it

@ConorMancone I once entered the girl's restroom by mistake. One year earlier, I was doing a test for college that was held at some high school, boys restroom on 2nd floor, girls on the first. next year I am doing the same test again, on the same school, but they renovated the school and restrooms changed places...

@ThoriumBR Fortunately you weren't drawn and quartered...

no, the security guy yelled at me from a distance, everyone on the corridor looked at me, and the introvert me died a thousand times that day

on the end it went well, because I passed the exam and entered one of the best universities on our country

As a fellow introvert I can understand :)

Sudden urge to say "The introvert dies a thousand deaths, the extrovert dies but once"...

What kind of question is that?

The underlying information isn't changed. It's just a representation

Could be a question he gets a lot from junior programmers that he wants to document

It seems so odd...

It went so badly...

He may have been hoping for a helpful question with a good answer, and therefore some upvotes

I've seen self question-and-answer go well, but they often go very badly...

You should post that as an answer :)

Self answering isn't a very reliable way to earn upvotes unless you already know so much about the field that you don't care about upvotes

It's also victim of an X-Y problem. The only way you could possible "not have room" to store it and fix that with a new representation is if you are using the wrong representation in the first place

I would only self answer like that if there was some problem that I couldn't find an answer to anywhere else that I finally figured out.

It's not like switching from base 16 to base 64 magically gives you more storage space. This is only an "issue" if you try to store binary data as a string with an encoding. A more naturally approach would be to just unecode it and store it as a binary blob - then the data will take up exactly the amount of space it takes up

Is it rude to respond to his not-great self answer with actually good answers?

His question basically is "I want to store seventeen thousand, eight hundred, ninety seven but there's only space for 8 bytes. If I write 17897 does it reduces the security?"

@ThoriumBR That's a great example!

I will comment there...

@ThoriumBR Make it an answer so we can upvote :)

So, I wrote my pleb answer

done

@MechMK1 nice answer

So I moved to another house, another ISP, 150mbps internet plan, and the latency is unbearable... Some times I don't even know if I am connected or not, and that being 0.5m from the router...

so I went to discover where in the infra is the latency, and got a nice curl response file to diagnose that: stackoverflow.com/a/22625150/16545

it connects to a site and throws everything at /dev/null and gives a report on lookup, connect time, pre-transfer and start-transfer times

and the lookup time is horrendous...

I guess ISP DNS is shit?

1.5s for lookup? that's way below terrible...

Did you try the same with 8.8.8.8 as your DNS?

Is that from your ISP's DNS?

What is your ping response time to various IP addresses?

yum update is pulling updates at 300kbps... 600kbps at most.

I had a similar problem with apt-get at some point. Sometimes, I would get speeds like 6kb/s, and it would stay there. I'd have to ^C and upon reloading, I'd get like 1 MB/s

ping is not bad, 200ms at most (icq, that I don't know why from all domains, I remembered this one) and 25ms at google

Ouch...

But I am glad to know I am not the only one who uses XKCD as connectivity check :D

@MechMK1 What world are we living in that google.com wasn't the first test case???

@FireQuacker I just feel like it gives Randall the recognition he deserves

it's because google is too close to everyone, so the latency will be very small...

xkcd does not have hundreds of cdns, mirrors, and still is a vital part of the infrastructure

> xkcd is a vital part of the infrastructure

@MechMK1 Recognition == traffic? :)

Ah yes, true nerddom

@FireQuacker Yeah, absolutely

@ThoriumBR All the updates would be coming from one domain, though, right?

updates are coming from globo.com, one of the largest content providers down here

I downloaded a windows image from ms, a couple gb, took half an hour...

at 150mbps should take a few minutes

didn't tested yet, just saw on reddit... but it will help me managing a client...