alt Hacker NewsOnly allowing GET requests is a hilarious piece of security theatre (or would if it weren't so sad). Everyone knows that GET is read-only only by convention. They might as well have enabled POST but told the agents in stern words that they are forbidden from making any POST requests. (Of course, if these things were anywhere near aligned, they would actually honor that, no matter how many utilons cheating would be worth.)
Replies
Until a couple of years ago instead of using query parameters I just made GET endpoints with json bodies, it worked perfectly!
I stopped when the new linter told me GET shouldn't have bodies, but I still have some of them in my code.
yeah that's so hopelessly naive, maybe someone was taught that GET is read-only throughout their whole education and career. But still, all you have to do is think about it from the server side and you should realize that you can do whatever the hell you want with that byte array on the socket, the client has no say and there's no client side guarantee whatsoever. idk where this line of thought comes from, it's like thinking robots.txt has any kind of actual enforcement at all with respect to crawlers. It's meaningless and works only by convention and the good will of the crawler author.
didn't notice your comment so posted a similar one - but yeah this is a very high level of inexperience to me... You'd think they would have some of the greatest security experts in there
some ivy league grad with no real world dev experience waved this on
Based on the hackiness of the claude code leak as well I get the impression that openai/anthropic have world class experts in ML but lack regular software expertise
To me it feels like an LLM would have suggested this as a safety measure. LLMs always follow official best practices, they might mistakenly believe that this is true for the wider internet as well.