Just a lvl 28 guy from Finland. Full-stack web developer and Scrum Master by trade, but more into server-side programming, networking, and sysadmin stuff.

During the summer, I love trekking, camping, and going on long hiking adventures. Also somewhat of an avgeek and a huge Lego fanatic.

  • 0 Posts
  • 7 Comments
Joined 2 years ago
cake
Cake day: June 20th, 2023

help-circle


  • Not intentionally, but in high school we had a test on identification of flowers and plants. The teacher was an older man and he wasn’t good with computers. He was showing pictures from the computer using video projector but didn’t realize that Windows was displaying the filename of each picture in the title bar and each picture was named e.g. “daisy.jpg”. Almost the whole class got full marks on the test except for the unlucky few who sat in the back row and had poor eyesight.




  • That’s reassuring to know. What I don’t understand is why you have the /api/v3/post/like/list route. You say you don’t want votes to be snooped on, but then you add an endpoint that makes it very easy for instance admins to do exactly that if they choose to? Also worth pointing out that the tool linked here wouldn’t work in its current form if this route didn’t exist.


  • Compare your actions to releasing a 0-day exploit for a security vulnerability instead of responsibly disclosing. It doesn’t help, it just causes chaos until the people who do the actual work can figure out a solution.

    This comparison is not fair at all. It’s not like the devs are unaware of this. They could start by removing the API endpoint that lists a post’s votes, but they haven’t, which means they seem to think it’s okay for the instance admins to snoop on votes if they so wish.