I don't mind seeing a duplicate here because this looks like a serious incident that may have been downvoted by Apify employees. I personally didn't see it til now despite checking HN very often.
If you check the thread you linked, Apify isn't being transparent about what data was in the leak. Someone posted it from an email they received and allegedly got downvoted, and then a response from an Apify employee.
(The title is fixed now, and I don't so much care about how much exposure the story gets on the front page as I do that we not lose track of the previous thread. I live in a blissful state of not even knowing what an Apify is.).
The number of systems that will show me the API token more than once makes me realize that many haven't figured out it is just a long password and should be treated exactly as such.
I feel like an asshole posting a criticism of the whole dependency category every time they get a critical vuln.
But if you are building an API service, you don't need an API Management dependency. And it's an additional attack vector. You (as in an engineer or as a company that provides an API service) need to do the actual undelegable job of building an API, just do the work, do the HTTP server, do the rate limiting, do the OAuth integration.
Verdict: Time to uninstall software in the category of API Management. That is, if you want to be the very best. If you want to be mediocre, sure use some middleware that provides API, slap some API into your software so that customers that ask for API have API. Otherwise, engineer an external Application Programming Interface into your systems.
tptacek | 6 hours ago
https://news.ycombinator.com/item?id=50469719
lowkey_ | 6 hours ago
If you check the thread you linked, Apify isn't being transparent about what data was in the leak. Someone posted it from an email they received and allegedly got downvoted, and then a response from an Apify employee.
tptacek | 5 hours ago
TZubiri | 3 hours ago
radial_symmetry | 5 hours ago
WTF were they not already?
LunaSea | 5 hours ago
bombcar | 5 hours ago
0127 | 5 hours ago
gnabgib | 5 hours ago
TZubiri | 3 hours ago
But if you are building an API service, you don't need an API Management dependency. And it's an additional attack vector. You (as in an engineer or as a company that provides an API service) need to do the actual undelegable job of building an API, just do the work, do the HTTP server, do the rate limiting, do the OAuth integration.
Verdict: Time to uninstall software in the category of API Management. That is, if you want to be the very best. If you want to be mediocre, sure use some middleware that provides API, slap some API into your software so that customers that ask for API have API. Otherwise, engineer an external Application Programming Interface into your systems.