Shotout to our hacker friend

pingu

True story, checked the logs and someone is making billions of GET requests to /v1.2/server/info hoping to find information about servers that does not belong to them. Fren, if you read this, you need a api key or you'll get a nice shiny 404 error no matter if the server exist or not, as if the system would leak that sort of information.

Come-on man, you're smart. Try making a api key first, you need bcrypt+sha256, or was it sha512+bcrypt times 3 with 12 in difficulty... I forgot, remind me when you figure it out. 🤡 Honk Honk 🤡

Pepe_The_Frog

Poor guy, is he a customer? because that would be ironic 👌

Orson_Deforest

Doesn't sound very smart to me, I thought all error responses where the same, just to prevent hackers from learning about existing and non existing servers. Because if they knew, they could use some social engineering. I tried it myself, it would be impossible to generate such list, hence a complete waste of time to brute force that endpoint.

JesseWells

Orson_Deforest I think that's the point, notice the sarcastic tone. And yes, it seems all the api functions are bullet proof, no useful leaks whatsoever, central authentication and fully synchronous by design.