Hacker News Reader

If you have a lock with no keys, it's a non-starter; the door has no purpose. You'd be better off sealing the entrance with bricks.

If you offer a website with an API then CORS is an enhancement in that you're helping protect users from getting owned or hijacked. Alternatively if you can't stomach the risk, you could take down your API, which is about as useful as solving a math equation by multiplying both sides by zero.

View on HN

"Lock with no keys" isn't particularly uncommon. They exist in the real world as one-way devices.

There's a while saying dedicated to it, "lock them up and throw away the key".

Hahah, alright. I'll grant you that. The lock:CORS metaphor was tenuous at inception, and now it is truly vaporized.

Notice how nobody ever does that with an actual lock. It's a metaphor for never letting them go free.

Reply on news.ycombinator.com