Hacker News Reader

I'm generally with you, but I do hope that this tarring and feathering will drive home one point:

Don't trust the client.

The user ID in the URL like this is a giant "try editing me and see what happens" sign, even if you came with no intention of providing unsolicited pen testing. I seriously doubt just this one person noticed.

View on HN

"The user ID in the URL like this is a giant "try editing me and see what happens" sign"

What's really surprising is that apparently the dev on this never viewed any porn on the internet.

Could you elaborate? I fail to see the connection.

Not sure what the parent is referring to, but back in the day you'd have porn preview galleries with no index, but with an easily enumerable id in the URL. Ah, youth...

You are correct.

Reply on news.ycombinator.com