greenone

My bank sure encountered a bug: they're APIs are returning march 30th for some records.

the linear.app website crashes safari/ios when you zoom in on the first image (the one showing the app)

thats like saying "having a public website is an invitation to DOS-attacks"

there are conventions and reasonable expectations, until now I did not expect that a tracking-pixel would be the basis for crawling, so far most crawlers tend to crawl whats publicly linked, not whats potentially publicly reachable if one knows every url there is

to clarify:

- marketing wants some tracking, some developers adds it

- ecommerce websites in the real world tend to "need" these tracking/conversion codes

- you do have legitimate get-requests like password-reset links with tokens, also we do use payment providers who send the customers back to us with get links which include payment tokens, newsletter-unsubscribe links are also often simple token links

- and yes normally a get-request should not change anything (at least not when its just repeated) but the sheer fact that they have access to it _and_ are crawling it is bad

my point being that I find it that they would just crawl everything they recorded instead of just crawling pages which are linked publicly or which are targeted in ad-campaigns combined with the fact that they don't warn you about it

I did similar research for a project. one vendor looked better than all others. had a good documentation, extensive, versioned API... or so I thought. Documentation was old and incomplete, API breaks regularly without notice. So my advive: try to get infos from someone who already uses that vendor. I was very shocked and disappointed after 1 month.

there is a fundamental/conceptual/trust issue with every tool a freelancer uses: his business depends on it, others can look into it. period.

why should I trust the core of my business to you guys?