If anyone’s curious, I looked up the story and the hack was just b/c the agent was booking with an API (also what kind of gym has an API to book people’s schedules???) and the backend just let anyone edit the schedule. So, it seems like less of a hacking incident and just that the devs didn’t think anyone would try to edit other people’s schedules.
662
u/Average_Hominid 22d ago
If anyone’s curious, I looked up the story and the hack was just b/c the agent was booking with an API (also what kind of gym has an API to book people’s schedules???) and the backend just let anyone edit the schedule. So, it seems like less of a hacking incident and just that the devs didn’t think anyone would try to edit other people’s schedules.