• 0 Posts
  • 55 Comments
Joined 3 years ago
cake
Cake day: June 16th, 2023

help-circle















  • Had a coding firm costing 1k+ euros which was unfamiliar with django select all() from DB just to cast that into a list each time a user opens the tool. That got real funny real fast when the customer started adding the announced 50k objects per day. They did that buried in about 50-60 api endpoints conveniently coded by hand instead of using genetic api endpoints available from django rest framework.

    When the loading times hit 50s per click, the company took the money and ran. My colleagues and me spent 2 years and half that to fix that shit.





  • Ask them to generate a schema file that you can download from the api. Or at least an endpoint that returns a hash of the current api schema file. That’s cheap versioning telling you if something changes.

    You can always use the swagger schema to verify the api. So ask some basic questions what should always be true and put that into validation scripts. If they use a framework, HEAD requests usually tell you some things.

    Last really bad vendor had an openapi page that listed the endpoints but the api wouldn’t adhere to the details given there. I discovered that their website used the api all the time and surfing that i was able to discover which parameters were required etc.

    Last idea is statistics. Grab any count data you can get, like from pagination data and create a baseline of available data over time. That gives you an expected count and you can detect significant divergences.

    I tend to show up at the vendors it guys in person and bribe them into helping me behind their bosses backs. Chocolate, coffee and some banter can do wonders.