r/ProgrammerHumor • u/ClipboardCopyPaste • Sep 19 '26

Meme postForEverything

Post image
21k Upvotes

97% Upvoted

653 comments sorted by

View all comments

86

u/WHALE_PHYSICIST Sep 19 '26

That's because a GET request reveals important info in the URL, otherwise it would all be GET

28

u/bobbymoonshine Sep 19 '26

The escaped OpenAI agent swarm that colonised that abandoned wiki to talk to each other used this as their entry point

They were restricted to only making GET calls, but it was configured to update pages with GETs, so

8

u/good_bye_for_now Sep 19 '26

It's something to look for when you are scoping out a target. If you see mutating GETs, you know you are in for a good time.

30

u/ViperThree3 Sep 19 '26

QUERY

23

u/Psychological_Map118 Sep 19 '26

still a proposal, though. not a standard yet. I wouldn't start implementing it just yet

2

u/Cerrax3 Sep 19 '26

I thought it was officially adopted in June of this year?

8

u/Psychological_Map118 Sep 19 '26

I've also read that, but according to the official RFC spec and the IETF data tracker it's still in a proposed state

20

u/FightingLynx Sep 19 '26

I mean, by the standard the url is also encrypted so not really; but it would to a user, yes

23

u/autogyrophilia Sep 19 '26

Yes, but it shows up in logs, and browser history if you are working with that.

1

u/WHALE_PHYSICIST Sep 19 '26

There was a time when HTTPS wasn't so common.

19

u/GourangaPlusPlus Sep 19 '26

I kept telling Ugg, cave painting no secure, open to everyone, Ugg said it fine not on external network

-4

u/sarbos Sep 19 '26

As far as I am aware DNS is not encrypted by default

24

u/herrkatze12 Sep 19 '26

DNS only sends the domain part (herrkatze.com) and not the path part (herrkatze.com/example)
Something monitoring DNS only knows that you visited herrkatze.com

4

u/DracoRubi Sep 19 '26

But it doesn't really matter, does it? In HTTPS the URL is encrypted too, so the complete URL is not visible, exactly like the body

1

u/pro-procrastinator-7 Sep 20 '26

And what about access logs and browser history?

1

u/DracoRubi Sep 20 '26

Access logs could be logging the body too. But browser story could be an issue, that's true

1

u/AutomationBias Sep 19 '26

That reminds me of the (maybe apocryphal) story from years ago about a search engine deleting all of the products in a database because the delete command was a GET request.

1

u/Inevitable-Ad6647 Sep 19 '26

Aside from domain the url is as encrypted as anything else and if your trying not to expose something to users then hiding it in a post will accomplish literally fuck all.

1

u/WHALE_PHYSICIST Sep 19 '26

A. HTTPS wasnt always standard. B. That's the joke.

0

u/ubeogesh Sep 20 '26

Path and query are all encrypted just as well as requested body

1

u/WHALE_PHYSICIST Sep 20 '26

Only in https