Are All Your APIs Insecure?

apichangelog.substack.com

1 pointbpedro2 comments

This is a pitch for some sort of automatic behavior-based API blocking service:

> companies should be able to detect suspicious API usage patterns and take adequate measures to prevent the escalation of an attack

I guess this depends on API, and is potentially pretty dangerous. I would hate for my account to be blocked because we deployed new version and now usage patterns are different.

That's a great point, and that's why I explicitly used the word suspicious. If you deploy a new version, then the tool you use to detect suspicious activity should take that into account.

And no, this is not a pitch. I don't work nor am endorsed by any of the services mentioned in the article.

Reply on news.ycombinator.com