4,484 karma · joined February 2, 2009
This was a great summation.
I wish Fedor and everyone at Cirrus the best of luck and OpenAI and thank them immensely for the years of free CI they gave to us in the Pony programming language despite it not having any marketing value to them.
I work at Antithesis now so you can take that with a grain of salt, but for me, everything changed for me over a decade ago when I started applying PBT techniques broadly and widely. I have found so many bugs that I wouldn't have otherwise found until production.
I'd say that almost no one should work with the major technical publishers more than once. There's some good basic skills you learn but otherwise, they contribute very little that you couldn't get done on your own.
An adversary is going to utilize more than a single query. It mostly protects against well intentioned folks.
Other forms of protection such as rate limiting are needed for threat models that involve an adversary.
The same problems exist with REST but there it is easier as you can know query complexity ahead of time at end points. GraphQL has to have something to account for the unknown query complexity, thus the additional heuristics.