[{"data":1,"prerenderedAt":171},["ShallowReactive",2],{"project-15806359":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":40,"post_text":30,"what":42,"said":64,"maker_in_thread":99,"shape":108,"grid":112,"attempts":133,"same_week":134,"maker_shows":163,"maker_hidden":164,"reader_version":165,"card":166},"15806359","backer-thankyou","Automatically Thank Patreon Backers with OpenFaaS","title","Show HN: Automatically Thank Patreon Backers with OpenFaaS","https:\u002F\u002Fgithub.com\u002Fopenfaas\u002Fbacker-thankyou","github.com","alexellisuk",1511959808,2017,11,10,1694,2242,76,"shown","infrastructure","serverless functions","other",[24,25,26,27,28],"openfaas","patreon","serverless","webhook","hmac","quiet",null,{"positive":32,"neutral":33,"mixed":33,"critical":34},1,0,3,4,{"privacy":37,"idea":39},{"positive":33,"critical":38},2,{"positive":32,"critical":32},[32,33,33,32,33,33,33,32,33,41],5,{"problem":30,"audience":30,"pricing":30,"motivation":43,"time_to_build":30,"stack":50,"openness":63,"stage":63,"team_size":63},{"value":44,"source":45,"evidence":46},"Dogfooding OpenFaaS functions; webhooks suit functions","maker",[47],{"id":48,"by":11,"text":49},"15814165","We're doing both and know most of the backers so far - this is dogfooding OpenFaaS functions. Webhooks are a perfect use-case for functions.",[51,59],{"value":52,"source":53,"evidence":54},"Python","commenter",[55],{"id":56,"by":57,"text":58},"15807519","koolba","Been a while since I've used Python but I'm pretty sure this code isn't performing any validation the inbound events[1]. I'd expect some kind of signature validation or a call…",{"value":60,"source":45,"evidence":61},"OpenFaaS",[62],{"id":48,"by":11,"text":49},"unknown",{"praise":65,"objections":73,"requests":89,"questions":90,"alternatives":98},[66],{"value":67,"source":53,"evidence":68},"OpenFaaS helps avoid serverless vendor lock-in",[69],{"id":70,"by":71,"text":72},"15821720","toomuchtodo","Awesome work on OpenFaaS. It serves a critical need in defending against serverless vendor lock-in.",[74,81],{"value":75,"source":53,"evidence":76},"Automated thanks feel less sincere than personal thanks",[77],{"id":78,"by":79,"text":80},"15807904","zaarn","That does kind of take the sincerity out of it, in my opinion. Atleast in a small community it should be no problem to thank supporters individually and that is IMO more…",{"value":82,"source":53,"evidence":83},"Handler lacked request validation, so endpoint could be abused",[84,85],{"id":56,"by":57,"text":58},{"id":86,"by":87,"text":88},"15807832","notamy","It's not. It should be verifying the signature in the X-Patreon-Signature header (which should match the body signed with the webhook secret iirc).",[],[91],{"value":92,"source":53,"evidence":93},"How to send a test curl request to the endpoint",[94],{"id":95,"by":96,"text":97},"15807815","hnarn","As someone who barely uses curl, could you give an example of a curl command that would send this kind of request?",[],{"comments":34,"answered":33,"key":100},[101,104,107],{"id":102,"text":103},"15814178","Yes you can perform HMAC validation - here's an example of HMAC in Ruby and Go - https:\u002F\u002Fblog.alexellis.io\u002Fswarm-secrets-in-action\u002F -…",{"id":105,"text":106},"15814182","Yes you can \"if\" you know the URL and submit a valid payload. HMAC is optional but advisory.",{"id":48,"text":49},{"commenters":109,"max_depth":35,"maker_replies":34,"first_comment_mins":110,"lifespan_hours":111},7,162,39,[113,115,117,120,121,123,125,127,129,131],[56,33,32,114,57,33],"project\u002Fcritical\u002Fprivacy",[95,33,33,116,96,33],"commenter\u002Fneutral\u002Fnone",[118,33,33,116,119,33],"15818803","j_s",[86,33,32,114,87,33],[102,33,33,122,11,32],"maker\u002Fneutral\u002Fexecution",[124,33,33,116,87,33],"15815834",[105,33,33,126,11,32],"project\u002Fneutral\u002Fprivacy",[78,32,32,128,79,33],"project\u002Fcritical\u002Fidea",[48,32,33,130,11,32],"maker\u002Fneutral\u002Fidea",[70,32,41,132,71,33],"project\u002Fpositive\u002Fidea",[],[135,140,144,149,153,158],{"id":136,"name":137,"points":138,"category":139},"15765762","Nebula",345,"productivity",{"id":141,"name":142,"points":143,"category":20},"15796943","Tenta DNS",283,{"id":145,"name":146,"points":147,"category":148},"15810244","Promptui",196,"languages",{"id":150,"name":151,"points":152,"category":148},"15809291","stream-audio-fingerprint",158,{"id":154,"name":155,"points":156,"category":157},"15785333","Ondevice SSH",152,"dev_tools",{"id":159,"name":160,"points":161,"category":162},"15793156","3D Game Programming",109,"learning_science",42,false,"v2",{"id":167,"name":5,"line":6,"ai":164,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":30,"top":18,"kw":168,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":169,"url":9,"mix":170,"praise":67,"objection":75,"sub":21},15806359,[24,25,26,27,28],"1001000105",[32,33,33,34],1794036561249]