Howdy.

Back in 2019 I reverse engineered the lyft bikes api to unlock them from my bed. It's one of my favorite stories, and after telling it dozens of times I finally decided to write it up in its full technical glory.

I used to love learning about security through blog posts/writeups, so I tried to include as much detail as possible. Let me know if you like this style!

▲

spydum 6 hours ago | parent | next [-]

Believe it or not, straight to jail! Just kidding, great writeup. I know it's not groundbreaking, but does surprise me how many products don't bother with rate limiting controls.

	▲	ibigio 3 hours ago \| parent [-]
		i actually think a quick-fix was setting a rate limit. which sadly thwarted my brute-forcing, but did not actually fix the race condition itself. though it's a very fair "kid, stop it" response until they fixed the race condition.

▲

5 hours ago | parent | prev [-]

[deleted]