RequestBin

» see requestb.in as it lived, on the wayback machine

~ the last words ~

You loaded requestb.in and clicked one button, and it handed you a URL. Anything sent to that URL got caught and displayed in the order it arrived, headers and body both. There was no account and nothing to install, so it became the fastest way in the world to find out what a webhook was actually sending, as opposed to what its documentation said it sent.

The archive holds a working homepage on 16 March 2018, 3,715 bytes of it, and four days later the apex had turned into a redirect. At 20:00 UTC on 20 March somebody posted the bare domain to Hacker News under the title "RequestBin discontinued their hosted service." The notice Runscope left in its place said the service had gone "due to ongoing abuse that made it very difficult to keep the site up reliably", followed by instructions for running your own copy.

Runscope had changed hands six months earlier. CA Technologies announced the acquisition on 28 September 2017, folding the API monitoring business in beside BlazeMeter. The shutdown notice does not mention any of that, and nothing public connects the two. The record holds only the sequence. Bought in September, and by March the free thing it was best known for had stopped answering.

~ the record ~

~ the donate box ~

The oldest copy the archive holds, from 8 January 2012, has a Beta badge in the header and a row of links reading Home, Download, API, Source, Discuss, Donate. Under the last one: "Consider donating to help support RequestBin and prove that we can sustainably run these kinds of public services for the community." The footer says copyright Jeff Lindsay, 2011. Six years later the sentence got its answer, and the answer came from the abuse side of the ledger.

~ what abuse looks like on an open endpoint ~

Malice was never required. A bin had no owner on either side of the URL, so there was nothing about it that could be rate-limited to a person. The accounts that circulated afterwards settle on two shapes, both of them ordinary: production systems pointed at a bin and then left running for months, and clients firing at volumes the service had never been sized for. Neither one looks like an attack from the inside. Both of them cost the same as an attack.

An account requirement gives you somebody to throttle and somebody to email. It also removes the entire reason the tool got reached for. You could be reading a request fifteen seconds after deciding you needed to see one.

~ what the readme kept saying ~

By 10 May 2018 the domain answered a 301 pointing at github.com/Runscope/requestbin, anchored to the README. The last thing the service did was hand you its source code. That repository now returns 404. The ownership around it kept moving in the meantime. Broadcom bought CA in 2018 and the Runscope platform was folded into BlazeMeter the following July. Perforce bought BlazeMeter in 2021.

The domain itself kept working as a signpost. Point a browser at requestb.in today and it lands on Pipedream, which built a hosted replacement under the requestbin.com name at the end of 2018 and has been carrying the old traffic since.

~ the forks that kept the credit line ~

The code outlived every host it ever had. GitHub still carries working copies under Unity Technologies, Insurance Zebra, apaleo and a dozen individual accounts, some of them pushed years after the hosted service went away. Their descriptions are all the same sentence, copied forward from a repository that no longer exists: "Inspect HTTP requests. Debug webhooks. Originally created by @progrium."

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »