20 ms·
Instagram took down private unofficial APIs via DMCA
- h1fra 7y agoYou can still find the implem in various language, like this one in js: https://github.com/dilame/instagram-private-api https://github.com/dilame/instagram-private-api
- coleifer 7y agoAnd GitHub bent over. Just host it somewhere else.
- paulgb 7y agoWhere? Pretty much anyone will honor a DMCA takedown. There might be some grey area where some hosts will be better at identifying an invalid/bad-faith one, but this one appears to be valid.
- notyourday 7y agoCounter-notice fixes it, making github restore it and giving Github immunity.
- slig 7y agoThat's a nice way to get legal problems with one of the biggest companies in the world.
- thejsa 7y agoGitHub waits fourteen days for the complainant to respond to your counter-notice before putting your repo back up, from experience :/ In addition, they won't even give you any info they hold on the complainant other than that explicitly included in the notice itself, claiming 'data protection' (some troll hit a bunch of my repositories with fraudulent takedowns in two waves, meaning it took about a month before they were all restored)
- asjw 7y agoOutside of the US The world is a pretty large place...
- coleifer 7y agoGit has an amazing variety of frontends and ways to distribute your code.
- CarelessExpert 7y agoOn your own web server? You don't need GitHub to publish or host a git repo...
- dewey 7y agoYour own webserver that's hosted by a hosting company? Most of the have very well oiled workflows for responding to DMCA violations. If you run your own server they'll go to your ISP.
- CarelessExpert 7y agoAre you aware that companies in countries like Canada don't respond to DMCA takedown requests, nor do they have domestic equivalents?
- dewey 7y agoMaybe not 100% identical to the DMCA takedown requests but there are systems in place to deal with these kinds of issues. If your hoster / ISP receives a bunch of these notices they'll probably reconsider hosting your content. https://ic.gc.ca/eic/site/oca-bc.nsf/eng/ca02920.html https://ic.gc.ca/eic/site/oca-bc.nsf/eng/ca02920.html
- CarelessExpert 7y agoValid point. Bill C-11 certainly made a mess of the situation in Canada. That said, there are plenty of other international jurisdictions where a server or VPS could be used to host this kind of content, so I think the fundamental point still remains: Yes, hosting content on a large US-based provider like GitHub means your content is available at their discretion. Hosting the content yourself gives you a much greater degree of freedom to control the availability of that content. Which is why I never rely solely on commercial cloud services like this for hosting my content.
- deleted 7y ago[deleted]
- vanous 7y agoThis is why codeberg was started. https://codeberg.org/ https://codeberg.org/
- tpmx 7y ago> And GitHub bent over. You mean Microsoft bent over. Legal is the first and most urgent part to integrate when aquiring a company, for obvious reasons.
- maxerickson 7y agoChoosing not to involve themselves in legally representing a user is not comparable to submissive participation in a sex act. There's also nothing wrong with submissive participation in a sex act. Communicate better.
- coleifer 7y agoWhat?
- maxerickson 7y agoIt may not be the meaning you intended, but "GitHub bent over." has a pretty clear, narrow definition.
- davidtranjs 7y agoEven Bitbucket would follow DCMA requests. Beside that, Github is the best place for the visibility of your project .
- vga805 7y agounofficial APIs or unofficial documentation about the APIs? what exactly was this, and if the latter, are the APIs still available?
- Nextgrid 7y ago“API” is a weird term to use in this context as it’s not actually an API server or anything like that. This is just an HTTP client for Instagram’s mobile app API.
- g4k 7y ago"This is a PHP library which emulates Instagram's Private API. This library is packed full with almost all the features from the Instagram Android App. This includes media uploads, direct messaging, stories and more." https://web.archive.org/web/20191207221404/https://github.com/mgp25/Instagram-API https://web.archive.org/web/20191207221404/https://github.co...
- rcaught 7y agohttps://web.archive.org/web/20191207221404/https://github.com/mgp25/Instagram-API https://web.archive.org/web/20191207221404/https://github.co... > Why did I make this API? > After legal measures, Facebook, WhatsApp and Instagram blocked my accounts. In order to use Instagram on my phone I needed a new phone, as they banned my UDID, so that is basically why I made this API.
- pmlnr 7y agoAnyone has the actual git repo as well?
- segmondy 7y agoIf you fork git repos, make sure to pull them down, if the official repo is taken down, your forks will disappear unless you have a copy. Here's a script I made to backup all your repos, throw it into a cron and run once a month or something, where 20 is the largest number of pages you have, adjust accordingly. I actually wrote this up when a fork I had disappeared. #!/bin/bash USERNAME='segmond' for i in `seq 1 20`; do curl --fail -s https://api.github.com/users/$USERNAME/repos?page=$i | jq '.[] | .clone_url' | xargs -t -n1 git clone sleep 1 done
- dicytea 7y ago> if the official repo is taken down, your forks will disappear unless you have a copy. https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/what-happens-to-forks-when-a-repository-is-deleted-or-changes-visibility https://help.github.com/en/github/collaborating-with-issues-... I don't think that's true, I've personally recovered deleted repositories by finding its forks. edit: Ah never mind it seems things work differently in the case of DMCA takedowns
- AdamJacobMuller 7y agoThere is also a big difference between clicking `fork` on github vs cloning and creating a new repository (on github) and then changing the remote URL and pushing. The latter isn't "github fork" even if it is a "git fork" and won't be affected by most[1] automated takedowns. 1> where most is defined as somewhere between 0 and 100%
- thefounder 7y agoIsn't the google vs oracle still on? How did github rule that apis are copyrighted?
- dkarras 7y agoI think with how DMCA works, Github doesn't have to (or need to) rule one way or another. Someone sends a notice and it is taken down swiftly. If the owner thinks this was in bad faith or a mistake, they can challenge it but if you are not absolutely sure that you can win such a claim you better talk to a lawyer first.
- notyourday 7y agoOwner needs to send a counter-notice. Github will have to restore it. FB will be forced to take owner to court but the repo will stay up until court decides
- wpietri 7y agoEasy to say. But I'd be hesitant to invite a lawsuit from a company with infinite money, a predatory attitude to their users, and a proven willingness to spend arbitrary sums of money to maintain their quasi-monopoly.
- ethanwillis 7y agoSomeone has to stand up to them at some point and we should support them when they do. The fact that they're willing to just throw tons of money at lawyers to be wrong and infringe on everyone else's rights is exactly the reason we should make them take us to court on principle.
- jrockway 7y agoIt is an important enough case that someone with money will probably help out. Of course, they might not, and then you're screwed. My understanding is that Google bought YouTube mostly to avoid an underfunded YouTube in legal trouble having a bad precedent set. If Facebook thought they could win against Google or Apple, they would have sent DMCA letters to Google and Apple for making web browsers and phone emulators with "developer tools" built in. But they know they'd lose, so they went after some random person on the Internet with no money.
- mCOLlSVIxp6c 7y agoLooks like this is the takedown request: https://github.com/github/dmca/blob/master/2020/01/2020-01-22-facebook.md https://github.com/github/dmca/blob/master/2020/01/2020-01-2... The core allegation is: > Mgp25’s Instagram-API repository (and its forks) offers a tool expressly designed to circumvent the Company’s effective access controls and protection measures by avoiding, bypassing, removing, deactivating, or impairing the Company’s technological measures without the authority of the copyright owners or the Company. Mgp25’s Instagram-API is designed to emulate the official Instagram mobile app when communicating with Instagram’s servers, which allows users of mgp25’s Instagram-API to send and receive data (including receiving legitimate, copyrighted posts by Instagram’s users) through Instagram’s private API. Mgp25’s Instagram-API also permits other types of access to, and collection of, Instagram’s users’ copyrighted works in manners that exceed the scope of access and functionality that would be permitted by a user with a legitimate, authorized Instagram account.
- wpietri 7y agoIs this legally a legitimate reason for a DMCA request? That it's a tool that could be used to bypass copyright controls? It's been a long time since I read it, but my understanding of the DMCA is that you need to claim an actual copyright violation on the thing being taken down. This sounds like a claim of contributory copyright infringement, which a) I don't remember being covered by DMCA, and b) there's a reasonable claim here for substantial non-infringing use, so I'm not sure contributory copyright infringement really applies.
- deleted 7y ago[deleted]
- saurik 7y agoThis is about Section 1201, one of the most interesting parts of the DMCA, which is about banning circumvention devices. What is confusing me is that I am under the impression that the DMCA "takedown" process (which I know quite little about, to be fair) was unrelated to the anti-trafficking provisions (which I do stare at a lot), so I don't think this is a valid request (even if it were a valid lawsuit... though I frankly doubt that either as I don't think an "access token" can be considered an "effective TPM"). (I am not a lawyer, but I spend an unreasonable amount of my time staring at Section 1201 issues; if anyone needs legal advice they should contact a lawyer: nothing I say should possibly be construed as legal advice.)
- enterabdazer 7y agoI don't know the details of the code, so I'm left with questions. Is the only difference between using this library and using Instagram's mobile app the fact that the library is not the "right" web browser? Isn't the library simply a different web client accessing a publicly available API? And requests from the library are properly authenticated / authorized by Instagram's servers through normal means (the library isn't bypassing some mechanism, it's just not the official app)? If it's true that it's just a different API client, then there may be some TOS violation, but isn't DMCA an overreach? Is there any validity to the claim?
- buckminster 7y agoA TOS violation is an unauthorised access which is a federal crime. See, for example, the case of Aaron Swartz. Using the DMCA seems preferable. Changing these laws would be better still.
- capableweb 7y agoSo if I put "If you visit the website, you owe me 5 USD" in my Terms of Service, I can have them arrested? Something feels very fishy here, has to be more conditions than just "TOS violation === federal crime"
- buckminster 7y agoThe difference is in what you can convince an investigator, a prosecutor and a jury to take seriously.
- Keverw 7y agoI know it's been interpreted as that under the CFAA, but I know there was a recent case regrading scraping so sounds like that that interpretation isn't true anymore. There was an debate between lawyers saying that sharing passwords for streaming services like Netflix, HULU, Spotify, etc with family could be seen as a federal crime too in theory if companies wanted to push it under that law but no actual lawsuits as far as I know.
- thosakwe 7y agoIANAL. I'm also assuming this was an HTTP client library. How could this possibly be a violation of copyright, if it's just a client that accesses their API? Their API is not truly "private," just undocumented. If you distribute a free app that calls a remote API over users' networks, you can't make the case that it's private, because it's clearly accessible from every network/connection/device. Something exposed to the public cannot simultaneously be private. At least, maybe the author's lawyer could argue the above in court. Among many things I hate about the DMCA, it's that hosts have basically no option other than to respond to takedown requests by actually taking down the content in question, for fear of litigation. It just rubs me the wrong way.
- mkagenius 7y agoWhat if such an open APIs cause a loss to the business, is it still legal? Coz then intent can be thought of as a bad one? Edit: people are assuming too much about my intent of this question and downvoting, I was just curious, moreover a good answer to this will make the case stronger against Instagram/Fb.
- ikeboy 7y ago>Among many things I hate about the DMCA, it's that hosts have basically no option other than to respond to takedown requests by actually taking down the content in question, for fear of litigation. That's the entire point. A DMCA takedown request is supposed to lead to the content being taken down. The person who uploaded it can send a counternotice, which will lead to the content being put back up if no lawsuit is filed. What would you change about the system? Should rights owners have no recourse short of litigation to get their content taken down?
- Semaphor 7y ago> What would you change about the system? 3 strikes and you are out. Take down 3 obviously (probably decided by a judge) non-infringing things and you lose the ability to send takedowns.
- 7y ago
- mddanishyusuf 7y agoNow facebook developers' app approval is so hard. I submit 6 times to review and every time reviewer point a mistake. I'm building for a tool that sets up a third party API gateway for your 3rd party applications APIs. https://nocodeapi.com https://nocodeapi.com
- 1hakr 7y agoAwesome! I love this tool. What were you doing all these days.
- mddanishyusuf 7y agoThanks, I'm adding lot's of applications and here are the list you can find them https://nocodeapi.com/marketplace https://nocodeapi.com/marketplace
- todd8 7y agoLooks very useful. I like your landing page, it nicely designed, works great on a phone, and communicates clearly. A tiny suggestion, it looks like a typographical error slipped though in the sentence: > Convert these applications APIs without any hustle and Power-up your products, tools & portfolio by these NoCodeAPI. I think you meant to use the word “hassle” instead of “hustle” as it would be a bit more idiomatic in the sentence.
- mddanishyusuf 7y agoThanks, todd8 for the catch. I'm working on the content. stay tuned.
- capableweb 7y agoSince you're advertising your product in a thread about Instagram, I thought your product would work with Instagram, but trying it I get "Insufficient developer role". Not sure if it's a bug or just not implemented yet.
- Nextgrid 7y agoDoes anyone have a mirror? I might download this and keep it just in case.
- shervinshaikh 7y agoYes I would like a copy too :)
- sbr464 7y agoSome of the forks[1] still work, although outdated. There are some on gitlab[2] also. Doing code searches finds other copies[3]. [1] https://github.com/NantipatSoftEn/Instagram-API https://github.com/NantipatSoftEn/Instagram-API [2] https://gitlab.com/alihesari/Instagram-API https://gitlab.com/alihesari/Instagram-API [3] https://github.com/DarriusAlexander/speaklight/tree/1b4167c3164a8fd1e1779410a61e2841c89ce386/wordpress/wp-content/plugins/social-auto-poster/includes/social/libraries/instagram/mgp25/instagram-php https://github.com/DarriusAlexander/speaklight/tree/1b4167c3...
- zodiakzz 7y agoYou can still install it using the Composr package manager: https://packagist.org/packages/mgp25/instagram-php https://packagist.org/packages/mgp25/instagram-php
- circular_logic 7y agoIf this developer had reversed engineered some documentation about the private API could that also receive a DMCA?
- deleted 7y ago[deleted]
- qes 7y agoYes. I could publish the source code of, say, my access control system, along with instructions on how it could be bypassed, but yet if you use those instructions to bypass it, that is a violation of the DMCA.
- KaiserPro 7y agoIn the author's own words, this API was explicitly designed to get round access controls. (see internet archive) So people should be cheering this no? I mean facebook are protecting their users from nefarious developers seeking to get access to people's data. The only crit is that it took so damn long to find it. (since 2016!) https://web.archive.org/web/20160603201221/https://github.com/mgp25/Instagram-API https://web.archive.org/web/20160603201221/https://github.co... I know thats not whats annoyed most people. But if facebook really are serious about privacy, then they took too damn long
- the_gipsy 7y agoThey should make their APIs secure, instead they abuse DMCA.
- slimed 7y agoExactly. All they did was remove an open source repository. It's still trivial to access their services in a way that they admit is harmful to their customers' privacy. As a bonus, now it's on the front page of Hacker News. It's almost as if they're making the same error as OP who identified the library as "an API" rather than a client of an insecure API implemented by Instagram. Presumably they know better.
- amylene 7y agoPerfect is the enemy of good. And we don’t know what work they’re doing on the engineering side. What if it turns out they detected this code was run by other people and responsible for 50% of the unauthorized access? Just because it doesn’t entirely solve the problem, does not mean they shouldn’t pursue all partial tactics.
- slimed 7y agoThe problem is that they are abusing a statute that we all know is harmful more generally and creating precedent for others to do it.
- deleted 7y ago[deleted]
- heavyset_go 7y agoWhat's the difference between scraping while circumventing anti-scraping measures, which certain circuits have upheld as being legal, and what this unofficial API client did? This is an honest question, and not a rhetorical one.
- filoleg 7y agoThat was my first thought upon seeing this post. Given the LinkedIn scraping decision earlier this week, i would think that this one should be in the clear.
- SergeAx 7y agoScraping is getting data, which are publicly available. Using API is a) getting data behind login, which I am not sure if is covered by LinkedIn lawsuit, and also b) posting data to the app: likes, comments and so on.
- tylergetsay 7y agoQuestion, is there any way to design an API such that it can't just be reversed into a new client library like this? Certificate pinning makes it harder to MITM but that's trivial to disable.
- taytus 7y agoIf you create a door, that door is going to be used to enter and to exit.
- SergeAx 7y agoExcept if you add a lock)
- shirshak55 7y agoeven with that you can use key to open the lock and key has to be stored somewhere and end user can always get it right?
- georgiecasey 7y agotheoretically no, but snapchat do a damn fine job of locking accounts that use iphone tweaks. it's not perfect but they seem to create enough FUD that people are wary to use them.