3 ms·

In the author's own words, this API was explicitly designed to get round access controls. (see internet archive) So people should be cheering this no? I mean f

In the author's own words, this API was explicitly designed to get round access controls. (see internet archive) So people should be cheering this no? I mean facebook are protecting their users from nefarious developers seeking to get access to people's data. The only crit is that it took so damn long to find it. (since 2016!) https://web.archive.org/web/20160603201221/https://github.com/mgp25/Instagram-API https://web.archive.org/web/20160603201221/https://github.co... I know thats not whats annoyed most people. But if facebook really are serious about privacy, then they took too damn long

the_gipsy 7y ago
They should make their APIs secure, instead they abuse DMCA.
- slimed 7y ago
  Exactly. All they did was remove an open source repository. It's still trivial to access their services in a way that they admit is harmful to their customers' privacy. As a bonus, now it's on the front page of Hacker News. It's almost as if they're making the same error as OP who identified the library as "an API" rather than a client of an insecure API implemented by Instagram. Presumably they know better.
  - amylene 7y ago
    Perfect is the enemy of good. And we don’t know what work they’re doing on the engineering side. What if it turns out they detected this code was run by other people and responsible for 50% of the unauthorized access? Just because it doesn’t entirely solve the problem, does not mean they shouldn’t pursue all partial tactics.
    - slimed 7y ago
      The problem is that they are abusing a statute that we all know is harmful more generally and creating precedent for others to do it.
keyrat 7y ago
I've been using the API for a personal project, and it doesn't let you access anything that you couldn't access in the app. It was just an API you could use instead of scraping the site. That mention in the readme from 2016 mentions a UUID banned from Whatsapp, so I'm not sure if that's what the author meant or just something copied from another readme. Either way, if Instagram was banning UUIDs it would be as trivial as getting another phone to bypass it, or to log in via a web browser.

the_gipsy 7y ago

They should make their APIs secure, instead they abuse DMCA.

slimed 7y ago
Exactly. All they did was remove an open source repository. It's still trivial to access their services in a way that they admit is harmful to their customers' privacy. As a bonus, now it's on the front page of Hacker News. It's almost as if they're making the same error as OP who identified the library as "an API" rather than a client of an insecure API implemented by Instagram. Presumably they know better.
- amylene 7y ago
  Perfect is the enemy of good. And we don’t know what work they’re doing on the engineering side. What if it turns out they detected this code was run by other people and responsible for 50% of the unauthorized access? Just because it doesn’t entirely solve the problem, does not mean they shouldn’t pursue all partial tactics.
  - slimed 7y ago
    The problem is that they are abusing a statute that we all know is harmful more generally and creating precedent for others to do it.

keyrat 7y ago

I've been using the API for a personal project, and it doesn't let you access anything that you couldn't access in the app. It was just an API you could use instead of scraping the site. That mention in the readme from 2016 mentions a UUID banned from Whatsapp, so I'm not sure if that's what the author meant or just something copied from another readme. Either way, if Instagram was banning UUIDs it would be as trivial as getting another phone to bypass it, or to log in via a web browser.