4 ms·

Open apis pretty much ruin honest competition, leaderboards, live races, etc. People already game metrics on their pelotons to get top 10 in races, and I don’t

by soared 6y ago

Open apis pretty much ruin honest competition, leaderboards, live races, etc. People already game metrics on their pelotons to get top 10 in races, and I don’t think companies want to deal with that on a larger scale. It’s a great idea, but I don’t think it’s always the right idea.

newsclues 6y ago
Closed systems are unhackable or cheat proof? I don’t think so
- _jal 6y ago
  Is your dwelling impossible to break in to? I don't think so. I also think it doesn't have to be.
  - TeMPOraL 6y ago
    Your dwelling's locks also have an open API (well, HPI) - most commonly, you stick a funnily twisted bit of metal into it, and then turn it until it unlocks. There are many things that make regular locks effective at preventing unauthorised entry to your house. Ability to access the lock is not one of them, and neither is knowledge about its principle of operations.
- JadeNB 6y ago
  It's even better than that—closed systems are hackable and vulnerable to cheating, and it's in their peddler's (as opposed to pedallers' …) interest to make sure that you don't know about the vulnerabilities of which they are aware.
  - fortran77 6y ago
    Why are cyclists so prone to cheating? See: https://www.bicycling.com/racing/a20020140/are-tour-de-france-racers-cheating-with-secret-motors/ https://www.bicycling.com/racing/a20020140/are-tour-de-franc... and https://en.wikipedia.org/wiki/Doping_at_the_Tour_de_France https://en.wikipedia.org/wiki/Doping_at_the_Tour_de_France
deadbunny 6y ago
Not sure I follow your argument, if people are already cheating how would an open API be any different/worse?
xoa 6y ago
The issue of cheating is genuinely valid one, but so is being able to use the hardware with a variety of software. And in this case, are you sure open APIs are actually in conflict? "Open" doesn't have to mean "forgeable", wouldn't it be possible to have a fully open and documented bike API that also cryptographicly signed output? Software could choose to not care about the signature and just run off the API directly, or to require a signature from a specific set of manufacturer keys, or for that matter both (why not support both casual groups and competitive ones depending on what users want?). Obviously for hardcore competitive types it'd still come down to the security and gameability of the hardware itself, and even if it was fairly solid it'd still mostly be about discouraging lazy cheaters, since as far as home use goes nothing stops someone from attaching an electric motor or something if they really want to screw with things. But I don't think full open APIs any software can use in this case precludes getting as much security as is possible to get out of the software/electronics side of things. And full open APIs would be super useful for longevity, variety of use, etc.
- ThePowerOfFuet 6y ago
  Disconnect the pedals, attach electric motor, bam: cryptographically-signed leaderboard cheating.
  - elliekelly 6y ago
    Is anything stopping someone from doing that with the Peloton hardware? I could absolutely motorize my pedaling if I wanted to (I wouldn’t even need to touch the API!) but it would defeat the entire purpose of buying the bike in the first place: exercise.
    - usrusr 6y ago
      Usually when you want to cheat in virtual races you simply claim to be 20 kg lighter than you actually are. No need for a protocol hack or motors.
  - tux1968 6y ago
    Not really relevant though, since that's true whether the API is open or not.
djmips 6y ago
This whole article showed how to hack a closed system. Closed APIs clearly don't prevent cheating and that's not why they exist.
sukilot 6y ago
Who cares? It's an exercise bike. If the high score is what you want you can play a video game.

by soared 6y ago

newsclues 6y ago

Closed systems are unhackable or cheat proof? I don’t think so

_jal 6y ago
Is your dwelling impossible to break in to? I don't think so. I also think it doesn't have to be.
- TeMPOraL 6y ago
  Your dwelling's locks also have an open API (well, HPI) - most commonly, you stick a funnily twisted bit of metal into it, and then turn it until it unlocks. There are many things that make regular locks effective at preventing unauthorised entry to your house. Ability to access the lock is not one of them, and neither is knowledge about its principle of operations.
JadeNB 6y ago
It's even better than that—closed systems are hackable and vulnerable to cheating, and it's in their peddler's (as opposed to pedallers' …) interest to make sure that you don't know about the vulnerabilities of which they are aware.
- fortran77 6y ago
  Why are cyclists so prone to cheating? See: https://www.bicycling.com/racing/a20020140/are-tour-de-france-racers-cheating-with-secret-motors/ https://www.bicycling.com/racing/a20020140/are-tour-de-franc... and https://en.wikipedia.org/wiki/Doping_at_the_Tour_de_France https://en.wikipedia.org/wiki/Doping_at_the_Tour_de_France

deadbunny 6y ago

Not sure I follow your argument, if people are already cheating how would an open API be any different/worse?

xoa 6y ago

The issue of cheating is genuinely valid one, but so is being able to use the hardware with a variety of software. And in this case, are you sure open APIs are actually in conflict? "Open" doesn't have to mean "forgeable", wouldn't it be possible to have a fully open and documented bike API that also cryptographicly signed output? Software could choose to not care about the signature and just run off the API directly, or to require a signature from a specific set of manufacturer keys, or for that matter both (why not support both casual groups and competitive ones depending on what users want?). Obviously for hardcore competitive types it'd still come down to the security and gameability of the hardware itself, and even if it was fairly solid it'd still mostly be about discouraging lazy cheaters, since as far as home use goes nothing stops someone from attaching an electric motor or something if they really want to screw with things. But I don't think full open APIs any software can use in this case precludes getting as much security as is possible to get out of the software/electronics side of things. And full open APIs would be super useful for longevity, variety of use, etc.

ThePowerOfFuet 6y ago
Disconnect the pedals, attach electric motor, bam: cryptographically-signed leaderboard cheating.
- elliekelly 6y ago
  Is anything stopping someone from doing that with the Peloton hardware? I could absolutely motorize my pedaling if I wanted to (I wouldn’t even need to touch the API!) but it would defeat the entire purpose of buying the bike in the first place: exercise.
  - usrusr 6y ago
    Usually when you want to cheat in virtual races you simply claim to be 20 kg lighter than you actually are. No need for a protocol hack or motors.
- tux1968 6y ago
  Not really relevant though, since that's true whether the API is open or not.

djmips 6y ago

This whole article showed how to hack a closed system. Closed APIs clearly don't prevent cheating and that's not why they exist.

sukilot 6y ago

Who cares? It's an exercise bike. If the high score is what you want you can play a video game.