4 ms·

I used to do this exact thing as a job, and it's crazy how little US brokers do to protect their APIs (at least back when I was doing it around 2015), given the

I used to do this exact thing as a job, and it's crazy how little US brokers do to protect their APIs (at least back when I was doing it around 2015), given the security implications. I'm not even a hacker and I was able to reverse engineer 90% of the US brokerages without a problem. Compare that to Singapore. I spent about an hour toying with the Lim & Tan API before our account got shut down. Apparently the fucking CTO was woken up in the middle of the night by all the alarm bells I set off lol. edit: when I say "without a problem", I mean that in relative terms. We got plenty of strongly-worded letters asking us to stop, and they played whack-a-mole with our instances. But we never faced a serious challenge to what we were doing.

timothygoltser 5y ago
We've had the same experience in 2022. An afternoon with an HTTPToolkit interceptor is usually all it takes to reverse engineer a brokerage's API; we spend most of our time paving over various brokerage-specific idiosyncrasies and responding to breaking changes in their APIs. We've discovered that building sane abstractions over the various retail brokerages in the US is a hard design problem given the variability in supported assets, account types, order strategies, authentication strategies, etc. Thankfully we haven't had to field any calls from irate, sleep-deprived CTOs yet - running experiments against APIs during local business hours only could be a good hack for avoiding those :)