16 ms·

Why should 3rd parties be allowed to make unauthorized api requests? Additionally, some apps are only monetized through advertisement, and 3rd party apps don't

• xmodem 4y ago
  The 3rd party is not making the API request though. I am, just using software that didn't come from the platform vendor. Many 3rd party twitter clients have expressed a willingness to display ads if provided an API to do so. As someone who has lost precious accessibility capabilities because of restrictions on 3rd party clients, I unfortunately have to point out that I don't really have a choice of what platforms I do or don't interact with in a lot of cases. I wouldn't stay at my job for very long if I didn't tolerate Slack's BS, for instance.
  • fzeroracer 4y ago
    Let me offer you a question then: Do you know how much data the OG App is taking from you while you authorize it to work on your behalf? How do you know it's not reading through your entire message history? Or building its own network graph of your friends to sell? How about security? How do you know it's securely storing your credentials? Or that it's not selling said credentials as well? Like in this scenario to Facebook it is in theory effectively you. Not the app operating on behalf of you with a limited set of permissions.
    • josephcsible 4y ago
      Sure, there's a risk there. But it should be my choice whether or not to accept that risk, not Meta's.
      • fzeroracer 4y ago
        In this case the risk you take doesn't matter (though I argue from a security standpoint this is something you should really care about in any argument around Meta), it's the risk Meta takes by allowing it. Because if the company takes your data and runs, Meta is the one also on the hook for not securing their APIs. If it turns out they're farming passwords from users to sell to whatever group ultimately the class action lawsuit will come out with knives facing Meta. Like this is a security problem, straight up. I would hope that you can agree on this and that not securing your API is bad.
        • josephcsible 4y ago
          Should you secure your API? Of course. But you should not secure my data from me.
        • franga2000 4y ago
          What do you mean? On what planet is it a provider's fault if a third party farms logins through a custom client. It's not their fault if I get phished, if the little booklet I store my passwords in under my pillow gets stole, if my computer is infected with a RAT... so why would it be in this scenario? I only got a few posts into the thread before Twitter booted me out for not having an account, so maybe there's some context I'm missing, but what kind of "not securing your API" are you talking about? The fact that a thir party, explicitly authorized the the user, was able to make actions on the user's behalf, doesn't make it secure, it makes it functional.
          • murderfs 4y ago
            > What do you mean? On what planet is it a provider's fault if a third party farms logins through a custom client. Earth: https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...
            • franga2000 4y ago
              > Cambridge Analytica then arranged an informed consent process for research in which several hundred thousand Facebook users would agree to complete a survey for payment that was only for academic use. > However, Facebook allowed this app not only to collect personal information from survey respondents but also from respondents’ Facebook friends.[13] In this way, Cambridge Analytica acquired data from millions of Facebook users FB gave them data about friends, when it was supposed to only give them data about respondents. Totally different situation.
    • d110af5ccf 4y ago
      Yes, people can and will write malicious programs. Those will sometimes take the form of third party clients for a service. That is not and will never be a valid argument against them being allowed to exist. Monopolies are not ok. Abusive behavior by the dominant market players isn't ok.
      • fzeroracer 4y ago
        Yes, but my point is that said clients should have to talk through properly secured APIs and required by law. Until then, an app like this is a massive, MASSIVE security risk and I would question the sanity of any team that saw something like this and ignored it.
        • d110af5ccf 4y ago
          > should have to talk through properly secured APIs I don't follow what you mean by this. The API endpoints that a company provides ought to be secured properly. In practice they might or might not be but obviously they ought to be. I don't see what that has to do with third party clients though. A third party client is stuck interacting with whatever API the company provides, however secure or insecure it might be.
          • fzeroracer 4y ago
            I mean from another perspective this is effectively a MITM style way of interacting with Meta's API. They are behaving as another unauthorized layer between the user and Meta's API. In actual secure systems involving third party clients the client usually authorizes itself on behalf of some user requests or permissions, so while it does things for the user there's a clear and secure delegation of permissions. Have you done much work with authorization? To put it in another way let's say there was a website that said it authorized with Steam. It asked you to put in your steam username and password. Is this secure? Now let's say that same website instead redirected you back to Steam (properly) and requested authorization on behalf of you. Is this secure? Now which bucket does this app fall under?
    • SturgeonsLaw 4y ago
      If you use the third party app, it might be doing all that stuff. If you use the official app, it will be doing all that stuff.
• felipellrocha 4y ago
  While I mostly agree with you, banning the personal accounts from their *team* is a bit much. Specially considering how that also includes access to Instagram, and WhatsApp, WhatsApp being the biggest issue here since in many countries that is considered a way of conducting business.
  • Matheus28 4y ago
    I agree, it's a bit much. But they are all violating the ToS they accepted so...
    • LtWorf 4y ago
      You mean that document saying something like: "we can do what we want, no recourse possible"? That should be forbidden too.
      • Matheus28 4y ago
        I'm pretty sure there's a line there about reverse engineering
        • mrguyorama 4y ago
          You can put whatever you want in a contract, and the other party can sign it, but that is not enough for it to be valid. Contract law usually has call outs against obviously absurd, overreaching, or "I own everything and anything" clauses
    • waitforit 4y ago
      By that logic, every employee of Apple/Google/Meta or at least the ones working on related projects should be handled a fine every time Apple/Google/Meta gets fined by the EU for breaking the law/abusing its position? The are violating the law after all.
      • Matheus28 4y ago
• josephcsible 4y ago
  Should phone companies get to force you to use phones you rent from them, instead of having the freedom to bring your own?
  • Matheus28 4y ago
    If that's their business model and they want to, sure. I'd guess that most wouldn't because it's not as profitable (they'd lose too many customers).
    • josephcsible 4y ago
      That's exactly what phone companies used to do, and they only stopped when the government made them stop. It was more profitable for them, at our expense.
      • Matheus28 4y ago
        AFAIK you've always been able to bring your own phone. They just wouldn't unlock your subsidized phone after the contract ended (which I find unfair, but it's in the contract people signed, so...). Regardless, I think this line of thought is becoming too off-topic. Why should the first party be serving content to people using third party apps that generate them no revenue? Just like websites are free to block adblock users, app apis should be free to block third party app users.
        • josephcsible 4y ago
          I'm not talking about cell phones. I'm talking about rotary dial phones back in the days of Ma Bell.
    • witheld 4y ago
      That was literally how phones worked on the beginning- AT&T had to be taken to court to stop it.
      • 4y ago
• stonogo 4y ago
  Why are first parties serving unauthorized API requests? If the API request is unauthorized, surely the proper response is "401 Unauthorized" and not "all the data you asked for, but then I'll find the people who helped you and get mad at them"? The problem here is that Meta wants to plug things into the internet and then control who gets to ask for those things. This is not how the internet works, at all. If you don't want third parties accessing your APIs, lock them down.
  • Matheus28 4y ago
    I'm willing to bet the instagram app already signs their api requests to make sure they're coming from the app. Third party apps are reverse engineering that. If you try to send a request without those headers, it'll very likely give you a 4xx code.
    • mrguyorama 4y ago
      The DMCA already has provisions that say reverse engineering for interoperability is fair game.
      • Matheus28 4y ago
        You can reverse engineer it all you want, the issue is when you publish something that interacts with a remote resource in a way that the owner of that resource did not allow you to.
  • sshine 4y ago
    This. > unauthorized api requests The word "unauthorized" has two meanings here: One is authorized by the user, another is authorized by the vendor.
• bfdm 4y ago
  Why shouldn't I be able to uae the software of my choosing? If i habe an account and have properly authenticated, the client I use is my choice. You can't reasonably make the "go elsewhere" argument with the monopoly hold FB has on much social data. We need to choose yo regulate them and others to force interoperability, or at the very least allow comcom explicitly (competitive compatibility).
  • Matheus28 4y ago
    So you want to consume their content, use their servers, but not display their ads?
    • Nextgrid 4y ago
      Nothing prevents a third-party client from displaying ads.
    • bfdm 4y ago
      They are free to cease offering unpaid accounts if they wish.
  • tptacek 4y ago
    Because your access to their API is conditioned on an agreement not to use unauthorized clients. You are free to use the software of your choosing in conjunction with your own computers, but not necessarily with everybody else's.
    • userbinator 4y ago
      • Matheus28 4y ago
        So I should be able to steal from my neighbor because that's true freedom? Because you're using their resources and servers in a way they didn't authorize.
• int_19h 4y ago
  > some apps are only monetized through advertisement, and 3rd party apps don't display them. How do you expect the 1st party to stay in business? They're welcome to find a different business model. Why should we sacrifice interoperability for everyone for their sake?
  • Matheus28 4y ago
    Why should you get to use their servers and resources if they don't want you to be using them without displaying ads?
    • amatecha 4y ago
      Probably because literally every single friend and family member of mine is on there and sharing their entire life there (and messaging me) and I can't take part in that. I said in another comment that once a platform provides that degree of communication, certain rights to protect the users should be applicable, to ensure we are able to participate in society without onerous cost to our mental health, dignity or privacy.
    • int_19h 4y ago
      They're welcome to take the servers down altogether, if they can't pay for them without displaying ads. Or require an API key that's tied to a particular account that pays for access.
    • pera 4y ago
      TV channels don't want you to mute your TV when they display ads, should TVs block this functionality to force you listen to their ad?
  • Shish2k 4y ago
    If shops don’t like shoplifters, they should stop putting products on shelves where anybody can just take them and walk out - it’s dumb to get the police involved to keep sustaining this obviously-flawed business model.
    • 4y ago
• nextaccountic 4y ago
  > Additionally, some apps are only monetized through advertisement, and 3rd party apps don't display them. How do you expect the 1st party to stay in business? Ad blockers are already a thing. Should they be forbidden?
  • Matheus28 4y ago
    My position is that if a website uses anti-adblock and you're using an adblock, circumventing it isn't okay. You're free to use a different website. Now, one could argue that by displaying ads in the first place, using an adblock is circumventing something therefore it isn't okay (basically remove one layer of abstraction from the previous sentence). That's also a fair position, but not mine because of entirely selfish reasons (it's inconvenient to me and non-adblock users are subsidizing my use of those websites). One could argue that allowing adblock users is a strategic decision in hopes they can spread the use of the website and payoff their "debt" that way. I operate web games and I allow adblock users for that reason.
    • lelanthran 4y ago
      > That's also a fair position, but not mine because of entirely selfish reasons (it's inconvenient to me and non-adblock users are subsidizing my use of those websites). That's fair - you are knowingly subsidising adblock users. If you don't want to subsidise adblock users, you're free to use a different site. (That's your basic argument, right? Freedom?)
• tsimionescu 4y ago
  By this logic, it should be illegal / a breach of contract for you to run an ad blocker, since the company may not make money? Should you also be forced to look at ads and not switch channels while they're on TV, with the channel being free to cut access if they find you haven been looking at the ads they serve? This logic really bends over backwards to support FB's and similar business models.
  • dylan604 4y ago
    Rather than just blocking the request for the ad, if an ad blocker allowed the requesting site to make the request for the ad but then just sent the data to the browser's equivalent of /dev/null, I'd be fine with that as long as I never had to see/hear the ad. This is of course ripe for abuse, but that's just synonymous for digital advertising in general. I don't consider it any different than me hitting mute on the TV during ad breaks or getting up and going to another room during that break.
    • tsimionescu 4y ago
      This makes absolutely no sense whatsoever. If you don't think sites have a fundamental right to push ads to sustain themselves (as I don't), then blocking the request is the best place to do it for performance reasons. But even if you do believe in that right - the site and advertiser care about a single thing: a human being seeing the ad. Serving the Ad request is not just useless for their purpose, it is actively costing them money, and potentially muddling their data.
      • dylan604 4y ago
        >the site and advertiser care about a single thing I disagree. The site just wants the advertiser's money. The advertiser wants the human to see an ad.
        • hedora 4y ago
          The user wants to support the site, and doesn't want to see the ad. Why not have the browser /dev/null them, and click a few for the heck of it? It would be in the user's interest.
• jart 4y ago
  If it's unauthorized, then not only does MITM the ad revenue, it MITM's the user's authentication too.
  • mcv 4y ago
    If it's a client, it's not in the middle.
• amatecha 4y ago
  I think I should have the legal right to access private messages addressed to me by family members via the service explicitly designed to facilitate private communication between friends and family members. I don't think I should be forced to see advertisements and be subjected to historically-unprecedented surveillance to read those couple hundred bytes of text from a family member. When a platform's primary purpose is communication, certain legal rights should be invoked immediately. In my opinion, one of those rights should be the ability to access those communications by any 3rd party client that doesn't intentionally function maliciously. How "proper 3rd-party client behaviour" is evaluated can be a problem for the industry to solve. They have the $trillions to figure something out. I think they'll survive. The argument "don't like it, don't use it" isn't a very reasonable argument when, socially speaking, you "have" to use a given service (usually the regionally-omnipresent service) to be included in society. Communication is the foundation of society and of human existence. I miss out on a shocking and honestly depressing amount of social activity because of my boycotting of FB, IG, WhatsApp and other similar services. I expect that our ability to communicate is carefully protected and treated as something crucially important. There's a reason there are SO MANY commercial services around communication and they are largely the most lucrative, because everyone NEEDS to communicate. People will subject themselves to extremely disadvantageous conditions to enable communication with others. Think about it. Facebook, Twitter, Instagram, TikTok, the internet, cellular phone service. These things are fundamental to communication in global society, and a TON of laws are written to govern their employment/usage. Internet communication just happens to still be pretty early in the stages of its effect on humanity, and as usual the legal world is well behind what those effects are. The effects are finally being felt. I believe my feelings on this subject will become more widespread as people realize how deeply they have been exploited by industry (once again).
  • Matheus28 4y ago
    I disagree. No one has the right to use facebook/twitter/etc as they wish, or even at all. They're not necessary for modern western society. SMS and phone calls are always an option. We aren't like China where if you don't have WeChat you can't do anything.
• barnabee 4y ago
  No one should be able to control what apps interact with their platform. Companies should have exactly zero control over how people interact with endpoints they open to the internet and it should be illegal and unenforceable to try to create any contractual obligations about how someone interacts with your APIs.
  • amatecha 4y ago
    Cheers, I have never before heard anyone else say these points I've been arguing (without me saying it first, at least). I feel a real sense of relief not being the only person "in the room" to say this, for once.
  • abenga 4y ago
    This seems extreme. Do you support fair use limits, or is blocking a DOS attack also a violation of these rules?
    • selfhoster11 4y ago
      Let’s not be ridiculous. DOS is not use, it’s abuse.
      • lovich 4y ago
        I want to preface this with that I agree with your point that DOS is abuse and not actually trying to use the platform. I disagree with calling the question ridiculous. If we’re involving legality like the poster up thread implied with making this illegal then there needs to be some sort of test or rule put in place on what constitutes illegal activity. We currently don’t have one and whenever a new rule is put in place you quickly find out that there is a significant chunk of people who would find anything you think is obviously wrong to be obviously right and vice versa
      • Matheus28 4y ago
        And using their servers and resources without generating them any revenue is not abuse? They clearly don’t want you to run a third party app without ads, yet you feel entitled to it?
• 1vuio0pswjnm7 4y ago
  "How do you expect the 1st party to stay in business?" Here is a different way to look at what is going on lately in the short history of the internetowrked computer. To me, there is no legitimate "business". Meta cannot charge IG users a fee. They will not pay. If they would pay, then why not charge them. Instead Meta exploits IG visitors by spying on them. Advertisers will pay. Third parties will be interested in the data Meta collects. What Meta is doing with FB, IG or WhatsApp is not legit "business" IMHO, because, IMO, a business generally produces something of value that people pay for. Generally, Meta does not do that. Newspapers sold advertising, but people were willing to pay for newspapers. Because newpapers produced something of value. They employed people to produce a product that people paid for: journalism. Meta does not employ people to produce something of value that people will pay for. The content on these apps comes from the people who use them, and from journalists emplyed by newspapers, but not Meta. Meta make people the product, access to and data on which they sell to paying customers. Websites and apps are not "products". In this "business" the people who use them, their behaviour and the details of their lives, are the product. A kid's lemonade stand looks more legit as "business" to me than a "tech" company producing so-called "products" that are given away for free, as bait. These are not the product that customers pay for, that no one likes to talk about. Billboards owners sell advertising. They own or lease real estate with high visibility to traffic. It is difficult to avoid billboards because we generally use the same paths to travel in physical space. As such, billboards are regulated. Not everyone with land adjacent to high traffic routes can erect billboards. See, e.g., Highway Beautification Act of 1965. Perhaps Meta is like a billboard company in a world that has yet to regulate billboards. IMO, Meta is far more of a hazard to life than a billboard is to the beauty of a highway. Meta does more than display advertising to people who use their websites and apps. Meta's "business model" is a threatening the stability of society. If it is allowed to continue, it should be heavily regulated. Imagine someone telling you, "If you don't like the billboards, don't look at them." Or "If you don't like the billboards, don't use the highway." It is not so simple. Now imagine Meta tells you, "If you don;t look at the billboards, you cannot use the highway". Meta is obscuring the true potential of the internet. It has given the internet a bad rap. Meta is not the internet nor its potential to improve people's lives anymore than billboards are the scenery. If left unregulated, billboards can obscure the scenery and eventually they can destroy it.
• jraph 4y ago
  > Don't like it, don't use it I don't like it and I don't use it, but unfortunately it's more complicated than that because of the network effect.
• deleted 4y ago
  [deleted]
• izacus 4y ago
  Because it allows for market competition at a tiny cost to a corporation. Free market competition in these ways makes people's lives better.
• yc-kraln 4y ago
  I think the perspective here is a very interesting one. Typically, such transactions are seen as between a user and a service provider. There is an agreed-upon protocol, and so long as everyone sticks to the agreed-upon protocol, the exchange can be successful: this is the basis of Email, the Web, etc. Taking aside advertisement for a moment, what you're suggesting is that the level of control should go as far as which clients are allowed to speak a given protocol. This would be similar to the landline system during the monopoly days, where you were only allowed to connect an officially-approved phone (with a correspondingly high ongoing rental cost) to the copper lines. From my perspective, there is no 3rd party involved here: there is an API surface which is developed and supported, and there is a client/customer who is interacting with the service through that API. Advertising either needs to be implemented into the API (good luck--see the demise of RSS), or the 1st party needs another business model.
• mrguyorama 4y ago
  Rules about things like DRM already have carve outs for "interoperability". A big example is back in the 90s, EA didn't like the rules Sega made for putting games on the MegaDrive/Genesis, so they did some reverse engineering work and made their own cartridges that worked great. Sega took them to court and got smacked down pretty hard, basically invalidating their entire anti-copy strategy. We should push for MORE of the above, not less. We should push for laws that HELP people use the things they have, instead of locking them out of their own property. If Facebook doesn't like people trying to access their own content, Facebook shouldn't have built a business on everyone else's content. Nobody forced them to do that.
  • Matheus28 4y ago
    EA making games for MegaDrive/Genesis doesn’t cost Sega any money. You using the api without ever seeing any ads will actively cost Meta money. Not the same thing.
    • dllthomas 4y ago
      I agree that it's not the same thing, and I don't know offhand about the MegaDrive/Genesis in particular, but game consoles have often been sold at a loss with profit made on sale of games. If that was true for Sega at the time, anyone EA making games that motivate sales of Sega consoles but no purchase of Sega (or Sega-licensed) games would absolutely be costing Sega money. I make no particular comment, here, on whether we should be defending that business model.
• LocalH 4y ago
  Why should 3rd parties be allowed to sell unauthorized devices to be connected to the telephone line? Additionally, phones are only monetized through leasing, and 3rd party phones aren’t leased. How do you expect the 1st party to stay in business? I don’t align with AT&T on a lot of issues, but they should be able to control which phones connect to their network. Don’t like it, don’t use it.