6 ms·
How does using private APIs violate copyright?
by codedokode 3y ago
How does using private APIs violate copyright?
- nicce 3y agoNot copyright but illegal data access and service use.
- Veen 3y agoIn exactly what respect is it illegal. Keeping in mind that "not complying with a corporation's policies" is not the same as breaking the law.
- hedora 3y agohttps://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- RoyGBivCap 3y agoI remember when this passed and thinking that it was all the big, incompetent businesses that can afford lawyers on retainer making sure that only big businesses that can afford lawyers on retainer maintain their position of superior power over individuals. Snuffing out any hope that the little guy - who through sheer talent - can do things on this incredible newfangled equalizing innovation called the Internet will finally have some real chance at power. Bank of America used it to make people who simply changed the account number in their URL bar the criminals instead of them, who were completely incompetent at securing access to their customer's accounts. What previously would have been arguably criminal negligence. It placed intent above competence - but only for those who can afford lawyers. And here it is again, being abused the same way. Hot take: It should be repealed completely.
- dragonwriter 3y agoAssuming that those third-party services are ones that the public can access via their own web interfaces, such that the only thing unauthorized is the manner in which the APIs are consumed, this would seem (unless I am missing more specific precedent) to fall out of CFAA coverage as a result of the Van Buren v. United States decision.
- from 3y agoI remember seeing "Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it" on HN earlier this year (https://news.ycombinator.com/item?id=30589489 https://news.ycombinator.com/item?id=30589489). Was this person lying?
- llamataboot 3y agoI often wondered what the full story behind that one has as OP never posted in it again and never heard a peep in any sort of media story
- dragonwriter 3y agoThere is no indication of what the charge was, and usually with hotlinking to an asset the legal issue is copyright infringement (which can be criminal as well as civil); that’s very different from suggesting that use of an API endpoint intended to be used by a public web frontend is a CFAA violation.
- chii 3y agoIt's still trespassing if the private property owner did not invite you in, even if there wasn't a locked door.
- leothecool 3y agoIs it still trespassing if you ask to be let in, and the butler lets you in when he's not supposed to?
- cardosof 3y agoIf someone I didn't grant access broke (in a very smart way) into my house, turned on the lights for a minute and then left, I'd still be pissed and would call it illegal.
- Veen 3y agoThe situations aren't really comparable. We're talking about sending a request from a computer to a publicly available API endpoint that Open AI would rather you didn't, and then using the data that endpoint sends in response. (Somewhat tangential, the "networks as a 3D space you travel around in with locations you visit" analogy does more harm than good. It's not what's happening and it results in muddled thinking.)
- minhazm 3y agoSomething being accessible does not mean you're authorized to access it. Someones house being unlocked doesn't mean it's okay for you to enter. Authorization is the key part here and you likely can be convicted under the CFAA[1]. [1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- Veen 3y agoAgain, I don't think the analogy holds—no one is entering anything. A better analogy would be someone standing outside your house and asking you to pass a book to them through the open door, which you then voluntarily do.
- cardosof 3y agoI don't disagree your second paragraph, I'm just curious - can you elaborate more on why is that?
- ke88y 3y agoThis is almost certainly an instance of Unauthorized Use under the CFAA and therefore criminal in the USA and any jurisdictions with similarly broad anti-hacking laws.
- dragonwriter 3y agoIf those are APIs consumed by public sites, then they are APIs the public is authorized to use by way of those sites, and Van Buren v. United States says that if you are authorized to access a system, accessing it a different “manner or circumstances” is not “unauthorized” as that term is used in the CFAA.
- numlock86 3y agoWhat part of "private API" is the one you don't understand? We could elaborate.
- berkle4455 3y agoThese are the exact same “private API”s your browser utilizes when visiting chat.openai.com and require your own API keys granted to you by OpenAI. Calling it illegal is utterly insane. It’s just a different user-agent and they’d prefer people use their official ones. OpenAI literally controls the keys so if they don’t want someone using an alternate mechanism, they can and will just ban the account.
- Veen 3y agoI wasn't aware companies could, by fiat, declare certain publicly available endpoints private, thereby compelling everyone by force of law to pretend they don't exist.
- spzb 3y agoMy bank's website is publicly available. That doesn't mean anyone is free to access my bank account. Just 'cause something is accessible on the internet doesn't mean you have the right to access it. Case law and statute goes back at least to the 1980s on this point.
- berkle4455 3y agoThe aforementioned tools do nothing whatsoever to grant to access accounts which aren’t theirs.
- spzb 3y agoI know. That’s not what I said.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- gjsman-1000 3y ago> Keeping in mind that "not complying with a corporation's policies" is not the same as breaking the law. Actually, the law says that the Terms of Service is a legally-binding contract unless you can prove any provision is legally considered unconscionable. However, if that happens, all provisions except that provision still bind. It is illegal to break a legally-binding contract, and you can be sued or taken to arbitration at a minimum in a civil court for "breach of contract." And that's before any Computer Fraud and Abuse Act or Digital Millennium Copyright Act violations. Yes, corporations don't sue users for "breach of contract" almost... ever. It's expensive, risky, has low compensation for doing so, and is just bad PR. But they legally always can.
- Veen 3y agoI'm assuming the users of Gpt4free haven't signed up to OpenAI's terms and conditions, even if they do contain language prohibiting use of these private APIs. A corporation can't unilaterally impose their TOS on the entire population (or, at least, one would hope they can't).
- gjsman-1000 3y agoIn that case though, let's say OpenAI decided to enforce their Terms of Use by potentially suing. The defendant would likely have to show, whether he likes it or not, that he never once signed up for ChatGPT, never once signed up for the official OpenAI API, and managed to perfectly reverse-engineer the API from the outside. Seems unlikely to me. But then of course... CFAA and DMCA. The DMCA in particular, for example, doesn't consider the strength of the lock in the criminality. DVDs can be cracked with 7 lines of Perl since 2001, but it's still a DMCA violation.
- dragonwriter 3y ago> The defendant would likely have to show, whether he likes it or not, that he never once signed up for ChatGPT, never once signed up for the official OpenAI API, and managed to perfectly reverse-engineer the API from the outside. These aren’t reverse engineering the OpenAI API, they are reverse engineering the APIs of public services that in turn call the OpenAI API. I’m not sure under what theory OpenAI would even sue. > But then of course... CFAA and DMCA. The DMCA in particular, for example, doesn't consider the strength of the lock in the criminality. The DMCA only applies to technology addressing copyrights, and CFAA seems inapplicable to consuming the backend APIs used by publicly accessible services because that’s just use of authorized access by a different manner, outside of CFAA scope under the Van Buren precedent.