9 ms·
What part of "private API" is the one you don't understand? We could elaborate.
by numlock86 3y ago
What part of "private API" is the one you don't understand? We could elaborate.
- berkle4455 3y agoThese are the exact same “private API”s your browser utilizes when visiting chat.openai.com and require your own API keys granted to you by OpenAI. Calling it illegal is utterly insane. It’s just a different user-agent and they’d prefer people use their official ones. OpenAI literally controls the keys so if they don’t want someone using an alternate mechanism, they can and will just ban the account.
- Veen 3y agoI wasn't aware companies could, by fiat, declare certain publicly available endpoints private, thereby compelling everyone by force of law to pretend they don't exist.
- spzb 3y agoMy bank's website is publicly available. That doesn't mean anyone is free to access my bank account. Just 'cause something is accessible on the internet doesn't mean you have the right to access it. Case law and statute goes back at least to the 1980s on this point.
- berkle4455 3y agoThe aforementioned tools do nothing whatsoever to grant to access accounts which aren’t theirs.
- spzb 3y agoI know. That’s not what I said.
- deleted 3y ago[deleted]
- berkle4455 3y ago> That doesn't mean anyone is free to access my bank account.
- s17n 3y agoThey can. Now you know.
- Veen 3y agoSo, if I create a cat GIF API, but announce that it's a private cat GIF API only I am allowed to use, I can sue anyone else who uses it to retrieve a cat GIF?
- deleted 3y ago[deleted]
- drusepth 3y agoLegally and literally: yes. Knowingly using a private API without authorization can fall under CFAA, contract law, copyright law, trespass to chattel, etc -- and you can issue a C&D and/or sue for whatever is relevant.
- woogley 3y agoPeople have gone to prison over guessable GET parameters https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_email_address_leak https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai... https://www.praetorianprefect.com/2010/06/114000-ipad-owners-the-script-that-harvested-their-e-mail-addresses/ https://www.praetorianprefect.com/2010/06/114000-ipad-owners...
- dragonwriter 3y agoCiting convictions overturned on appeal probably isn't the strongest evidence of illegality. (Because they were overturned on threshold issues that didn’t involve inquiry into the substantive merits of the charges, its not evidence against illegality, either, but...)
- woogley 3y agoMy point is people have gone to prison over GET parameters, not the legality of the it. DOJ has CFAA. Abusing private APIs is flying close to the sun. Even if you do get out of prison eventually
- dragonwriter 3y ago> My point is people have gone to prison over GET parameters, not the legality of the it. DOJ has CFAA. And CFAA is limited by Van Buren.
- sschueller 3y agoMy website is private. If you visit it I will sue you. If someone bypasses authentication I understand but if your api is open on the public internet on purpose, you don't get to randomly declare what's private and what isn't.
- numlock86 3y ago> mycoolsite.com is the same as mycoolsite.com/api/bb8d4cc4-1453-473b-8594-95db0f41877d/3c9242b8-2394-48c1-9643-618ca38eb13d for which you'll also need these dozen parameters and custom headers for, which there is no public documentation for Whoo whoo, go easy on the straw man, man.