4 ms·

How would reddit block them?

haswell 3y ago
I imagine that over time they’ll update their 1st party clients to use authentication, and if they’re really motivated they could implement some kind of token binding. It would surprise me if this isn’t in their near term plans given the apparent urgency they have to shut down the APIs.
- Tommstein 3y ago
  Unless they block web browsers too, ain't gonna work (and even then, still probably wouldn't work). Any app can simulate a regular web browser.
  - haswell 3y ago
    It’s less about fully breaking these clients and more about forcing them to deliberately circumvent API restrictions, which opens legal avenues.
- rane 3y ago
  How would that work exactly? Wouldn't this library be able to pretend to be a 1st party client?
  - maccard 3y ago
    It's a game of cat and mouse, it's like anticheat, or user agent spoofing. All reddit have to do is make it "difficult" enough to dissuage the majority of users for it to be worthwhile.
  - haswell 3y ago
    Something like this [0]. The point would be to force clients to deliberately circumvent the restrictions, which I believe would give them more standing to go after 3rd party clients that attempt this. Worth noting that most browsers don’t support token binding yet, but this has been in the works for awhile, so I’m mentioning it here for illustrative purposes. They could theoretically implement something less airtight but with the same general goal. - [0] https://datatracker.ietf.org/doc/html/rfc8473 https://datatracker.ietf.org/doc/html/rfc8473
  - sprite 3y ago
    Both Apple and Google will remove apps from their store if they access a 3rd party API without consent. Not to mention that if using non sanctioned APIs you will likely face lawsuits from whatever service you are implementing a 3rd party client for.
- hiatus 3y ago
  If reddit removed their web view and went app-only it would be dead in the water IMO.
  - haswell 3y ago
    But this isn’t just about the web view, is it? My understanding is that they’re still hitting API endpoints. What I’m getting at is that it’s theoretically possible to start locking down the APIs such that only Reddit’s own clients including the web view can continue to call those APIs. Clients that are calling the unprotected endpoints would be forced to start circumventing the new API security, setting up an avenue for Reddit to go after such clients. Getting rid of the web view isn’t necessary.
jorams 3y ago
They can just turn off the .json endpoints for unauthenticated requests. Their own clients use a non-public GraphQL API that (supposedly, I haven't checked) uses elaborate fingerprinting to stop outside access. When I said "all apps" I should probably have clarified that it's all 3rd-party apps.

I imagine that over time they’ll update their 1st party clients to use authentication, and if they’re really motivated they could implement some kind of token binding. It would surprise me if this isn’t in their near term plans given the apparent urgency they have to shut down the APIs.

Tommstein 3y ago
Unless they block web browsers too, ain't gonna work (and even then, still probably wouldn't work). Any app can simulate a regular web browser.
- haswell 3y ago
  It’s less about fully breaking these clients and more about forcing them to deliberately circumvent API restrictions, which opens legal avenues.
rane 3y ago
How would that work exactly? Wouldn't this library be able to pretend to be a 1st party client?
- maccard 3y ago
  It's a game of cat and mouse, it's like anticheat, or user agent spoofing. All reddit have to do is make it "difficult" enough to dissuage the majority of users for it to be worthwhile.
- haswell 3y ago
  Something like this [0]. The point would be to force clients to deliberately circumvent the restrictions, which I believe would give them more standing to go after 3rd party clients that attempt this. Worth noting that most browsers don’t support token binding yet, but this has been in the works for awhile, so I’m mentioning it here for illustrative purposes. They could theoretically implement something less airtight but with the same general goal. - [0] https://datatracker.ietf.org/doc/html/rfc8473 https://datatracker.ietf.org/doc/html/rfc8473
- sprite 3y ago
  Both Apple and Google will remove apps from their store if they access a 3rd party API without consent. Not to mention that if using non sanctioned APIs you will likely face lawsuits from whatever service you are implementing a 3rd party client for.
hiatus 3y ago
If reddit removed their web view and went app-only it would be dead in the water IMO.
- haswell 3y ago
  But this isn’t just about the web view, is it? My understanding is that they’re still hitting API endpoints. What I’m getting at is that it’s theoretically possible to start locking down the APIs such that only Reddit’s own clients including the web view can continue to call those APIs. Clients that are calling the unprotected endpoints would be forced to start circumventing the new API security, setting up an avenue for Reddit to go after such clients. Getting rid of the web view isn’t necessary.

jorams 3y ago

They can just turn off the .json endpoints for unauthenticated requests. Their own clients use a non-public GraphQL API that (supposedly, I haven't checked) uses elaborate fingerprinting to stop outside access. When I said "all apps" I should probably have clarified that it's all 3rd-party apps.