9 ms·
Seeing all Reddit apps shut down, I can't help but wonder — what is it that made everyone play by the rules? What happened to the adversarial interoperability s
by grishka 3y ago
Seeing all Reddit apps shut down, I can't help but wonder — what is it that made everyone play by the rules? What happened to the adversarial interoperability spirit? What forces people to use their own API keys instead of pretending to be one of the official apps?
I can understand the iOS apps, the App Store hegemony does kinda force this and there were cases of Apple removing apps that interact with an online service without that service's permission. But web, desktop and Android apps have no one to force them to comply with these kinds of rules, yet these are also shutting down.
It wasn't always like this. 15 years ago, when ICQ was huge, everything with a screen, keyboard, a network interface, and a way to run arbitrary code had an unofficial ICQ client for it. Most people haven't ever seen the official clients. That's just one example. What happened?
- yakabuff 3y agofrom my own personal experience, reddit's legal team sends you a threatening email demanding that you take down your site stating that you have violated some tos/agreement
- Modified3019 3y agoYou should post that somewhere
- Seattle3503 3y agoYou would have to give up oauth no? If you do, your users need to trust you with their username and password. Maybe most wouldn't care.
- charcircuit 3y ago>What forces people to use their own API keys instead of pretending to be one of the official apps? https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- booi 3y agoThank god for that act. Otherwise there might be fraud on the internet
- cookiengineer 3y agoBecause all people comply with the law, especially the ones considering doing fraud on the internet
- grishka 3y agoThat's in the US though. It's known that the US government does its best to protect the interests of corporations. There are other countries, in some of which reverse engineering something for the purpose of interoperability is explicitly allowed. edit: looking at the list of cases, and knowing that the US legal system relies on precedents, it feels like using an online service's private API is allowed under this act.
- costco 3y agoYes, as far as I can tell terms of service violations resulting from things like scraping/using unofficial APIs are not CFAA violations and certainly not criminal unless you are not supposed to have access to the data in the first place. The company may still sue in civil court but it has to be on other grounds. Which is why hiQ "lost" to LinkedIn and settled even though they won on the CFAA issue. And why Plaid is still in business.
- charcircuit 3y agoThe important thing is that it was suggested to use API keys which you are not authorized to use. Just because the keys are technically public it doesn't mean that you are authorized to use them. If someone uploads their AWS token to Github it isn't legal to use it even if it was made public.
- grishka 3y ago
- Shekelphile 3y ago> Seeing all Reddit apps shut down, I can't help but wonder — what is it that made everyone play by the rules? What happened to the adversarial interoperability spirit? What forces people to use their own API keys instead of pretending to be one of the official apps? The official reddit app uses a seperate, undocumented graphql based api rather than the public REST one they allow for public use. I suspect someone is/will be already using it to emulate the 'old' API soon enough.
- mappu 3y agoStealth ( https://f-droid.org/en/packages/com.cosmos.unreddit/ https://f-droid.org/en/packages/com.cosmos.unreddit/ ) has an optional access mode that works by scraping old.reddit.com, that still works.
- dagurp 3y agoWhy is not being able to log in a feature? Reddit is terrible when you can't block the mainstream subreddits.
- codetrotter 3y agoImagine you use an unauthorised client and you post a lot of thoughtful content. Really pouring your heart and soul into that account. And then one day a few months from now, boom u/spez (CEO of Reddit) has another genius business insight for the direction he wants to take Reddit. Next day they’ve banned the accounts of everyone who’s been found to be using unauthorised clients. Better to stay logged out if you’re gonna browse with an unauthorised client. Besides, the client could keep a list of subreddits you like anyway, and retrieve posts from those instead of from the default front page. Worst reddit can do then is to IP ban you bat at least they won’t be deleting anything that you’ve been spending time to write.
- mst 3y agoI may be an outlier but I never bother with the reddit front page - I go direct to specific subreddits and read them one at a time.
- greyface- 3y agoThere didn't use to be any rules to play by. Official "front door" APIs are a modern phenomenon. They started being offered, and rugpulls were rare, so we got complacent and started using them rather than reverse engineering first-party APIs.
- stavros 3y agoWe didn't "get complacent", APIs are just a better experience. You get documentation, guarantees of stability, advance warning for changes, a changelog, etc. Even factoring in the risk of a rug pull, it makes more sense to use an API than spend ongoing constant effort reversing a first-party one that will keep breaking on your users randomly and need urgent fixes all the time.
- grishka 3y agoIn the one non-open-source company I worked at, the first-party API was an extension of the public API. Some methods took additional internal-only parameters if you were using one of the official app IDs, for example. Some returned additional fields in responses. A bunch of additional internal-only methods also became available. I mean, if you have a public API, it makes sense, engineering-wise, to build your internal API on top of that, doesn't it? But apparently not everyone does it like this.
- piaste 3y agoIt's a bit more nuanced than that. Breaking changes are a lot harder once you have third-party clients, and redesigns are even harder. So, for example, if those clients have only a fraction of the features of your internal clients, it may make sense to relegate them to a separate, stable backend service while you work on your internal one. But if there's just a couple of internal methods and everything else has to be public, it probably makes sense to have a single backend. There's a lot of in-between cases, and that's where an engineering architect shows his skills in choosing the right approach.
- justcool393 3y agoThat's basically how reddit works. I've implied this in comments on reddit[1], but there is basically no way for reddit to do what it wants to do with non-OAuth clients. Old reddit for example uses the reddit API essentially directly. now with new reddit, there's been a split, and it looks like from my count that reddit is currently supporting like 7 different APIs internally, parts of them all used in various different places. The reddit API is pretty functional and most of what anyone would ever really want to do was already supported in the API (and therefore available basically with few current restrictions). Few of the actual undocumented/internal APIs on reddit are all that interesting. [1]: https://www.reddit.com/r/redditdev/comments/14nbw6g/updated_rate_limits_going_into_effect_over_the/jq6m1mz/ https://www.reddit.com/r/redditdev/comments/14nbw6g/updated_...
- cratermoon 3y ago> What forces people to use their own API keys instead of pretending to be one of the official apps? The fact that without the associated secret, an API key is useless.
- grishka 3y agoWhat do you mean by that? An API key usually is the secret. And everything needed to access the API must by definition be contained in the client app, so it's only a question of reverse engineering enough of it to extract these parameters.
- cratermoon 3y agoThis is why I get paid big bucks to investigate and remediate security problems in applications and systems.
- grishka 3y agoIt is technically impossible to embed a "secret" into something you allow everyone to download, and expect it to stay secret forever. This is called security through obscurity and it isn't real security.
- cratermoon 3y agoThis I know. What keeps me employed is knowing how to construct a client that doesn't embed a secret yet manages to perform an authorization flow.
- deleted 3y ago[deleted]
- flangola7 3y agoThis is in-fact the precise use case of secure enclave remote attestation. Maybe the GCHQ will be able to run their own Reddit clients, but the average person or even experienced hacker will not.
- gochi 3y agoMost apps back then weren't staffed by hundreds/thousands of people with a giant legal team to enforce trademarks either.
- grishka 3y agoYes but there's definitely some kind of "fair use" allowed for trademarks. My own observations show that it's fine for a product to claim it's "for" or "compatible with" someone else's trademarked product. One example is third-party coffee capsules "for Nespresso machines", usually accompanied by "not affiliated with Nespresso". I'm sure Nespresso has an army of lawyers but these things continue to be sold all around the world so it must be legal to do this.
- chipotle_coyote 3y agoIn that specific case, it's because Nespresso's patent on the capsule design ran out and they can't stop other people from selling compatible capsules anymore. While they still had the patent, they went after third-party capsules pretty aggressively. There is no "fair use" clause for patents or trademarks the way there is for copyright, but patents expire much faster. (Trademarks do, too, although they can be renewed indefinitely -- but you have to do it affirmatively every 10 years in the US.) With the necessary "not a lawyer" disclaimer in place: in the case of Reddit's APIs (or anyone else's), AFAIK the issue wouldn't a trademark or patent issue, per se -- an API can't be patented (or trademarked), and it's debatable whether they can be copyrighted. (A case between Oracle and Google involving Java's APIs made it all the way to the Supreme Court, which kind of punted on making a definitive legal decision as to the copyrightability of APIs.) But, making unauthorized use of them could almost certainly be classified as a breach of contract, e.g., a violation of the end-user license.
- ThatPlayer 3y agoThis happened to my preferred reddit app: reddit is fun. They changed their name to "rif is fun for reddit". Still want reddit in the name to show up in searches.
- KingLancelot 3y agoReddit simply isn’t worth it. All the interesting content and communities are gone, it’s just facebook news edution now.
- pyeri 3y ago>> It wasn't always like this. 15 years ago, when ICQ was huge, everything with a screen, keyboard, a network interface, and a way to run arbitrary code had an unofficial ICQ client for it. Most people haven't ever seen the official clients. That's just one example. What happened? Crony capitalism and big tech monopoly is what happened. These companies achieved success by doing innovations once but today they no longer want to work the hard route of innovating things. Instead, they're using the "legal" and convoluted route that involves closing the source code or build processes of everything, acquiring the small competitor who tries innovation and shut it down, encouraging walled gardens and non-standard APIs everywhere, etc.
- unforeseen9991 3y agoThat's part of what happened, but I think the reason that crony capitalism happened in the first place was the demographics changed. Companies don't "want" do to anything but exploit something to make a profit. When ICQ was huge, it wasn't your average joe sixpack using the internet. Now that it is, there's a lot of money to be made.
- morserer 3y agoNot an expert, but I wonder if all the redditors who would be mad about it have already jumped ship and gone to federated alternatives, and all the redditors who are left are the ones who don't care and are watching the chaos with popcorn. If you're asking about the moderators, they were forced to either reopen or be un-modded. They did what they could.
- LeFantome 3y agoWhat alternatives? I am here because I lost access to Reddit. Lemmy is not a replacement. A totally different experience for every sub-Reddit is not going to work. Reddit was pitched as The Front Page of the Internet. Where is the front page of Lemmy?
- ParetoOptimal 3y ago> Reddit was pitched as The Front Page of the Internet. Where is the front page of Lemmy? https://wefwef.app https://wefwef.app > Lemmy is not a replacement. A totally different experience for every sub-Reddit is not going to work. Not sure what you mean.
- sleight42 3y agoProbably means [this](https://tenforward.social/@elight/110708424512879073 https://tenforward.social/@elight/110708424512879073) and [this](https://tenforward.social/@elight/110696839817687860 https://tenforward.social/@elight/110696839817687860).
- rrrrrrrrrrrryan 3y agoI thought this as well. I'm apparently a weirdo because I've just used the website for the past 14 years, on both desktop and mobile (though with an ad-blocker), but for all the folks that really love the alternative Android apps, why can't bring-your-own-key be an option? The fact that they're installing an alternative app kinda makes them super-users of Reddit anyway, so asking them to generate their own personal API key shouldn't be too unreasonable. It just seems strange that the app would choose to completely shut down instead.
- 1473-bytes 3y agoThat's what I did. Got a developer API key, patched the 3rd party app, good to go.
- strombofulous 3y agoMe too, I intercepted the network requests and rewrote the key and token (and user agent ^.^ I wonder if any reddit admins here would recognize it...) in the request to access_token, or whatever the endpoint is idr Assuming you are on android since you patched the app. Did you manage to do it without data loss? It's annoying to turn on httpcanary every time I launch rif.
- yreg 3y agoChristian (Apollo dev) said that he has asked reddit specifically about letting people use their own API keys in Apollo and reddit said that they wouldn't allow it. It would lead to a cat and mouse game and Christian is not interested in that. Why should he bend over backwards to improve user experience of a platform that is working actively against him?
- actualwitch 3y ago> used the website Do you mean the old one? That's probably also getting scrapped in the near future, I'm guessing.
- rrrrrrrrrrrryan 3y ago
- water554 3y agoMore like 20-25 years ago
- grishka 3y agoICQ was the messaging service everyone around me used in the late 00s. The two most popular clients were QIP and Miranda. Then VKontakte introduced instant messaging and ICQ was quickly forgotten. Then, around 5 years later, people started gradually switching to Telegram. Today almost everyone I chat with uses Telegram.
- toyg 3y agoThe network effects were very localized, depending on which country you were you would have probably used a different service. ICQ faded out pretty quickly around 2002 where I lived, with MSN, Yahoo, and Google, taking over. I know in the States they also had a lot of AOL and iChat.
- eterm 3y agoIndeed, for the UK at least, the ICQ peak was 98-99 wasn't it? MSN messenger quickly took over after it was released in '99. I remember hearing at the time that ICQ remained popular in Russia and other Eastern European countries for much longer than it did in Western Europe though.
- ProAm 3y ago> I can't help but wonder — what is it that made everyone play by the rules? Some developers got free passes. I know of some. Total level playing field.
- neurostimulant 3y agoWhy waste energy building tools to support a company that actively hostile to their own users. Might as well spend the energy building for something else, e.g. to support fediverse, which in the last few weeks got a surge of new apps and tools made by developers abandoning reddit.
- grishka 3y agoWell, I myself am building fediverse things since 2019, so... :) The thing with centralized social services though is that network effects exist. You can't just switch from Reddit to Lemmy or Kbin the same way you can switch between Windows and Linux.
- jalapenos 3y agoExactly this. I used to browse Reddit everyday, using one of these third-party apps (the official app and website being close to unusable). When that app shut down, it just felt natural to leave Reddit behind. I opened an account on Twitter instead, having never used it before. The leadership of Reddit always seem to have been hated by the users, but I feel this might be the final straw that sends it the way of Digg etc.
- mplewis 3y agoReddit resents its users. We’ve been unpaid moderation staff for the life of the website and admins don’t give us the tools we need to do a good job for free. Good riddance.