4 ms·

If you don't need an account or an api key to access it, then there's no contract signed, and so they can't restrict your usage contractually. An API with no re

If you don't need an account or an api key to access it, then there's no contract signed, and so they can't restrict your usage contractually. An API with no requirement for an API key is functionally identical here. On the other hand, scraping a website that only exposes content to logged in users is the same as using an api behind a key. The relevant part is whether you need to sign a contract to access the content.

gooseyman 2y ago
I’m with you on the API piece here. Is the non-password protected end of the site really fair game for scraping? I’m sure the terms of service say not to, but are those enforceable?
- deleted 2y ago
  [deleted]
- pests 2y ago
  Craigslist successfully sued PadMapper over similar public scraping.
AlienRobot 2y ago
I think that ship sailed when websites started having to ask users consent for cookies. Now it's no longer "accessing a website" it's "interacting with a service." If they have to ask for consent to set a cookie, you have to abide by their ToS to connect to their servers.
- seanhunter 2y ago
  I highly doubt that is legally the case. In situations when I have been in conversations with lawyers about this sort of thing they have been universally of the opinion that to be bound to some terms of service the user has to take an affirmative action to accept those terms. The action can’t just be expressing your cookie preference, and in fact in some jurisdictions (Europe, California? I think) the cookie regulations that gave rise to those annoying consent dialogs specifically say you can’t give a user a different quality of service if they refuse the cookies, so that would seem to undermine your argument somewhat.
nickff 2y ago
Wouldn’t a DDoS be perfectly legal and permissible under your logical framework?
- klabb3 2y ago
  DDoS is arbitrary with any definition. What’s the difference between a weak server that can’t handle an influx of load vs an “attack”? The result is the same. It all depends on intent and coordination, which is better defined by lawyers than engineers. To some extent, you have to expect that anything with an open port 80 on the public internet is accessed by strangers. First because it’s the technical reality, but it’s also part of the principles of the web in some deeper philosophical sense.

gooseyman 2y ago

I’m with you on the API piece here. Is the non-password protected end of the site really fair game for scraping? I’m sure the terms of service say not to, but are those enforceable?

deleted 2y ago
[deleted]
pests 2y ago
Craigslist successfully sued PadMapper over similar public scraping.

AlienRobot 2y ago

I think that ship sailed when websites started having to ask users consent for cookies. Now it's no longer "accessing a website" it's "interacting with a service." If they have to ask for consent to set a cookie, you have to abide by their ToS to connect to their servers.

seanhunter 2y ago
I highly doubt that is legally the case. In situations when I have been in conversations with lawyers about this sort of thing they have been universally of the opinion that to be bound to some terms of service the user has to take an affirmative action to accept those terms. The action can’t just be expressing your cookie preference, and in fact in some jurisdictions (Europe, California? I think) the cookie regulations that gave rise to those annoying consent dialogs specifically say you can’t give a user a different quality of service if they refuse the cookies, so that would seem to undermine your argument somewhat.

nickff 2y ago

Wouldn’t a DDoS be perfectly legal and permissible under your logical framework?

klabb3 2y ago
DDoS is arbitrary with any definition. What’s the difference between a weak server that can’t handle an influx of load vs an “attack”? The result is the same. It all depends on intent and coordination, which is better defined by lawyers than engineers. To some extent, you have to expect that anything with an open port 80 on the public internet is accessed by strangers. First because it’s the technical reality, but it’s also part of the principles of the web in some deeper philosophical sense.