6 ms·

Okay then, why can I scan all your user data without an account or any authentication? This URL: http://www.heyzap.com/api/v1/users/search?q=mike http://www.he

Okay then, why can I scan all your user data without an account or any authentication? This URL: http://www.heyzap.com/api/v1/users/search?q=mike http://www.heyzap.com/api/v1/users/search?q=mike Allows me to anonymously see numerous (limited by # of results) users records. When I choose one from the list and go to this URL: http://www.heyzap.com/api/v1/users/mike_midkiff/activity http://www.heyzap.com/api/v1/users/mike_midkiff/activity I see all of Mike Midkiff's info. All the games he has, WHERE he played (are you f'in kidding me??????), HOW MUCH he paid, and even his unique ID. hackers, wake up. Bad engineering is bad. Only the developer whose game Mike bought should be able to request his information, and ONLY relative to that developers game. Hell. If someone gets mad at him in game, they can use YOUR API to track him down and beat the crap out of him. Nice.

immad 14y ago
Mike has a public profile and his activity is public. Its like being able to read peoples public Tweets. Edit: Location is optional (based on user) and we only give city level with a truncated Lat/Long. Again this is the same as twitter/instagram etc.
PythonDeveloper 14y ago
Just admit it's a bad implementation and commit to fix it. Except with Twitter and Instagram, I need to authenticate to get the information about WHERE an action occurred, so at least there's a trail. With your implementation, I can scan all my competitors users with public profiles (at the very least) and see who's buying what. If this is a transparency play, then say that and make a stink about it. But when Mike gets the crap kicked out of him, also step up and cover his medical bills. Edit: Okay.. so the location IS truncated, kudos. Why is this an unauthenticated API?
- what 14y ago
  You sound angry, calm down. I fail to see your point. I could also just go here http://www.heyzap.com/profile/mike_midkiff http://www.heyzap.com/profile/mike_midkiff and scrape for the same data.
  - PythonDeveloper 14y ago
    I am SOOO not angry, just shocked. HeyZap didn't build the games that power them, the developers did. HeyZap, in releasing information such as installs, etc., to unauthenticated API calls is saying "This is HEYZAP's data". It's not. It's the developers data too. Without that developers game, you'd have NO data, and each player is a customer of the developer once they buy the game. They're not just HeyZap's users, they are paid customers of that developer. Treat your developers businesses with respect and limit information to the developer and let them decide if they want to release it.
    - MaxGabriel 14y ago
      Hi, just to clarify, we don't have install data or anything from developers, only public information of what's on the app store, and what users share on Heyzap. It is the user's right to share this information if they would like to, in the same way that I can leave a review of an app without the developer's permission.
- PythonDeveloper 14y ago
  Wow.. EVEN better than I thought. I can get all the developers sales and stats just following a single, unauthenticated link: http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot { "game": { "checkins_count": 876134, "developer_name": "RUNNERGAMES", "activity_url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity, "android_package": "com.game.BubbleShoot", "tips_and_questions_count": 773, "checkins_url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity/checkins http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity..., "description": null, "players_count": 52612, "questions_url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity/questions http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity..., "web_url": "http://www.heyzap.com/game/Kqh-bubble-shoot http://www.heyzap.com/game/Kqh-bubble-shoot, "players_url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/players http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/players, "url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot, "tips_url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity/tips http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity..., "thumbnail_url": "http://d2ruqtjkg8og7r.cloudfront.net/mobile_game_icon_com.game.BubbleShoot http://d2ruqtjkg8og7r.cloudfront.net/mobile_game_icon_com.ga..., "name": "Bubble Shoot", "id": "Kqh-bubble-shoot", "android_price": "Free" } } AND if I go HERE, I can see ALL the checkins with their locations, again without authentication: http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity { "activity": [ { "type": "checkin", "like_count": 0, "message": "", "comment_count": 0, "created_at": 1353111191, "user": { "display_name": "emil", "profile_image_url": "http://www.heyzap.com/legacy/images/users/default_user_photo_200.png http://www.heyzap.com/legacy/images/users/default_user_photo..., "web_url": "http://www.heyzap.com/profile/emilgousfendi http://www.heyzap.com/profile/emilgousfendi, "url": "http://www.heyzap.com/api/v1/users/emilgousfendi http://www.heyzap.com/api/v1/users/emilgousfendi, "username": "emilgousfendi", "id": "emilgousfendi" }, "location": { "truncated_longitude": 106.963, "city": "Bekasi", "truncated_latitude": -6.356, "country": "ID" }, "updated_at": 1353111191, "id": 192146287, "time_ago": "just now", "game": { "android_package": "com.game.BubbleShoot", "web_url": "http://www.heyzap.com/game/Kqh-bubble-shoot http://www.heyzap.com/game/Kqh-bubble-shoot, "url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot, "thumbnail_url": "http://d2ruqtjkg8og7r.cloudfront.net/mobile_game_icon_com.game.BubbleShoot http://d2ruqtjkg8og7r.cloudfront.net/mobile_game_icon_com.ga..., "name": "Bubble Shoot", "android_price": "Free", "id": "Kqh-bubble-shoot" } }, ...
- nowandagain 14y ago
  I don't really understand your point about authenticated API's. It seems like twitters API is just authenticated because they want control over the apps that access use it, and not expressly for user's privacy. For example, this trends map (http://trendsmap.com/ http://trendsmap.com/) is presumably based on twitters API, has location data, and is open for anyone to access.
FSEA 14y ago
Thanks for all that public information. edit: I should really be thanking immad for confirming this data is available for open and free consumption without restrictions.
eropple 14y ago
I thought your first post in this thread was missing the point a bit (i.e., these platforms exist for social integration, so rolling your own doesn't really address the bigger goal of these systems. But this one? This is great stuff. Thanks for taking the time to do this.
- PythonDeveloper 14y ago
  My point was simply to spur the industry on to build an open source implementation that anyone can use and run, a la PhoneGap, Apache or PostgreSQL. I wasn't missing the point. OpenFeint was built on the backs of indie developers, and they sold out and didn't protect the indie developer. Okay, so selling out isn't so bad, but why then make the developers do all the work to get compatibility when THEY were the ones that made you rich?

immad 14y ago

Mike has a public profile and his activity is public. Its like being able to read peoples public Tweets. Edit: Location is optional (based on user) and we only give city level with a truncated Lat/Long. Again this is the same as twitter/instagram etc.

PythonDeveloper 14y ago

Just admit it's a bad implementation and commit to fix it. Except with Twitter and Instagram, I need to authenticate to get the information about WHERE an action occurred, so at least there's a trail. With your implementation, I can scan all my competitors users with public profiles (at the very least) and see who's buying what. If this is a transparency play, then say that and make a stink about it. But when Mike gets the crap kicked out of him, also step up and cover his medical bills. Edit: Okay.. so the location IS truncated, kudos. Why is this an unauthenticated API?

what 14y ago
You sound angry, calm down. I fail to see your point. I could also just go here http://www.heyzap.com/profile/mike_midkiff http://www.heyzap.com/profile/mike_midkiff and scrape for the same data.
- PythonDeveloper 14y ago
  I am SOOO not angry, just shocked. HeyZap didn't build the games that power them, the developers did. HeyZap, in releasing information such as installs, etc., to unauthenticated API calls is saying "This is HEYZAP's data". It's not. It's the developers data too. Without that developers game, you'd have NO data, and each player is a customer of the developer once they buy the game. They're not just HeyZap's users, they are paid customers of that developer. Treat your developers businesses with respect and limit information to the developer and let them decide if they want to release it.
  - MaxGabriel 14y ago
    Hi, just to clarify, we don't have install data or anything from developers, only public information of what's on the app store, and what users share on Heyzap. It is the user's right to share this information if they would like to, in the same way that I can leave a review of an app without the developer's permission.
PythonDeveloper 14y ago
Wow.. EVEN better than I thought. I can get all the developers sales and stats just following a single, unauthenticated link: http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot { "game": { "checkins_count": 876134, "developer_name": "RUNNERGAMES", "activity_url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity, "android_package": "com.game.BubbleShoot", "tips_and_questions_count": 773, "checkins_url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity/checkins http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity..., "description": null, "players_count": 52612, "questions_url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity/questions http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity..., "web_url": "http://www.heyzap.com/game/Kqh-bubble-shoot http://www.heyzap.com/game/Kqh-bubble-shoot, "players_url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/players http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/players, "url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot, "tips_url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity/tips http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity..., "thumbnail_url": "http://d2ruqtjkg8og7r.cloudfront.net/mobile_game_icon_com.game.BubbleShoot http://d2ruqtjkg8og7r.cloudfront.net/mobile_game_icon_com.ga..., "name": "Bubble Shoot", "id": "Kqh-bubble-shoot", "android_price": "Free" } } AND if I go HERE, I can see ALL the checkins with their locations, again without authentication: http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot/activity { "activity": [ { "type": "checkin", "like_count": 0, "message": "", "comment_count": 0, "created_at": 1353111191, "user": { "display_name": "emil", "profile_image_url": "http://www.heyzap.com/legacy/images/users/default_user_photo_200.png http://www.heyzap.com/legacy/images/users/default_user_photo..., "web_url": "http://www.heyzap.com/profile/emilgousfendi http://www.heyzap.com/profile/emilgousfendi, "url": "http://www.heyzap.com/api/v1/users/emilgousfendi http://www.heyzap.com/api/v1/users/emilgousfendi, "username": "emilgousfendi", "id": "emilgousfendi" }, "location": { "truncated_longitude": 106.963, "city": "Bekasi", "truncated_latitude": -6.356, "country": "ID" }, "updated_at": 1353111191, "id": 192146287, "time_ago": "just now", "game": { "android_package": "com.game.BubbleShoot", "web_url": "http://www.heyzap.com/game/Kqh-bubble-shoot http://www.heyzap.com/game/Kqh-bubble-shoot, "url": "http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot http://www.heyzap.com/api/v1/games/Kqh-bubble-shoot, "thumbnail_url": "http://d2ruqtjkg8og7r.cloudfront.net/mobile_game_icon_com.game.BubbleShoot http://d2ruqtjkg8og7r.cloudfront.net/mobile_game_icon_com.ga..., "name": "Bubble Shoot", "android_price": "Free", "id": "Kqh-bubble-shoot" } }, ...
nowandagain 14y ago
I don't really understand your point about authenticated API's. It seems like twitters API is just authenticated because they want control over the apps that access use it, and not expressly for user's privacy. For example, this trends map (http://trendsmap.com/ http://trendsmap.com/) is presumably based on twitters API, has location data, and is open for anyone to access.

FSEA 14y ago

Thanks for all that public information. edit: I should really be thanking immad for confirming this data is available for open and free consumption without restrictions.

eropple 14y ago

I thought your first post in this thread was missing the point a bit (i.e., these platforms exist for social integration, so rolling your own doesn't really address the bigger goal of these systems. But this one? This is great stuff. Thanks for taking the time to do this.

PythonDeveloper 14y ago
My point was simply to spur the industry on to build an open source implementation that anyone can use and run, a la PhoneGap, Apache or PostgreSQL. I wasn't missing the point. OpenFeint was built on the backs of indie developers, and they sold out and didn't protect the indie developer. Okay, so selling out isn't so bad, but why then make the developers do all the work to get compatibility when THEY were the ones that made you rich?