7 ms·

The interesting thing is that they say the library used proprietary code. From talking to Contra, they are just using a REST API which is not documented (Undocu

The interesting thing is that they say the library used proprietary code. From talking to Contra, they are just using a REST API which is not documented (Undocumented API !== Proprietary). If you publish a publicly accessible API then expect it to be used by everyone and everything.

dangoldin 13y ago
By that reasoning, can't one make the argument that what weev did was use an undocumented API though? The endpoints were publicly accessible but obfuscated (and quite poorly at that).
- Dylan16807 13y ago
  That access route was unintentional, which is rather different from intentional but undocumented.
  - gingerlime 13y ago
    Absolutely. I wonder if by that token you could find a security exploit in an API that causes undesired behaviour (e.g. elevated privileges) and claim you're simply accessing an undocumented API? Or another way of looking at it - does accessing an undocumented API constitute hacking/unauthorized access? (which is probably an even more serious violation than copyright infringement in most countries) (disclaimer: I don't even know what this particular API is doing, or what's the alleged infringement, I'm just wondering about the principles in general)
    - jlgreco 13y ago
      Considering that most custom scrapers these days simplify their job by using whatever undocumented API the site's javascript might be using (makes the job very easy, but is of course a fragile solution), making the use of undocumented APIs be considered "unauthorized access", even in the absence of a restrictive robots.txt or EULA, would be very bad for a lot of people.
    - GhotiFish 13y ago
      I had this philosophy for every single crack. Computers do what they're programmed to do, they do what you told them to do, if you didn't want your computer to respond to a buffer overflow by writing over the stack and executing a sequence of commands that escalated the defendant to an administrator, you shouldn't of programmed that feature in. When you inserted that string directly into that SQL command, you gave your users access to a wide range of features. Now all of a sudden you don't like that feature any more because someone used it? You gave the users the ability to ask for arbitrary tables in your database, why should a hacker go to court for asking for a "user table"? Shouldn't you be the one in court? That's how I saw things when I was ~15, anyway. I still kinda think that way... Though I've figured out that just because someone left their safe open, doesn't mean you get to steal the gold.
      - jlgreco 13y ago
        > Though I've figured out that just because someone left their safe open, doesn't mean you get to steal the gold. True. Though on the other hand, if somebody figures out they they get free sodas when they hold down both the coke and sprite buttons, as far as I am concerned they get to have their free soda.
        kivikakk 13y ago
        There is surely some cognitive dissonance here. > > Though I've figured out that just because someone left their safe open, doesn't mean you get to steal the gold. > True. Though on the other hand, if somebody figures out they they get free sodas when they hold down both the coke and sprite buttons, as far as I am concerned they get to have their free soda. So, if the safe is left open, you don't get to take it, but if you press buttons that unintentionally make it open up, you get you have your free gold? uh.
        jlgreco 13y ago
        If the teller gives you free money, that is on the teller, not you. Whether that teller is human or an automated machine doesn't particularly matter to me. Just don't take money that the teller, automated or otherwise, does not volunteer. Regular safes and vaults, with no teller, have no agency and are not capable of giving you money.
    - yebyen 13y ago
      If pushing the right buttons on a Video Poker machine to make it pay out 10x jackpot is a CFAA violation, then yes, writing a script to access an undocumented API is unauthorized access. Then again, I'm pretty sure that company lost their case. How can you claim that it's not documented if you provide HTML and Javascript example code?

dangoldin 13y ago

By that reasoning, can't one make the argument that what weev did was use an undocumented API though? The endpoints were publicly accessible but obfuscated (and quite poorly at that).

Dylan16807 13y ago
That access route was unintentional, which is rather different from intentional but undocumented.
- gingerlime 13y ago
  Absolutely. I wonder if by that token you could find a security exploit in an API that causes undesired behaviour (e.g. elevated privileges) and claim you're simply accessing an undocumented API? Or another way of looking at it - does accessing an undocumented API constitute hacking/unauthorized access? (which is probably an even more serious violation than copyright infringement in most countries) (disclaimer: I don't even know what this particular API is doing, or what's the alleged infringement, I'm just wondering about the principles in general)
  - jlgreco 13y ago
    Considering that most custom scrapers these days simplify their job by using whatever undocumented API the site's javascript might be using (makes the job very easy, but is of course a fragile solution), making the use of undocumented APIs be considered "unauthorized access", even in the absence of a restrictive robots.txt or EULA, would be very bad for a lot of people.
  - GhotiFish 13y ago
    I had this philosophy for every single crack. Computers do what they're programmed to do, they do what you told them to do, if you didn't want your computer to respond to a buffer overflow by writing over the stack and executing a sequence of commands that escalated the defendant to an administrator, you shouldn't of programmed that feature in. When you inserted that string directly into that SQL command, you gave your users access to a wide range of features. Now all of a sudden you don't like that feature any more because someone used it? You gave the users the ability to ask for arbitrary tables in your database, why should a hacker go to court for asking for a "user table"? Shouldn't you be the one in court? That's how I saw things when I was ~15, anyway. I still kinda think that way... Though I've figured out that just because someone left their safe open, doesn't mean you get to steal the gold.
    - jlgreco 13y ago
      > Though I've figured out that just because someone left their safe open, doesn't mean you get to steal the gold. True. Though on the other hand, if somebody figures out they they get free sodas when they hold down both the coke and sprite buttons, as far as I am concerned they get to have their free soda.
      - kivikakk 13y ago
        There is surely some cognitive dissonance here. > > Though I've figured out that just because someone left their safe open, doesn't mean you get to steal the gold. > True. Though on the other hand, if somebody figures out they they get free sodas when they hold down both the coke and sprite buttons, as far as I am concerned they get to have their free soda. So, if the safe is left open, you don't get to take it, but if you press buttons that unintentionally make it open up, you get you have your free gold? uh.
        jlgreco 13y ago
        If the teller gives you free money, that is on the teller, not you. Whether that teller is human or an automated machine doesn't particularly matter to me. Just don't take money that the teller, automated or otherwise, does not volunteer. Regular safes and vaults, with no teller, have no agency and are not capable of giving you money.
  - yebyen 13y ago
    If pushing the right buttons on a Video Poker machine to make it pay out 10x jackpot is a CFAA violation, then yes, writing a script to access an undocumented API is unauthorized access. Then again, I'm pretty sure that company lost their case. How can you claim that it's not documented if you provide HTML and Javascript example code?