Hacker News Reader

Comment by leggomylibro | Hacker News Reader

It's probably an unauthorized use of the API; Lyft's API is not public, and requires a separate agreement to use.

https://developer.lyft.com/docs/lyft-developer-platform-term...

One section I'd draw particular attention to reads,

"You Will Not: a. use the Platform or Service in any manner that is competitive to Lyft or the Service, including in connection with any application, website or other product or service that also includes, features, endorses, or otherwise supports in any way a third party that provides services competitive to Lyft’s products and services, in our sole discretion; ..."

So if Uber profited from that misuse, why wouldn't Lyft have a case?

View on HN

I think Lyft tries to avoid directly smearing Uber for a couple reasons: 1) Uber paves the way for them legally by using a lot of Uber VC money to fight regulation and lobby, which helps both companies. 2) Lyft is doing a lot of the same things that Uber is doing, they're just less gross about it, but they still skirt laws and do other things government actors may not like, so it would be a bit of kettle and pot.

It's a good bet that Lyft lawyers are currently preparing and there are probably top level negotiations ongoing between Lyft and Uber regarding this area.

If there is evidence Uber attempted a bridge too far such as using the fake accounts to divert Lyft drivers or in some way impacted Lyft level of customer service, Uber can all but ask Lyft not to squeeze too hard

Well, in a perfect world, because the clause would be unenforceable as contrary to public policy.

I have no opinion on the actual legality of it.

Why is that clause contrary to public policy?

If I provide information to my customers, I have to provide the same information directly to my competitor? Why does that make the world better?

It makes the world better by not attempting to draw a legal distinction based on somebody's internal motives.

In this particular case, it makes the world better by recognizing that "prohibiting competition" is not a worthwhile goal for the state to promote. We recently had another spurt of articles praising California's policy of not enforcing noncompetes as to employees. Why are noncompetes for customers a better idea?

It makes the world better by not attempting to draw a legal distinction based on somebody's internal motives.

That's called mens rea and it's how, for example, various types of murder and accidental death are distinguished. It's kind of a core element of western jurisprudence...

So, what terms do you see as enforceable on a private API?

If I set up a server to respond to only the people I choose, what restrictions can I make on it in your perfect world?

If you set up a server to respond to only people you choose, it's on you to make sure it's only people you choose that use it. Then you can make any restrictions you want and invalidate access for anyone who goes against your rules

So otherwise it is wild-west, no legal recourse, right?

Do you really believe that?

In other words, every hack is legal?

If you believe accessing a URL manually, incrementing a number in a URL, or using wget is a hack, yes. At least you'd be in agreement with the US Dept. of Justice in that.

The web is open. If you put your a chair out in a public square with a sign on that back that says, "Only paying members can sit." don't be surprised when someone random sits in it.

This puts words in the mouth of the poster that the poster didn't say. The Lyft API is authenticated so it's definitely not like accessing a URL manually, using wget, or or incrementing a number. You have to sign up, get an account and then you can use it.

A better analogy would putting your chair in a private room with a locked door and sign on the door that says ask management for access to the chair. Anyone who breaks in to use that chair definitely knows they aren't supposed to be there.

If they break a security measure, it's a hack. If there was deliberately no security, it's not a hack.

So if you forgot to lock your front door, everyone can walk into your house and help themselves to your properties?

Quoting @zaphar:

> The Lyft API is authenticated

In other words, the door was locked and you gave the key to a guy, who then peed on the carpet. While that was impolite, he was definitely not guilty of breaking and entering.

If you gave the key to a guy so they could watch your dog, they're still guilty of theft if they steal your stuff.

Also did Lyft know they were giving the key to Uber? If someone impersonates your dog sitter to get the key to your house, they still did not have permission to enter your house so it's still breaking and entering.

So I can brute force your laptop in a coffee shop and steal your shit, because you didn't stop me?

The lengths people will go to justify Uber is amazing.

Reply on news.ycombinator.com