Hacker News Reader

> What likely happened here is a remote team was paid to generate docs with a directive like, “Smartcar has a good API,” and stole them directly. Then the management team didn’t bother checking.

If a remote team is writing your API documentation by copying and pasting, then what is the actual implementation team building from?

Remote teams can be responsible for both implementation and documentation.

I’m not saying that’s what happened here necessarily, but I’ve seen this pattern repeated before (less egregiously). Founders can only do so much and most people are completely ignorant of the value of a good API, so it’s not hard for an executive team to say, “make it like that other one,” instead of staffing out the proper team.

Hi, I'm the CEO of Smartcar. While I can't go into exact details, I can say from what we know so far: this occurred out of their main headquarters.

Right but the parent's point is its not just the API documentation but the API itself that strongly mirrors your product?

Can you clarify? "Out of" can mean either "outside of" or "within" weirdly enough.

I think in this context it means within.

It means the production of the items in question came out of the location specified.

Good to see that I am being down voted for my accent/dialect.

I didn't down-vote you, but I imagine it's because you just repeated "out of" without explicitly clarifying which definition was meant (though it's more obvious in your version, at least to a native speaker).

For what it's worth, the usage here means "from within."

So Otonomo took down their API.

Can you confirm that more of their API other than the authorization code was duplicated? Honestly duplicating auth APIs are perfectly fine. If you showed proof of business APIs being duplicated, I'd have more faith in your claim. Right now this looks like a publicity stunt on a baseless argument.

> Honestly duplicating auth APIs are perfectly fine.

You don't get to say this.

Unless I'm going crazy. I guess we have a big industry problem around auth then. We only have some many types/ways to implement auth and we all use them.

Seems as if you are wildly speculating?

> What likely happened here is a remote team was paid to generate docs with a directive like, “Smartcar has a good API,” and stole them directly.

They didn't steal the docs (not only the docs). They stole the whole public facing architecture as evidenced by the fact that they are using in some instances the exact same API resources names and method names.

And randomly generated UUIDs from code examples.

But we don't know that, do we? They only showed some auth code. The OP does _not_ show that Otonomo has duplicated any business APIs, and Otonomo took their docs down. Unless someone has proof Otonomo copied more than just the examples documented in the OP, this is just pure PR fluff.

Yes, unless the business API was duplicated as well (and as noted above, there is no indication that they were), it just points to someone being lazy in writing up auth documentation.

Duplicated parameter names would be expected in this case, and preferred actually, so that they conform to the OAuth spec :-) The descriptive text is not an exact copy as well. From what we know, the only damning bit is that parameter values were exactly the same as in smartcar's documentation, which while not condonable, is not as egregious as it would be, had Otonomo cloned the business API as well.

> business API was duplicated

I would like to believe that interoperability trumps copyright in this case - a competitor copying an API/protocol and making a compatible, competing service is good for the consumer.

That's quite an assumption that they just paid a remote team to do that and their management overlooked it.