Hacker News Reader

Comment by cj | Hacker News Reader

> You mean that you are disappointed that you did not come up with this on your own

I’ve been aware of this loophole for years, it’s nothing new and is widely known.

I just chose to build our business using legitimate above-board APIs and services, as should Telegram.

If it's public and available and Telegram didn't sign a contract or EULA which forbids using this endpoint, it's legitimate.

The cons is that Google can break the endpoint at any time.

That said, I wrote a similar hack for a Wordpress plugin 10 years ago which automatically generated articles in multiple languages (think SEO farming).

I just looked at what their frontend app was calling and used it.

I run a business which needs to run programmatically searches on different search engines and using official APIs is out of the question. I didn't even check what their API offering is.

The only search engine that seriously try to prevents scraper is Yandex which asks for a lot of captchas but I've built a system to allow humans to just process captchas and give back to the code the result.

This definitely violates the terms of service, if that's what you're asking.

They never agreed to the ToS, so they can't have violated them.

It does seem to violate the Google Play ToS in terms of applications not using unauthorized 3rd party resources.

Google will most likely just fingerprint these calls and block them serverside, I'm guessing.

If you use a service by someone else then you implicitly agree to the terms. I agree that browsewrap style ToS are bullshit where merely landing on a website supposedly binds you to whatever terms they wrote, but if you actually go out of your way to integrate someone's API into your code you are definitely agreeing to the terms!

How so? A contract requires a "meeting of the minds". If one of the minds doesn't agree to (or even see) the contract, then how could it be enforceable?

This might not be so clear. If you think about google crawling your site without you knowing it - technically its same unprotected request/response as calling API. If i had TOS that prohibits crawling of the site (instead of robots.txt) does it mean that google is breaking my TOS? Seems like the solution is clearly for me to protect my site/api - not other way around.

Now if I add to all my backend response headers ”x-terms: you must agree usage terms: https://xn--blah-jb7a would it make it explicit enough, also for the ignorant engineer with “But this API just works” attitude ? It should be a industry standard really.

Reply on news.ycombinator.com