Zuckerman vs: Zuckerberg: why and how this is a battle of the public understanding of APIs, and why Zuckerman needs to lose and Meta needs to win
Imagine that you’re a cool, high-school, technocultural teenager; you’ve been raised reading Cory Doctorow’s “Little Brother” series, you have a 3D printer, a soldering iron, you hack on Arduino control systems for fun, and you really, really want a big strobe light in your bedroom to go with the music that you blast-out when your parents are away.
So you build a stepper-motor with a wheel and a couple of little arms, link it to a microphone circuit which does a FFT of ambient sound, and hot-glue the whole thing to your bedroom lightswitch so that the wheel’s arms can flick the lightswitch on-and-off in time to the beat.
If you’re lucky the whole thing will work for a minute or two and then the switch will break, because it wasn’t designed to be flicked on-and-off ten times per second; or maybe you’ll blow the lightbulb. If you’re very unlucky the entire switch and wiring will get really hot, arc, and set fire to the building. And if you share, distribute, and encourage your friends to do the same then you’re likely to be held liable in one of several ways if any of them suffer cost or harm.
Who am I?
My name’s Alec. I am a long-term blogger and an information, network and cyber security expert. From 1992-2009 I worked for Sun Microsystems, from 2013-16 I worked for Facebook, and today I am a full-time stay at home dad and part-time consultant. For more information please see my “about” page.
So what is an API? My personal definition is broad but I would describe an API as any mechanism that offers a public or private contract to observe (query, read) or manipulate (set, create, update, delete) the state of a resource (device, file, or data).
In other words: a light switch. You can use it to turn the light on if it’s off, or off if it’s on, and maybe there’s a “dimmer” to set the brightness if the bulb is compatible; but light switches have their physical limitations and expected modes of use, and they need to be chosen or designed to fit the desired usage model and purpose.
The modern equivalent for web-browsers is called Selenium WebDriver and is widely used by both automated software testers and criminal bot-farms, to name but two purposes.
So yes: the tech industry — or perhaps: the tech hacker/user community — has a long history of wiring programmable motors to light switches and hoping that their house does not catch on fire… but we should really aspire to do better than that… and that’s where we come to the history of EBay and Twitter.
History of Public APIs
In the early 2000s there was a proliferation of platforms that offered various services — “I can buy books over the internet? That’s amazing!” — and this was all before the concept of a “Public API” was invented.
People wanted to “add-value” or “auto-submit” or “retrieve data” from those platforms, or even to build “alternative clients”; so they examined the HTML, reverse-engineered the functions of Internal or Private APIs which made the platform work, wrote and shared ad-hoc tools that posted and scraped data, and published their work as hackerly acts of radical empowerment “on behalf of the users” … except for those tools which stole or misused your data.
The eBay API was originally rolled out to only a select number of licensed eBay partners and developers. […] The eBay API was a response to the growing number of applications that were already relying on its site either legitimately or illegitimately. The API aimed to standardize how applications integrated with eBay, and make it easier for partners and developers to build a business around the eBay ecosystem.
On September 20, 2006 Twitter introduced the Twitter API to the world. Much like the release of the eBay API, Twitter’s API release was in response to the growing usage of Twitter by those scraping the site or creating rogue APIs.
an ecosystem of ad-hoc tools that attempt to blindly and retrospectively track EBay’s own platform development would not offer standardisation across the tools that use those APIs, and so would thereby actually limit potential for third-party client development; each tool would be working with different assumed “contracts” of behaviour that were never meant to be fixed or exposed to the public, and would also replicate work
proliferation of man-in-the-middle “services” that would act “on your behalf” — and with your credentials — on the Twitter and EBay platforms, presented both a massive trust and security risk to the user (fraudulent purchases? fake tweets? stolen credentials?) with consequent reputational risk to the platform
But at the most fundamental level: Public APIs exist in order to formalise contracts of adequate means by which third-parties can observe or manipulate “state” (e.g.; user data, postings, friendships, …) on the platform.
By offering a Public API the platform frees itself also to develop and use Private APIs which can service other or new aspects of platform functionality, and it’s in a position to build and “ring-fence” the Public API service in the expectation of both heavy useand abuse being submitted through it.
Similarly: the Private APIs can be engineered more simply to act like domestic light-switches: to be used in limited ways and at human speeds; it turns out that this can be important for matters like privacy and safety.
Third parties benefit from Public APIs by having a guaranteed set of features to work with, proper documentation of API behaviour, and confidence that the API will behave in a way that they can reason about, and an API lifecycle management process with which will enable them to make their own guarantees regarding their work.
The shortest summary of the lawsuit that I have heard from one of its ardent supporters, is that the lawsuit:
[…] seeks immunity from [the Computer Fraud and Abuse Act] and [the Digital Millennium Copyright Act] [for legal] claims [against third parties or users] for automating a browser [to use Private APIs to obtain extra “value” from a website] and [the lawsuit also] does not seek state mandated APIs, or, indeed, any APIs
(private communication)
To make a strawman analogy so that we can defend it’s accuracy:
Let’s build and distribute motors to flick lightswitches on and off to make strobe lights, because what’s the worst that could happen? And we want people to have a fundamental right to do this, because Section 230 says we have such a right. We won’t be requiring any new switches to be installed, we just want to be allowed to use the ones that are already there, so it’s easy and low-cost to ask for, and there’s no risk to us doing this. But we also want legal immunity just in case what we provide happens to burn someone’s house down.
In other words: a return to the ways of the early 2000s, where scraping data and poking undocumented Private APIs was an accepted way to hack extra value into a website platform. To a particular mindset — especially the “big tech is irredeemably evil” folk — this sounds great, because clearly Meta intentionally prevents your having full, automated remote control over your user data on the grounds that it’s terribly valuable to them, and their having it keeps you addicted, so it helps them make money …
And you know what? To a very limited extent I agree with that premise — or at least that some of the Facebook user-interface is unnecessarily painful to use.
E.g. I feel there is little (some, but little) practical excuse for the heavy user friction which Facebook imposes upon editing of the “topics you may be interested in receiving adverts about“; but the way to address this is not to encourage proliferation of browser plugins (of dubious provenance regarding privacy and regulatory compliance, let alone uncertain behaviour) which manipulate undocumented Private APIs.
Apart from any other reason, as alluded above, Private APIs are built in the expectation of being used in a particular way — e.g. by humans, at a particular cadence and frequency — and on advanced platforms like Facebook they are engineered with those expectations enforced by rate limits not only for efficiency but also for availability, security and privacy reasons.
If you start driving these Private APIs at rates which are inhuman — 10s or 100s of actions per second — then you should and will expect them to either be rate-limited, or else possibly break the platform in much the same way that flicking a lightswitch at such a rate would break that lightswitch or bulb.
With this we can describe the error in one of the proponent’s claims: We aren’t requiring any new [APIs] to be installed, we just want to be allowed to use the ones that are already there — but if the Private API is neither intended nor capable of being driven at automated speeds then either something (the platform?) will break, or else there will be loud demands that the Private APIs be re-engineered to remove “bottlenecks” (rate limits) to the detriment of availability and security.
But if you will be calling for the formalisation of Private APIs to provide functionality, why are you not instead calling for an obligation upon the platform to provide a Public API?
Private APIs are not Public APIs, and Public APIs may demand registration
The general theme of the lawsuit is to demand that any API which a platform implements — even undocumented Private ones — should be legally treated as a Public API, open for use by third party implementors, without reciprocal obligation that the third-party client obtain an “API Key” to identify itself, nor to abide by particular behaviour or rate-limits.
In short: all APIs, both Public and Private, should become “fair game” to third party implementors, and the Platforms should have no business to distinguish between one third-party or another, even in the instance that one or more of them are malicious.
This is a dangerous proposal. Platforms innovate new functionality and change their Private API behaviour at a relatively rapid speed, and there is currently nothing to prevent that; but if a true “right to use” for a Private API becomes somehow enshrined, what happens next?
Obviously: any behaviour which interferes with a public right-to-use is illegal, so it will therefore become illegal to change or remove Private APIs — or at very least any attempt to do so will lead to claims of “anticompetitive behaviour” and yet more punitive lawsuits. The free-speech rights of the platform will be abridged by compulsion to never change APIs, or to support legacy-publicly-used-yet-undocumented APIs forever more.
I don’t want to keep flogging this horse, so I am just going to try and summarise in a few bullets:
Private APIs exist to provide functionality to directly support a platform; they are implemented in ways which reflect their expected (usually: human) modes of use, they are not publicly documented, they can come and go, and this is normal and okay
Public APIs exist to provide functionality to support third-party value-add to a platform; they are documented and offer some form of public “contract” or guarantee of behaviour, capability, and reliability. They are often designed in expectation of automated or bulk usage.
Private APIs do not offer such a public contract; they are not meant to be built upon other than by the platform itself. They are meant to be able to “go away” without fuss, but if their use is a guaranteed “right” then how can they ever be deprecated?
If third parties want to start using Private APIs as if they were Public APIs then the Private APIs will probably need to be re-engineered to support the weight of automated or bulk usage; but if they are going to be re-engineered anyway, why not push for them to become Public APIs?
If some (in-browser) third party tools claim to be acting “for the public good” then presumably they will have no problem in identifying themselves in order to differentiate themselves from (in-browser) evil cookie-stealing malware and worms; but to differentiate themselves would require use of an API Key and a Public API — so why are the third-party tool authors not calling to have the necessary Public APIs?
Just because an academic says “I wrote a script and I think it will work and that I [or one of your users] should be allowed to run it against your service without fear of reprisal even though [we] don’t understand how the back end system will scale with it”— does not mean that they should be permitted to do so willy-nilly, not against Facebook nor against your local community Mastodon instance.
Another data broker is telling me that they have a „legitimate interest“ in scraping and selling my data because they need to for their business. 🙄 That is not enough.
When someone claims legitimate interest, they have to show that your rights and freedoms do not outweigh their interests. „We want to because money!“ does not quite do that!
À #VIGINUM, nous avons pour mission de détecter et caractériser les manipulations de l'information impliquant des acteurs étrangers dans le débat public français.
Nous recrutons un•e développeur•se fullstack pour renforcer le pôle technique. Au programme, pas mal de #scraping et de collecte de données mais aussi développement d'outils en interne.
@f_moncomble@linguistics I sure scraped my bit of data for linguistic research, but I am contemplating how ethical it is. Is #scraping justified for research purposes, and not for commercial goals? Who is responsible for the data that is scraped with your tool? I think that is an interesting discussion to have?!
I understand the importance of alt text for images. But as I was drafting my image description just now a question occurred to me – in adding alt text to images am I also inadvertently making it easier for the AI bots to scrape my artwork?
It's SO strange to me how people are so adament that they don't want their data being sold/abused.
Yet, we have a literal data harvester in front of our own eyes with NewsMast out in the open using Fedi posts for their "news app" and nobody is blinking an eye...🤦♂️
@BeAware – All data that is publicly available on a website will be scraped for commercial use, violating intellectual proporty rights and data privacy rights. Such is the nature of today's Web, and the Fediverse is a part of it. #DataPrivacy#Fediverse#Scraping#CommercialUse
Just spent at least two hours deleting all of my work from Tumblr, before their AI scraping shit hits the fan, although it's probably too late. In that case, the deletion functions as a gesture of protest.
This shameless large-scale intellectual property theft by greedy tech business assholes everywhere is starting to make the internet pretty annoying. 😖
"Politico has given its Europe, German and French websites a redesign which improves readability for the web crawlers that feed into generative AI large language models (LLMs)."
None of these people exist, but you can buy their books on Amazon anyway. Here's an article on Amazon authors with GAN-generated faces and the books these authors publish (which appear to be almost entirely devoid of original human-created content).
If for whatever reason you never wish to interact with #Threads, you can personally block it for your account. This hides all posts and profiles from Threads, prevents anyone from Threads from following you, and stops your posts from being delivered to or fetched by Threads. Simply click the "Block domain threads.net" option on any Threads profile or post you see in Mastodon.
@tasket If they want to #scrape all your information, they will, it is publicly available on the internet. Wouldn't be surprised if they already did it with their AI. No, it does not matter if you add no index to your robots.txt or profile.
If you want to get started doing Web scraping with Python, this tutorial is very well done.
By Cody Winchester for the NICAR @IRE_NICAR (National Institute for Computer Assisted Reporting - that is, data journalism) conference early this year https://github.com/cjwinchester/nicar23-python-scraping
I've said this before, but I will say it again: those of you doing research on the fediverse using #scraping techniques or #APIs, keep in mind that this place is not 1 thing, but 10s of thousands of communities, each with their own terms/codes of conduct. So just grabbing all the posts you can likely violates many communities' norms or terms.
@i0null
> I'm no advocate of IP law but commercial derivatives should absolutely be compensated, especially given the market capital of these companies
A New Tool Helps Artists Thwart AI—With a Middle Finger.
Kudurru, the new tool from the creator of Have I Been Trained?, can help artists block web scrapers and even “poison” the scraping by sending back the wrong image. #scams#scam#scammers#spam#cybersecurity#data #artists#creators#scraping
...23andMe officials... confirmed that private data for some of its users is... up for sale. The cause of the leak... is data scraping, a technique that essentially reassembles large amounts of data by systematically extracting smaller amounts of information available to individual users
The crime forum post claimed the attackers obtained “13M pieces of data.”
This week on my podcast, I read my recent @medium column, "How To Think About #Scraping: In #privacy and #labor fights, copyright is a clumsy tool at best," which proposes ways to retain the benefits of scraping without the privacy and labor harms that sometimes accompany it:
If you'd like an essay-formatted version of this thread to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:
So I have a collection of cartridges from US, Europe, and Japan. I've extracted ROMs from all of them I can so far and I'm trying to come up with a collection folder I can backup that can be dropped into an emulator frontend (e.g. Emulation Station) with correct information....
Recommended emulator frontend + scraping tool for multiregion collection?
So I have a collection of cartridges from US, Europe, and Japan. I've extracted ROMs from all of them I can so far and I'm trying to come up with a collection folder I can backup that can be dropped into an emulator frontend (e.g. Emulation Station) with correct information....