Hacker News Reader

Comment by pfraze | Hacker News Reader

Doctorow is arguing for adversarial interop but also observes that companies shut down APIs due to them becoming data leak vectors and then use that concern to make circumvention illegal. The dilemma is real. You end up with a sense that fair access and security are meaningfully in conflict. Perhaps a bit like the anti-cheating DRM conversation in the RMS state of FOSS thread. I’m also reminded of the free speech vs moderation debate, where the common retort to decentralization by Twitter employees is “you don’t know how impossible moderation will become.”

Im inclined to think the system has to be rearchitected to solve the dilemma such that interop is the default easier option. (And, ideally, makes data security default easier.) Nobody has succeeded at it yet but it’s always the theory I’ve chosen to pursue.

View on HN

> the system has to be rearchitected to solve

If it was obvious how to, we'd be talking about that, but it's not even obvious how to. A process to solve a problem no one knows how to solve can get co-opted and yield something awful, so I am not inclined to start one yet.

Moreover, there must be plenty of room for innovation.

We're all using TCP/IP, which is a great win for interoperability, but also an enabler of proprietary application protocols above it because it didn't try to preclude them. We've missed out on some things though, in the CNLP/OSI side of things, but I'm not familiar enough with them to know just how tragic, if at all, that is -- we're pretty happy with TCP/IP anyways. Do note that no one forced TCP/IP on anyone. The best interop is that which arises w/o the use of force.

>> the system has to be rearchitected to solve

> If it was obvious how to, we'd be talking about that, but it's not even obvious how to

We're in agreement, both on that and on your points on how innovation does happen. Basically all of the decentralization projects in the past ten years, from federation to p2p to blockchains, have been taking a stab at the greenfield approach. None of them have worked in the sense that they displace existing approaches, but I remain hopeful that something useful can come out of it all.

As a fun aside, one of the more interesting semi-adversarial approaches I've seen was Delta Chat [1] which basically put a chat interface on top of email.

1. https://delta.chat/en/

The only thing missing in the "dilemma" is someone, teary, begging us to "think of the children."

"The dilemma is real."

Um, authentication?

The issue with API mass data leaks is unauthenticated access to the data.

Facebook HAS a web-wide authentication service, to heap the irony. Which of course would be sabotaged, but there are of course other means to do basic authentication. The users presumably know their passwords.

That is a fake issue, IMO.

Is it fake? The relationship isn't just between the user and facebook (thus, auth) it's between the user, facebook, and the third-party app. The concern is that the 3rd-parties act maliciously; see the challenges with browser extensions.

I'm not making excuses for the big companies -- I'm just trying to evaluate the challenges properly. If the core of the problem really is the behaviors of 3p apps, the security model for them is what a solution needs to address.

Then you get into... authorization.

Yes, facebook and other social platforms have issues with people snagging account access, usually by shared password vectors, but come on.

This is still basic meat and potatoes auth for a more open social "pan-platform".

Well I'm more thinking of the problem that browser extensions had, where people would make something handy or fun, be granted perms by the user, then get sold to people looking to mine user data. Extension authors get solicitations for these sales constantly, and the sale prices can be really tempting for devs. A friend of mine just made a silly "cursor sparkles" extension and he's mentioned multiple of these emails.

Regardless of how you feel about it, the Cambridge Analytica ordeal was entirely about using benign quiz apps to mine user data, and the pressure that Facebook received was to fix their security. That's a huge incentive to lock down fair access. So if this is the situation, we need to address it if we're going to fix the technical pressures that create monopolies.

that's a user problem. they granted the extension permission to access the data. that's on them. You will never be able to solve that problem. after all a user can just hand out their credentials if they want to.

Facebook's issues stems from the fact they allowed apps in their market to access data they didn't need to function / hide exactly how much access these applications are granted.

the reality here is auth is the solution; for browser extensions we need better UX. if a extension is asking for access to your navigation / page data that needs to be flagged and warned about during the setup flow.

many of these auth systems make the risky API access grants appear extremely benign.

Okay so they have wide authentication infrastructure, that much is obvious. However consider this:

If users, say, want to use an alternative application to view their Instagram posts and Facebook posts, or an alternative application to interact with TikTok, you would, of course, need to authenticate the user against their service to read the APIs, and thats fine, applications can do that with user consent, and of course, if you do that, you can reverse engineer the platforms formats, as described in this article.

The dilemma isn't being able to authenticate a user against an API, its that, if you actually go through and do this, Facebook, TikTok, Slack, or any other service, can use the courts to shut down your business. They have, effectively made this illegal, or at best, legally dubious, through case law and legislation. This was not always the case however, it hasn't always been this way, see Apple reverse engineering Microsoft Office document formats, or Airbnb scraping Craigslist to build their listings.

Reply on news.ycombinator.com