Hacker News new | past | comments | ask | show | jobs | submit login

This raises an interesting theoretical question:

If you develop a web service and make it accessible from the public internet, what restrictions should you be allowed to place on its usage? And what should the consequences be for individuals trying to bypass those restrictions?




> If you develop a web service and make it accessible from the public internet, what restrictions should you be allowed to place on its usage?

Whatever you want. Public API access =! protected right.

> And what should the consequences be for individuals trying to bypass those restrictions?

Denial of future access by technical means.


I agree if you mean "whatever [technical] restrictions you want".

However, providing the tools that allow instituting legal restrictions is a big can of worms; property rights just don't apply cleanly to client/server communications.


I agree that legal restrictions carry little to no weight in the technical world (I'm not arguing if they should or not, just if the do).

The solution is to require API accounts, which you can then monitor and terminate with prejudice. Tie the account to something unique-ish, or difficult to constantly cycle (SMS? check provider, deny if Google Voice, Twilio, has to be a physical carrier if we're talking messaging client).

The law may eventually catch up to tech. Maybe.


They don't apply cleanly to real property either which is why people who own property have 'people with guns' (gov't technical solution) to resolve any disputes about who's property it is.

Similarly when someone uses a server in a way you don't like you send 'people with guns' to resolve any disputes, because in this case lawyers are believed to be cheaper than changing the server.

This isn't about the ideals of law and power, it's about getting people to stop doing things you don't like, apparently WhatsApp chose a reasonably effective strategy.


In this case they do. When you access my API, you're accessing my server, my property. If I have decided that I do not want you accessing that, it's no different than if I have decided I do not want you on my land.

Not everything is special simply because it's digital.


In a hypothetical world in which SaaS has taken over the market, and 3rd-party clients are forbidden by virtue of license agreements, interoperability becomes impossible.

Imagine if Windows Server had been SaaS; Samba would never exist, Mac OS X and Linux couldn't operate in a Windows environment.

Where property law falls down is when we consider what it is you're selling -- access to a service, or a fully controlled end-to-end service agreement where you assert control over both the client and server.

If it's the latter, does this create a healthy market, or does it create something that could never exist before: the ability to create a "natural monopoly" on an individual customer level. That is, once people are invested in your platform, the cost to compete for that person is so high that it creates a nearly unassailable barrier to entry?

Pre-SaaS, if someone wanted to compete with Microsoft Office, they could invest the effort supporting the Office file format to ease customer transition.

Post-SaaS, if Google Docs, Office 365, et al disallow data/API access to third-party clients, supporting your competitors' existing customers becomes impossible.


If you don't want someone using your API, then return 403 Forbidden. It's more efficient than strongly-worded letters.


It depends on why you've decided. If it's by some predetermined rule that applies the same to everybody, it's probably OK. If it's something like "I didn't like that comment supporting same sex marriage you posted on my blog" maybe not. At what point are APIs considered public accommodations?


So if i have a library that implements your API should that also be illegal?


Though I doubt it'll be a popular opinion, you should only place whatever restrictions you can technically enforce.

Anything else basically ends up a) not working and b) requiring government intervention of one sort or another, eventually, and that harms everyone.


In the non-digital world, you can't enforce that people won't murder each other... should murder not be restricted?


This is an absurd comparison.




Consider applying for YC's first-ever Fall batch! Applications are open till Aug 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: