Zuckerman vs: Zuckerberg: why and how this is a battle of the public understanding of APIs, and why Zuckerman needs to lose and Meta needs to win
Imagine that you’re a cool, high-school, technocultural teenager; you’ve been raised reading Cory Doctorow’s “Little Brother” series, you have a 3D printer, a soldering iron, you hack on Arduino control systems for fun, and you really, really want a big strobe light in your bedroom to go with the music that you blast-out when your parents are away.
So you build a stepper-motor with a wheel and a couple of little arms, link it to a microphone circuit which does a FFT of ambient sound, and hot-glue the whole thing to your bedroom lightswitch so that the wheel’s arms can flick the lightswitch on-and-off in time to the beat.
If you’re lucky the whole thing will work for a minute or two and then the switch will break, because it wasn’t designed to be flicked on-and-off ten times per second; or maybe you’ll blow the lightbulb. If you’re very unlucky the entire switch and wiring will get really hot, arc, and set fire to the building. And if you share, distribute, and encourage your friends to do the same then you’re likely to be held liable in one of several ways if any of them suffer cost or harm.
Who am I?
My name’s Alec. I am a long-term blogger and an information, network and cyber security expert. From 1992-2009 I worked for Sun Microsystems, from 2013-16 I worked for Facebook, and today I am a full-time stay at home dad and part-time consultant. For more information please see my “about” page.
So what is an API? My personal definition is broad but I would describe an API as any mechanism that offers a public or private contract to observe (query, read) or manipulate (set, create, update, delete) the state of a resource (device, file, or data).
In other words: a light switch. You can use it to turn the light on if it’s off, or off if it’s on, and maybe there’s a “dimmer” to set the brightness if the bulb is compatible; but light switches have their physical limitations and expected modes of use, and they need to be chosen or designed to fit the desired usage model and purpose.
The modern equivalent for web-browsers is called Selenium WebDriver and is widely used by both automated software testers and criminal bot-farms, to name but two purposes.
So yes: the tech industry — or perhaps: the tech hacker/user community — has a long history of wiring programmable motors to light switches and hoping that their house does not catch on fire… but we should really aspire to do better than that… and that’s where we come to the history of EBay and Twitter.
History of Public APIs
In the early 2000s there was a proliferation of platforms that offered various services — “I can buy books over the internet? That’s amazing!” — and this was all before the concept of a “Public API” was invented.
People wanted to “add-value” or “auto-submit” or “retrieve data” from those platforms, or even to build “alternative clients”; so they examined the HTML, reverse-engineered the functions of Internal or Private APIs which made the platform work, wrote and shared ad-hoc tools that posted and scraped data, and published their work as hackerly acts of radical empowerment “on behalf of the users” … except for those tools which stole or misused your data.
The eBay API was originally rolled out to only a select number of licensed eBay partners and developers. […] The eBay API was a response to the growing number of applications that were already relying on its site either legitimately or illegitimately. The API aimed to standardize how applications integrated with eBay, and make it easier for partners and developers to build a business around the eBay ecosystem.
On September 20, 2006 Twitter introduced the Twitter API to the world. Much like the release of the eBay API, Twitter’s API release was in response to the growing usage of Twitter by those scraping the site or creating rogue APIs.
an ecosystem of ad-hoc tools that attempt to blindly and retrospectively track EBay’s own platform development would not offer standardisation across the tools that use those APIs, and so would thereby actually limit potential for third-party client development; each tool would be working with different assumed “contracts” of behaviour that were never meant to be fixed or exposed to the public, and would also replicate work
proliferation of man-in-the-middle “services” that would act “on your behalf” — and with your credentials — on the Twitter and EBay platforms, presented both a massive trust and security risk to the user (fraudulent purchases? fake tweets? stolen credentials?) with consequent reputational risk to the platform
But at the most fundamental level: Public APIs exist in order to formalise contracts of adequate means by which third-parties can observe or manipulate “state” (e.g.; user data, postings, friendships, …) on the platform.
By offering a Public API the platform frees itself also to develop and use Private APIs which can service other or new aspects of platform functionality, and it’s in a position to build and “ring-fence” the Public API service in the expectation of both heavy useand abuse being submitted through it.
Similarly: the Private APIs can be engineered more simply to act like domestic light-switches: to be used in limited ways and at human speeds; it turns out that this can be important for matters like privacy and safety.
Third parties benefit from Public APIs by having a guaranteed set of features to work with, proper documentation of API behaviour, and confidence that the API will behave in a way that they can reason about, and an API lifecycle management process with which will enable them to make their own guarantees regarding their work.
The shortest summary of the lawsuit that I have heard from one of its ardent supporters, is that the lawsuit:
[…] seeks immunity from [the Computer Fraud and Abuse Act] and [the Digital Millennium Copyright Act] [for legal] claims [against third parties or users] for automating a browser [to use Private APIs to obtain extra “value” from a website] and [the lawsuit also] does not seek state mandated APIs, or, indeed, any APIs
(private communication)
To make a strawman analogy so that we can defend it’s accuracy:
Let’s build and distribute motors to flick lightswitches on and off to make strobe lights, because what’s the worst that could happen? And we want people to have a fundamental right to do this, because Section 230 says we have such a right. We won’t be requiring any new switches to be installed, we just want to be allowed to use the ones that are already there, so it’s easy and low-cost to ask for, and there’s no risk to us doing this. But we also want legal immunity just in case what we provide happens to burn someone’s house down.
In other words: a return to the ways of the early 2000s, where scraping data and poking undocumented Private APIs was an accepted way to hack extra value into a website platform. To a particular mindset — especially the “big tech is irredeemably evil” folk — this sounds great, because clearly Meta intentionally prevents your having full, automated remote control over your user data on the grounds that it’s terribly valuable to them, and their having it keeps you addicted, so it helps them make money …
And you know what? To a very limited extent I agree with that premise — or at least that some of the Facebook user-interface is unnecessarily painful to use.
E.g. I feel there is little (some, but little) practical excuse for the heavy user friction which Facebook imposes upon editing of the “topics you may be interested in receiving adverts about“; but the way to address this is not to encourage proliferation of browser plugins (of dubious provenance regarding privacy and regulatory compliance, let alone uncertain behaviour) which manipulate undocumented Private APIs.
Apart from any other reason, as alluded above, Private APIs are built in the expectation of being used in a particular way — e.g. by humans, at a particular cadence and frequency — and on advanced platforms like Facebook they are engineered with those expectations enforced by rate limits not only for efficiency but also for availability, security and privacy reasons.
If you start driving these Private APIs at rates which are inhuman — 10s or 100s of actions per second — then you should and will expect them to either be rate-limited, or else possibly break the platform in much the same way that flicking a lightswitch at such a rate would break that lightswitch or bulb.
With this we can describe the error in one of the proponent’s claims: We aren’t requiring any new [APIs] to be installed, we just want to be allowed to use the ones that are already there — but if the Private API is neither intended nor capable of being driven at automated speeds then either something (the platform?) will break, or else there will be loud demands that the Private APIs be re-engineered to remove “bottlenecks” (rate limits) to the detriment of availability and security.
But if you will be calling for the formalisation of Private APIs to provide functionality, why are you not instead calling for an obligation upon the platform to provide a Public API?
Private APIs are not Public APIs, and Public APIs may demand registration
The general theme of the lawsuit is to demand that any API which a platform implements — even undocumented Private ones — should be legally treated as a Public API, open for use by third party implementors, without reciprocal obligation that the third-party client obtain an “API Key” to identify itself, nor to abide by particular behaviour or rate-limits.
In short: all APIs, both Public and Private, should become “fair game” to third party implementors, and the Platforms should have no business to distinguish between one third-party or another, even in the instance that one or more of them are malicious.
This is a dangerous proposal. Platforms innovate new functionality and change their Private API behaviour at a relatively rapid speed, and there is currently nothing to prevent that; but if a true “right to use” for a Private API becomes somehow enshrined, what happens next?
Obviously: any behaviour which interferes with a public right-to-use is illegal, so it will therefore become illegal to change or remove Private APIs — or at very least any attempt to do so will lead to claims of “anticompetitive behaviour” and yet more punitive lawsuits. The free-speech rights of the platform will be abridged by compulsion to never change APIs, or to support legacy-publicly-used-yet-undocumented APIs forever more.
I don’t want to keep flogging this horse, so I am just going to try and summarise in a few bullets:
Private APIs exist to provide functionality to directly support a platform; they are implemented in ways which reflect their expected (usually: human) modes of use, they are not publicly documented, they can come and go, and this is normal and okay
Public APIs exist to provide functionality to support third-party value-add to a platform; they are documented and offer some form of public “contract” or guarantee of behaviour, capability, and reliability. They are often designed in expectation of automated or bulk usage.
Private APIs do not offer such a public contract; they are not meant to be built upon other than by the platform itself. They are meant to be able to “go away” without fuss, but if their use is a guaranteed “right” then how can they ever be deprecated?
If third parties want to start using Private APIs as if they were Public APIs then the Private APIs will probably need to be re-engineered to support the weight of automated or bulk usage; but if they are going to be re-engineered anyway, why not push for them to become Public APIs?
If some (in-browser) third party tools claim to be acting “for the public good” then presumably they will have no problem in identifying themselves in order to differentiate themselves from (in-browser) evil cookie-stealing malware and worms; but to differentiate themselves would require use of an API Key and a Public API — so why are the third-party tool authors not calling to have the necessary Public APIs?
Just because an academic says “I wrote a script and I think it will work and that I [or one of your users] should be allowed to run it against your service without fear of reprisal even though [we] don’t understand how the back end system will scale with it”— does not mean that they should be permitted to do so willy-nilly, not against Facebook nor against your local community Mastodon instance.
I believe Flipboard will prove to be a counterweight to Threads and a prime location for news & pundits (as #Meta does not really desire the latter two on their platforms).
Hat dies Meta nicht im Griff oder möchten sie sich nicht einmischen, weil es ihren Interessen gleicht?!
»Social Media – Auf Facebook organisieren sich hunderte rechtsextreme US-Milizen:
Eine neue Untersuchung spricht von starker Zunahme der Aktivitäten im letzten Jahr. Entsprechende Gruppen sind auf Facebook verboten, Meta hat das Problem offenbar nicht im Griff«
I know #WhatsApp is popular amongst Americans 🇺🇸 who travel outside of the country, but I doubt #Meta will replace #iMessage in the #UnitedStates 🇺🇸 in the near future.
#Apple has already lost to #Facebook Messenger in #America 🇺🇸, so in a sense @zuck has already won.
Tja liebe Leute. Schaut euch das #Fediverse von heute noch mal an.
So wird es #Meta nicht lassen, denn sie wollen Geld verdienen.
Allein schon beim quer Lesen des Beitrags, werden eine Fülle von Befürchtungen der #Fedipact Konten indirekt bestätigt
A lot of people have insisted #Meta isn't getting involved with the #Fediverse to embrace, extend and extinguish it...
... but even before fully implementing Fediverse interoperability in #Threads they're already talking openly about changing its protocols to add features like monetization. 🤔
Text in a screenshot reads as follows: McCue riffed on the idea that fediverse users could become creators where some of their content became available to subscribers only, similar to how Patreon works. For instance, fediverse advocate and co-editor of ActivityPub Evan Prodromou created a paid Mastodon account (@evanplus) that users could subscribe to for $5 per month to gain access. If he’s on board with paid content, surely others would follow. Cottle agreed that the model could work with the fediverse, too. He additionally suggested there are ways the fediverse could monetize beyond donations, which is what often powers various efforts today, like Mastodon. Cottle said someone might even make a fediverse experience that consumers would pay for, the way some fediverse client apps are paid today.
Okay, so another set of stats now that April is over.
As I've said before, I am posting concurrently to Pixefed and Instagram to see what the differences are.
Let's break it down by month first. Here are average likes by month for the year to date:
January - Insta 20 / Pixelfed 8
February - Insta 21 / Pixelfed 8
March - Insta 27 / Pixelfed 11
April - Insta 26 / Pixelfed 9
Year to date, we're averaging 23.7 likes per post on Insta and 9.1 likes per post on Pixelfed.
Interessant, dass eine Institution da jetzt erst drauf kommt. Manche hier wissen das schon seit Jahren.
Weiss auch nicht, aber was neues ist das jetzt nicht. Meta war schon immer ein Höllenloch, wer sich da rumtreibt, lebt einfach hinterm Mond was Content Moderration, Meldemöglichkeiten und Sanktionierungen von Accounts/Postings angeht.
Als Francis Haugen vor dem EU Parlament aussagte, hätten die dort eigtl schon alles wissen können. Da brauchts nicht erst noch ne eigene Untersuchung. Meta ist das Befinden der Nutzer:innen völlig egal, denen gehts halt einfach nur um Profit. 🤷♀️
In another context, there was a discussion, in recent past, that some members of Indian government suggested taking the extreme measure of blocking Proton due to a hoax bomb threat that were sent through Proton Mail. Finally it did not happen.
I believe that that Meta will not pull out of India and the existing encryption standards of WhatsApp will not change for Indian users. With more than 500 million active users in India, the stakes are too high from either side.
I was excited by the #Europe#DMA news back in March, when will we finally be able to communicate with #WhatsApp users from other platforms like #Matrix ?
There is a very simple way to ‘fix’ social media, and that is to make platforms legally responsible for all the content posted on their systems. Yes, it would break the business model of such providers, but isn’t that what’s needed, given that they have consistently shown that they are using their power irresponsibly? #SocialMedia#Meta#Twitter
Edit: it has been suggested that legal responsibility should only apply to content “promoted” by platforms. That seems to be an excellent improvement.
threads is paying people to post with their "bonus program" and yes ofc it's scummy lmao
The Threads bonus is an invite-only bonus program that lets you earn money on your Threads content... Based on the performance [and] number of posts you create.
is this really the vibe we want them bringing to the fediverse???
"Internetplattformen müssen erkennen, dass kreative menschliche Gemeinschaften äußerst wertvolle Ressourcen sind, die es zu kultivieren gilt, und nicht nur Quellen von verwertbarem Rohmaterial für LLMs." -- Judith Donath/Bruce Schneier
Why Meta is looking to the fediverse as the future for social media
“You could imagine an extension to the protocol eventually — of saying like, ‘I want to support micropayments,’ or … like, ‘hey, feel free to show me ads, if that supports you.’ Kind of like a way for you to self-label or self-opt-in. That would be great,” Cottle noted, speaking casually. Whether or not Meta would find a way to get a cut of those micropayments, of course, remains to be seen.
EU is pressuring Meta due to fears of Russian interference in elections (www.theguardian.com)
Action against Facebook owner comes amid deep concerns about how it is dealing with fake news