> Seeing all Reddit apps shut down, I can't help but wonder — what is it that made everyone play by the rules? What happened to the adversarial interoperability spirit? What forces people to use their own API keys instead of pretending to be one of the official apps?

The official reddit app uses a seperate, undocumented graphql based api rather than the public REST one they allow for public use. I suspect someone is/will be already using it to emulate the 'old' API soon enough.

Stealth ( https://f-droid.org/en/packages/com.cosmos.unreddit/ ) has an optional access mode that works by scraping old.reddit.com, that still works.

Why is not being able to log in a feature? Reddit is terrible when you can't block the mainstream subreddits.

Imagine you use an unauthorised client and you post a lot of thoughtful content. Really pouring your heart and soul into that account. And then one day a few months from now, boom u/spez (CEO of Reddit) has another genius business insight for the direction he wants to take Reddit. Next day they’ve banned the accounts of everyone who’s been found to be using unauthorised clients.

Better to stay logged out if you’re gonna browse with an unauthorised client.

Besides, the client could keep a list of subreddits you like anyway, and retrieve posts from those instead of from the default front page.

Worst reddit can do then is to IP ban you bat at least they won’t be deleting anything that you’ve been spending time to write.

I may be an outlier but I never bother with the reddit front page - I go direct to specific subreddits and read them one at a time.

You can still follow or block subreddits without needing to log in, only those blocks would be local to the app, not synced to your account.

There didn't use to be any rules to play by. Official "front door" APIs are a modern phenomenon. They started being offered, and rugpulls were rare, so we got complacent and started using them rather than reverse engineering first-party APIs.

We didn't "get complacent", APIs are just a better experience. You get documentation, guarantees of stability, advance warning for changes, a changelog, etc.

Even factoring in the risk of a rug pull, it makes more sense to use an API than spend ongoing constant effort reversing a first-party one that will keep breaking on your users randomly and need urgent fixes all the time.

In the one non-open-source company I worked at, the first-party API was an extension of the public API. Some methods took additional internal-only parameters if you were using one of the official app IDs, for example. Some returned additional fields in responses. A bunch of additional internal-only methods also became available.

I mean, if you have a public API, it makes sense, engineering-wise, to build your internal API on top of that, doesn't it? But apparently not everyone does it like this.

It's a bit more nuanced than that. Breaking changes are a lot harder once you have third-party clients, and redesigns are even harder.

So, for example, if those clients have only a fraction of the features of your internal clients, it may make sense to relegate them to a separate, stable backend service while you work on your internal one. But if there's just a couple of internal methods and everything else has to be public, it probably makes sense to have a single backend.

There's a lot of in-between cases, and that's where an engineering architect shows his skills in choosing the right approach.

That's basically how reddit works. I've implied this in comments on reddit[1], but there is basically no way for reddit to do what it wants to do with non-OAuth clients.

Old reddit for example uses the reddit API essentially directly. now with new reddit, there's been a split, and it looks like from my count that reddit is currently supporting like 7 different APIs internally, parts of them all used in various different places. The reddit API is pretty functional and most of what anyone would ever really want to do was already supported in the API (and therefore available basically with few current restrictions).

Few of the actual undocumented/internal APIs on reddit are all that interesting.

[1]: https://www.reddit.com/r/redditdev/comments/14nbw6g/updated_...

Most apps back then weren't staffed by hundreds/thousands of people with a giant legal team to enforce trademarks either.

Yes but there's definitely some kind of "fair use" allowed for trademarks. My own observations show that it's fine for a product to claim it's "for" or "compatible with" someone else's trademarked product. One example is third-party coffee capsules "for Nespresso machines", usually accompanied by "not affiliated with Nespresso". I'm sure Nespresso has an army of lawyers but these things continue to be sold all around the world so it must be legal to do this.

In that specific case, it's because Nespresso's patent on the capsule design ran out and they can't stop other people from selling compatible capsules anymore. While they still had the patent, they went after third-party capsules pretty aggressively. There is no "fair use" clause for patents or trademarks the way there is for copyright, but patents expire much faster. (Trademarks do, too, although they can be renewed indefinitely -- but you have to do it affirmatively every 10 years in the US.)

With the necessary "not a lawyer" disclaimer in place: in the case of Reddit's APIs (or anyone else's), AFAIK the issue wouldn't a trademark or patent issue, per se -- an API can't be patented (or trademarked), and it's debatable whether they can be copyrighted. (A case between Oracle and Google involving Java's APIs made it all the way to the Supreme Court, which kind of punted on making a definitive legal decision as to the copyrightability of APIs.) But, making unauthorized use of them could almost certainly be classified as a breach of contract, e.g., a violation of the end-user license.

This happened to my preferred reddit app: reddit is fun. They changed their name to "rif is fun for reddit". Still want reddit in the name to show up in searches.

> What forces people to use their own API keys instead of pretending to be one of the official apps?

The fact that without the associated secret, an API key is useless.

What do you mean by that? An API key usually is the secret. And everything needed to access the API must by definition be contained in the client app, so it's only a question of reverse engineering enough of it to extract these parameters.

This is why I get paid big bucks to investigate and remediate security problems in applications and systems.

It is technically impossible to embed a "secret" into something you allow everyone to download, and expect it to stay secret forever. This is called security through obscurity and it isn't real security.

This I know. What keeps me employed is knowing how to construct a client that doesn't embed a secret yet manages to perform an authorization flow.

This is in-fact the precise use case of secure enclave remote attestation. Maybe the GCHQ will be able to run their own Reddit clients, but the average person or even experienced hacker will not.

I have no idea what cratermoon is intending to talk about, but the usual way to solve this problem is attestation. At a high level, the client device has the secret, but it is embedded in a secure enclave that makes it difficult to extract. You then build a chain of trust from that secret that attests that the binary being run is the official one.

Android (at least with the standard Google services) seems to provide an implentation of this through the play integrety API [0]. I'm not familiar with the internals of that system, but I have worked on this type of system for a much more constrained use-case.

If I were designing this, my first pass at a napkin design would be:

* Devices running the app must have a TPM. This TPM is loaded with a private key that is intended to remain highly secret. Corresponding public key is well known.

* During boot, "everything" is measured into the TPM's Platform Configuration Registers (PCRs). To measure something into a PCR, you update the PCR value as: PCR[n] = hash(PCR[n] || measured_value).

* The TPM does not (in this use-case) have a notion of what the "correct" values of the PCRs are. However, it can use the secret key to sign the PCRs values. Forging this signature would require either breaking the underlying crypto, hacking the TPM, or learning the secret key contained within the TPM. To prevent replay attacks, the TPM includes a nonce sent by the server.

* The device sends the server a list of what firmware/kernel/OS it is running (everything that was measured into the TPM). The server determines what the PCR values for the claimed configuration should be, and validates the signature that the TPM generated

* You now know that the OS is "trusted", and can now trust the OS to verify that the app is signed by a given public certificate and is running in a sufficiently secure environment.

[0] https://developer.android.com/google/play/integrity

Why authenticate the device and not the user?

How does authenticating the user help? The whole point of the exercise is to block 3rd party apps. It is assumed that the user is authorized to access Reddit through the first party app, so authenticating the user doesn't solve the issue.

That's how oauth2 works. If the app isn't registered with reddit, it doesn't get to act on behalf of the user. No app secrets are necessary, just the user's login credentials, which the app never sees. The resource owner (reddit in this case) can allow or disallow based on the client_id (which is not a secret) and the redirect_uri registered for the app. Reddit, twitter, google, github, apple, and dozens of others handle apps this way.

Client_id is spoofable.

Redirect_uri helps with webapps that run on a standard web browser. However, if the client is not a web app (or, is running under a properly modified web browser), it can simply ignore the redirect.

Oauth2 does contemplate a client_secret field for client authentication. However, such a field is useless on public clients.

The oath2 spec is very explicit that client_id can not be used as a means of authenticating clients.

>What forces people to use their own API keys instead of pretending to be one of the official apps?

https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

That's in the US though. It's known that the US government does its best to protect the interests of corporations. There are other countries, in some of which reverse engineering something for the purpose of interoperability is explicitly allowed.

edit: looking at the list of cases, and knowing that the US legal system relies on precedents, it feels like using an online service's private API is allowed under this act.

Yes, as far as I can tell terms of service violations resulting from things like scraping/using unofficial APIs are not CFAA violations and certainly not criminal unless you are not supposed to have access to the data in the first place. The company may still sue in civil court but it has to be on other grounds. Which is why hiQ "lost" to LinkedIn and settled even though they won on the CFAA issue. And why Plaid is still in business.

The important thing is that it was suggested to use API keys which you are not authorized to use. Just because the keys are technically public it doesn't mean that you are authorized to use them.

If someone uploads their AWS token to Github it isn't legal to use it even if it was made public.

> If someone uploads their AWS token to Github it isn't legal to use it even if it was made public.

I'm pretty sure these kinds of services where you can incur significant charges by using the API have a stipulation in their ToS that any API calls performed with your key are considered to be made on your behalf. Kinda like banks do with online banking, "everything done online under your login is considered as if you've done it at a branch with paper forms". Regardless of laws it's still your own responsibility to protect your credentials.

Thank god for that act. Otherwise there might be fraud on the internet

Because all people comply with the law, especially the ones considering doing fraud on the internet

Why doesn't youtube-dl break this law?

Isn't it do similar operations to extract videos from websites?

They tried to shut down youtube-dl on copyright grounds because iirc the unit tests included URLs for some music videos and breaking their "DRM" constituted a DMCA violation or something like that. That was the only attempt I'm aware of.

You would have to give up oauth no? If you do, your users need to trust you with their username and password. Maybe most wouldn't care.

>> It wasn't always like this. 15 years ago, when ICQ was huge, everything with a screen, keyboard, a network interface, and a way to run arbitrary code had an unofficial ICQ client for it. Most people haven't ever seen the official clients. That's just one example. What happened?

Crony capitalism and big tech monopoly is what happened. These companies achieved success by doing innovations once but today they no longer want to work the hard route of innovating things. Instead, they're using the "legal" and convoluted route that involves closing the source code or build processes of everything, acquiring the small competitor who tries innovation and shut it down, encouraging walled gardens and non-standard APIs everywhere, etc.

That's part of what happened, but I think the reason that crony capitalism happened in the first place was the demographics changed. Companies don't "want" do to anything but exploit something to make a profit.

When ICQ was huge, it wasn't your average joe sixpack using the internet. Now that it is, there's a lot of money to be made.

from my own personal experience, reddit's legal team sends you a threatening email demanding that you take down your site stating that you have violated some tos/agreement

You should post that somewhere

Not an expert, but I wonder if all the redditors who would be mad about it have already jumped ship and gone to federated alternatives, and all the redditors who are left are the ones who don't care and are watching the chaos with popcorn.

If you're asking about the moderators, they were forced to either reopen or be un-modded. They did what they could.

What alternatives? I am here because I lost access to Reddit.

Lemmy is not a replacement. A totally different experience for every sub-Reddit is not going to work.

Reddit was pitched as The Front Page of the Internet. Where is the front page of Lemmy?

> Reddit was pitched as The Front Page of the Internet. Where is the front page of Lemmy?

https://wefwef.app

> Lemmy is not a replacement. A totally different experience for every sub-Reddit is not going to work.

Not sure what you mean.

Probably means [this](https://tenforward.social/@elight/110708424512879073) and [this](https://tenforward.social/@elight/110696839817687860).

There's a bit of conflating terms but the underlying point makes sense: topics shouldn't be linked with an instance, they should reach across different servers. This is what groups are for, and are being actively worked on.

"Groups... are being actively worked on."

Where? By who? For what platform? Show me?

You're welcome on Sqwok (https://sqwok.im), it's chat based, in active dev

If that's you idea of a Reddit replacement, then you've been using Reddit very different from most people.

The issue with replacing Reddit is that you need millions of users to crowd-source all that information that has gone into every minor sub-reddit. I don't think it's sub-reddits like /r/askreddit, /r/pics or /r/politics that people would be missing in a Reddit clone. It's all the small specialized sub-reddit, where you could get help fixing a lawnmower or debate the finer points of the various aspect ratios of national flags.

I've never claimed it was a replacement, it's a new experience focused on what I believe is a shortcoming with current social media sites in that they aren't optimized for live discussion.

For instance you mention "debate the finer points of various aspect ratios". Current social networks are not very good for actual debate, in fact the genesis of Sqwok can be traced to a live debate in r/worldnews where I grew tired of refreshing the page. Many of the alternatives popping up for both Twitter & Reddit are cloning the underlying data model and user interface without offering much more.

Sqwok is different in that it couples some of the familiar aspects of existing social networking with high quality instant messaging, designed from the ground up for live public debate and discussion in a new format. Still has a long way to go but I believe there's a place for it.

Usenet? The more I think about it, Reddit is just Usenet with better moderation and voting. The voting doesn't make that much sense in the smaller sub-reddits where you'd typically read all the posts anyway. So that basically just leaves you with building better moderation. Still a hard problem, but not impossible.

If we had spent the time building better NNTP clients, rather than trying to integrate with the API of single company, I think we could have had the possibility at least of having true communities.

NNTP was a bit of a dumpster fire though. Each ISP carrying some groups, or none at all, losing messages left and right ... Those problems cannot be solved with a better client, they were fundamental issues.

Now, if you had said "if we had spent the time building a better NNTP protocol and servers", I would have agreed. In the end, that's basically what the fediverse is.

The fediverse might be technically better, but it's a big mess. Is it PubSub, is it Mastodon, Lemmy, Podcasting 2.0? We're trying to put way to many project and ideas into "The Fediverse" to provide a clear trajectory.

I feel like it would have been easier to fix NNTP. It had at least a clear focus.

Same, I mostly came to HN through search results or links out of Reddit. Once Apollo shut down I pretty much was done - I only ever used Alien Blue and when it got bought, I was off Reddit until Apollo came along.

HN is where I’ll be for my daily news stuff, and I’m actively looking for communities and forums around my more niche interests and hobbies.

No one (within the margin of error) has gone to "federated alternatives". No one cares about "federated" or "decentralised" or any of this nonesense.

I was skeptical too.

Lemmy has grown exponentially in the last few months and I've found it to be an adequate replacement after learning the basics.

I was skeptical about reddit in 2008 and hesitated to leave digg.

The only real pain with Lemmy right now is that it doesn't have all the niche sub Reddits due to lower population. Hopefully that'll change, because that's Reddit's real draw for me, not just shitposting and memes, which Lemmy is now doing a decent job with.

Your broad statement is ridiculous. I am not friends with 3 billions of people, but many people I care about are on the fediverse; everyone (within the margin of error) is on the fediverse. No one (within the margin of error) cares about a tech forum hosted by a VC (from https://whaly.io/posts/hacker-news-2021-retrospective). And yet here we are.

Please don't use only your tech and stats goggles to analyze the situation, understand that we are talking about people with a vast range of experiences and wants and needs.

I thought this as well. I'm apparently a weirdo because I've just used the website for the past 14 years, on both desktop and mobile (though with an ad-blocker), but for all the folks that really love the alternative Android apps, why can't bring-your-own-key be an option?

The fact that they're installing an alternative app kinda makes them super-users of Reddit anyway, so asking them to generate their own personal API key shouldn't be too unreasonable.

It just seems strange that the app would choose to completely shut down instead.

That's what I did. Got a developer API key, patched the 3rd party app, good to go.

Me too, I intercepted the network requests and rewrote the key and token (and user agent ^.^ I wonder if any reddit admins here would recognize it...) in the request to access_token, or whatever the endpoint is idr

Assuming you are on android since you patched the app. Did you manage to do it without data loss? It's annoying to turn on httpcanary every time I launch rif.

Christian (Apollo dev) said that he has asked reddit specifically about letting people use their own API keys in Apollo and reddit said that they wouldn't allow it.

It would lead to a cat and mouse game and Christian is not interested in that. Why should he bend over backwards to improve user experience of a platform that is working actively against him?

> used the website

Do you mean the old one? That's probably also getting scrapped in the near future, I'm guessing.

No, I literally use the new website. It's fine for me.

Because the reality is that reddit doesn't want third-party apps, and wouldn't allow it. Why do you think this is a technical issue? Reddit doesn't want the apps, period.

More like 20-25 years ago

ICQ was the messaging service everyone around me used in the late 00s. The two most popular clients were QIP and Miranda. Then VKontakte introduced instant messaging and ICQ was quickly forgotten. Then, around 5 years later, people started gradually switching to Telegram. Today almost everyone I chat with uses Telegram.

The network effects were very localized, depending on which country you were you would have probably used a different service. ICQ faded out pretty quickly around 2002 where I lived, with MSN, Yahoo, and Google, taking over. I know in the States they also had a lot of AOL and iChat.

Indeed, for the UK at least, the ICQ peak was 98-99 wasn't it?

MSN messenger quickly took over after it was released in '99.

I remember hearing at the time that ICQ remained popular in Russia and other Eastern European countries for much longer than it did in Western Europe though.

> I can't help but wonder — what is it that made everyone play by the rules?

Some developers got free passes. I know of some. Total level playing field.

Why waste energy building tools to support a company that actively hostile to their own users. Might as well spend the energy building for something else, e.g. to support fediverse, which in the last few weeks got a surge of new apps and tools made by developers abandoning reddit.

Well, I myself am building fediverse things since 2019, so... :)

The thing with centralized social services though is that network effects exist. You can't just switch from Reddit to Lemmy or Kbin the same way you can switch between Windows and Linux.

Exactly this. I used to browse Reddit everyday, using one of these third-party apps (the official app and website being close to unusable).

When that app shut down, it just felt natural to leave Reddit behind.

I opened an account on Twitter instead, having never used it before.

The leadership of Reddit always seem to have been hated by the users, but I feel this might be the final straw that sends it the way of Digg etc.

About time it kicks the bucket.

Twitter is not the ship to be jumping to now, though. It's also on fire.

The demise of Twitter is greatly exaggerated.

Whether you believe it'll be fatal or a phoenix-like rebirth, you can't deny it's burning right now.

As a person that's never used Twitter, it's as on fire as it's always been, the people yelling about it just changed but none of them are leaving.

It feels a whole lot like people who threaten to move to Canada every 4 years.

Canada's on fire too

Well doesn’t matter where one stands then, if all is in flames.

I'm just using it for sports news, and it's been great for that (i.e. "wojbombs" for breaking NBA trade news). It's also a great place to get fanarts (anime, gacha games, etc). I don't engage though, only passively use it.

Meh, I just use it to follow certain people who share good content.

At the time I still had the habit to never use my real name, email or address. (Well I was still going to school/studying anyway) I think the assumption was that services were simply there for the creator's benefit. Maybe it's good to remind oneself that a service that is given for free always has a catch unless it's from a non-profit.

Reddit resents its users. We’ve been unpaid moderation staff for the life of the website and admins don’t give us the tools we need to do a good job for free. Good riddance.