Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

zatanna.ai

Post reply on HN
Print view View original

51–60 of 97 posts

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#51

Post by teraflop »

alexblackwell_ wrote: post #44
5701652400 wrote: post #38

smeels like severe breach of ToS. virtually every single website and app mandates not to reverse engineer and not to temper with inner workings (including client-server networking). side note, YC25/YC26 batches have multiple startups that blantly violate ToS and sitting on a timebomb just pending a lawsuite and Cease and Desist Letters.

The goal is not to scrape sites en-masse, but to allow people to automate their existing workflows and actions that they perform already via a browser. I understand the concerns around this being unethical, and it's something I spent a lot of time thinking about when I worked on automations previously. I've written a decent amount about how I don't think that sneaker bots or ticket bots are ethical. I don't support m…

> Is using puppeteer to automate a form submission a violation of ToS? If so then why is using a screen reader not?

Without taking a position on the ethics of automation, surely this isn't a serious question? Things that the ToS prohibits you from doing are ToS violations, and other things aren't.

For instance, from AirBnb's terms of service: "Do not use bots, crawlers, scrapers, or other automated means to access or collect data or other content from or otherwise interact with the Airbnb Platform."

There is no similar prohibition against using screen readers.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#52

Post by bbg2401 »

> Because Kampala is a MITM, it is able to leverage existing session tokens/anti-bot cookies and automate things deterministically in seconds

If a web property has implemented anti-bot mechanisms, what ethical reasons do you have for providing evasion as a service?

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#53

Post by alexblackwell_ »

teraflop wrote: post #51
alexblackwell_ wrote: post #44

Earlier quoted context omitted.

The goal is not to scrape sites en-masse, but to allow people to automate their existing workflows and actions that they perform already via a browser. I understand the concerns around this being unethical, and it's something I spent a lot of time thinking about when I worked on automations previously. I've written a decent amount about how I don't think that sneaker bots or ticket bots are ethical. I don't support m…

> Is using puppeteer to automate a form submission a violation of ToS? If so then why is using a screen reader not? Without taking a position on the ethics of automation, surely this isn't a serious question? Things that the ToS prohibits you from doing are ToS violations, and other things aren't. For instance, from AirBnb's terms of service: "Do not use bots, crawlers, scrapers, or other automated means to access or…

My broader point is that these ToS clauses are often so broad and vague that they're essentially unenforceable and not meaningful in practice. For example, "Do not use bots" covers a pretty substantial amount of ground, and intention isn't exactly something you can screen for. Is an autofill chrome extension a bot? If so what separates that autofill from accessibility extensions? Is someone using Whispr flow to fill forms considered a bot? AirBNB doesn't block Google's crawler. Why? A company can enforce its TOS as it wishes. My general point is that the waters are murky, and that automation is a sort of sliding scale.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#54

Post by alexblackwell_ »

bbg2401 wrote: post #52

> Because Kampala is a MITM, it is able to leverage existing session tokens/anti-bot cookies and automate things deterministically in seconds If a web property has implemented anti-bot mechanisms, what ethical reasons do you have for providing evasion as a service?

I wouldn't consider what we do evasion really. We are using real tokens that you have received from your browser as a result of browsing the web. Any good anti-bot will have enforcement for abuses of that token.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#55

Post by alexblackwell_ »

doc_ick wrote: post #45
alexblackwell_ wrote: post #31

Earlier quoted context omitted.

Definitely get that. Being hammered by scrapers is a massive PITA (especially with latest aggressive AI crawlers). We focus primarily on allowing people to automate their existing workflows. For all hosted workflows we have rate limits to prevent mass scraping/affecting server workload in any real capacity. In fact, because we don't load js/html and hit endpoints directly I would guess that we consume less server res…

Oh no I’m not worried about the resources or rate limits. If I’d make a mobile app and users simply use your automation service instead of my mobile app, I’d lose traffic/money/motivation to improve it. If they run into issues from your service now it could make my app look bad while the error isn’t with the app. See tailwind for an example tale.

The requests still route through your servers/the data still lives with you. Kampala is a powerful tool but I don't see people replacing the actual apps with it. Most of our customers use it for automating repetitive actions in legacy dashboards.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#56

Post by ImPostingOnHN »

teraflop wrote: post #51
alexblackwell_ wrote: post #44

Earlier quoted context omitted.

The goal is not to scrape sites en-masse, but to allow people to automate their existing workflows and actions that they perform already via a browser. I understand the concerns around this being unethical, and it's something I spent a lot of time thinking about when I worked on automations previously. I've written a decent amount about how I don't think that sneaker bots or ticket bots are ethical. I don't support m…

> Is using puppeteer to automate a form submission a violation of ToS? If so then why is using a screen reader not? Without taking a position on the ethics of automation, surely this isn't a serious question? Things that the ToS prohibits you from doing are ToS violations, and other things aren't. For instance, from AirBnb's terms of service: "Do not use bots, crawlers, scrapers, or other automated means to access or…

> For instance, from AirBnb's terms of service: "Do not use bots, crawlers, scrapers, or other automated means to access or collect data or other content from or otherwise interact with the Airbnb Platform."

> There is no similar prohibition against using screen readers.

A screen reader uses automated means to access or collect data or other content from or otherwise interact with a platform.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#57

Post by kay_o »

alexblackwell_ wrote: post #11
Barbing wrote: post #5

Zatanna Kampala (had to double check it wasn’t Harris) Just mulling these names over, how’d you come up with them? PS: clear value prop!

Zatanna is a DC comic book character. I’m not sure if either of us have even read comics, so not sure where that came from. For Kampala, when I started this I was trying Conductor for the first time. The generated workspace name was Kampala (the capital of Uganda). We even have a 3rd name. We actually incorporated as NoPoll. That one’s a bit less inspiring though lol.

Gotta ask, did you talk to legal in any way before naming your company after someone's IP

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#58

Post by ImPostingOnHN »

5701652400 wrote: post #40

so if API is published, there is nothing to reverse engineer. and if API is not published, and you MITM with self-compromised CAs, and then use it (commercially?) you ~100% breaking ToS. this is just un-ethical. or YC does not have regard anymore for such things?

Some people may believe in equal measure that intentionally trying to break interoperability is unethical. Especially if it's my data.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#59

Post by bbg2401 »

alexblackwell_ wrote: post #54
bbg2401 wrote: post #52

> Because Kampala is a MITM, it is able to leverage existing session tokens/anti-bot cookies and automate things deterministically in seconds If a web property has implemented anti-bot mechanisms, what ethical reasons do you have for providing evasion as a service?

I wouldn't consider what we do evasion really. We are using real tokens that you have received from your browser as a result of browsing the web. Any good anti-bot will have enforcement for abuses of that token.

But as mentioned by another reader, that would almost certainly violate the ToS of the web property subject to the automation. It's almost indistinguishable from session hijacking as far as that property is concerned. And it certainly isn't intended usage.

Indeed, it would likely be classed as a violation according to your own ToS.

It's a delicate matter as we all deploy personal automations that break ToS without us really giving it a second thought. But as a commercial endeavour, it feels brazen, I'm sorry to say.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#60

Post by janalsncm »

teraflop wrote: post #51
alexblackwell_ wrote: post #44

Earlier quoted context omitted.

The goal is not to scrape sites en-masse, but to allow people to automate their existing workflows and actions that they perform already via a browser. I understand the concerns around this being unethical, and it's something I spent a lot of time thinking about when I worked on automations previously. I've written a decent amount about how I don't think that sneaker bots or ticket bots are ethical. I don't support m…

> Is using puppeteer to automate a form submission a violation of ToS? If so then why is using a screen reader not? Without taking a position on the ethics of automation, surely this isn't a serious question? Things that the ToS prohibits you from doing are ToS violations, and other things aren't. For instance, from AirBnb's terms of service: "Do not use bots, crawlers, scrapers, or other automated means to access or…

Under that ToS would a screen reader not be considered “other automated means” of “interacting with” the platform? It is automatically walking an accessibility tree.
Post reply on HN