Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

github.com

Post reply on HN
Print view View original

71–80 of 87 posts

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#71

Post by anon291 »

chatmasta wrote: post #60
anon291 wrote: post #59

Earlier quoted context omitted.

The law will say what qualifies as a browser. Computer programmers are not legal experts lol. The law is not a program. The difference between you accessing it and a computer accessing it makes these things different.

A browser is a user agent, it's some software that makes requests to a server and renders them in a way I can understand. There's no difference between using a screen reader to vocalize content and using an AI agent to summarize it.

Sigh and now you're arguing with me instead of the law, as if I matter.

Bits have color and if you don't know what that means, Google that before responding.

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#72

Post by sureglymop »

loktarogar wrote: post #56

In my experience reverse engineering is often the easy bit, or at least easy compared to what follows: maintenance. Knowing both when and how it fails when it fails (eg in cases like when the API stops returning any results but is still otherwise valid). Knowing when the response has changed in a way that is subtle to detect, like they changed the format of a single field, which may still parse correctly but is now i…

I word say: it depends. I must've wasted days of my life trying to reverse engineer android apps with pinned certificates. It's crazy how hard it has become to just inspect the traffic on my own device that I bought and own.

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#73

Post by loktarogar »

sureglymop wrote: post #72
loktarogar wrote: post #56

In my experience reverse engineering is often the easy bit, or at least easy compared to what follows: maintenance. Knowing both when and how it fails when it fails (eg in cases like when the API stops returning any results but is still otherwise valid). Knowing when the response has changed in a way that is subtle to detect, like they changed the format of a single field, which may still parse correctly but is now i…

I word say: it depends. I must've wasted days of my life trying to reverse engineer android apps with pinned certificates. It's crazy how hard it has become to just inspect the traffic on my own device that I bought and own.

Yeah I feel you on that. I wonder if this can deal with those difficult cases? This would be killer if so

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#74

Post by CPLX »

korkybuchek wrote: post #43
daveguy wrote: post #37

Earlier quoted context omitted.

This analogy is completely off. A closer analogy is someone calls you on your phone letting you know they're here. You were expecting them, so you say "come on in." But, they were at the back door instead of the front door. I don't think anyone would consider that your friend did something illegal.

Yeah, the CFAA doesn't work by analogy unfortunately.

The entire US legal system works by analogy.

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#75

Post by sunbum »

sureglymop wrote: post #72
loktarogar wrote: post #56

In my experience reverse engineering is often the easy bit, or at least easy compared to what follows: maintenance. Knowing both when and how it fails when it fails (eg in cases like when the API stops returning any results but is still otherwise valid). Knowing when the response has changed in a way that is subtle to detect, like they changed the format of a single field, which may still parse correctly but is now i…

I word say: it depends. I must've wasted days of my life trying to reverse engineer android apps with pinned certificates. It's crazy how hard it has become to just inspect the traffic on my own device that I bought and own.

Just setup httptoolkit [0], it just works.

[0] - https://httptoolkit.com/

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#77

Post by franga2000 »

sunbum wrote: post #75
sureglymop wrote: post #72

Earlier quoted context omitted.

I word say: it depends. I must've wasted days of my life trying to reverse engineer android apps with pinned certificates. It's crazy how hard it has become to just inspect the traffic on my own device that I bought and own.

Just setup httptoolkit [0], it just works. [0] - https://httptoolkit.com/

I'm gussing you haven't done this a lot? You can't easily add a cert to the system store without rooting, but then you need to bypass root detection. If the app uses cert pinning, you either need to hook it (also detectable) or patch it (error-prone and again, detectable). If the app is Flutter, you'll need to do some binary patching too.

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#78

Post by buildfocus »

franga2000 wrote: post #77
sunbum wrote: post #75

Earlier quoted context omitted.

Just setup httptoolkit [0], it just works. [0] - https://httptoolkit.com/

I'm gussing you haven't done this a lot? You can't easily add a cert to the system store without rooting, but then you need to bypass root detection. If the app uses cert pinning, you either need to hook it (also detectable) or patch it (error-prone and again, detectable). If the app is Flutter, you'll need to do some binary patching too.

If you have root, HTTP Toolkit will handle most of that for you - it can detect root via ADB, install systems certs automatically, and install Frida & intercept individual app targets with most cert pinning disabled (frida scripts it uses are here: https://github.com/httptoolkit/frida-interception-and-unpinn...).

No manual setup or config, just click a button and done.

Avoiding in-depth detection is left as an exercise for the reader, although there are a small set of existing countermeasures in there. In practice, there is definitely a very long tail of further cases of increasing complexity, with diminishing returns on automated solutions, but it turns out in practice you can automate quite a long way down that path and cover most normal cases.

Flutter is the one awkward case here I've found that doesn't fully work. Very interested to see if there are generalizable automated solutions there, or if the recent fork announcements mean the slow death of flutter anyway...

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#79

Post by Hisoka »

shmatt wrote: post #22
richardzhang wrote: post #17

Earlier quoted context omitted.

We are working on a way to auto-patch internal APIs that change by having another agent trigger the requests. Regarding the legality aspects — really appreciate you mentioning this — we’ve put a lot of thought into these issues, and it’s something we’re continually working on and refining. Ultimately, our goal is to allow each developer to make their own informed decision regarding the policies of the platforms that…

I have to disagree, it is definitely not legal in the US to use unauthorized access points to access authorized data. Thats like saying you're allowed to get into your apartment through breaking your neighbors door and climbing between the windows In the US this is pretty simply covered by Computer Misuse Act and Computer Fraud and Abuse Act, both federal laws Im not claiming you're liable, just surprised no lawyer p…

[dead]

Re: Launch HN: Integuru (YC W24) – Reverse-engineer internal APIs using LLMs

#80

Post by nkrisc »

chatmasta wrote: post #48
shmatt wrote: post #22

Earlier quoted context omitted.

I have to disagree, it is definitely not legal in the US to use unauthorized access points to access authorized data. Thats like saying you're allowed to get into your apartment through breaking your neighbors door and climbing between the windows In the US this is pretty simply covered by Computer Misuse Act and Computer Fraud and Abuse Act, both federal laws Im not claiming you're liable, just surprised no lawyer p…

If my browser is downloading some data, then what’s the difference if my AI agent is doing the same? I’ll even tell you it’s my browser. Who are you to say what qualifies as a browser?

Likely a judge or jury will decide. Law isn’t code.

If it’s two different things then it’s not the same thing.

Post reply on HN