5

This question is more about conventional practice, so I don't include the detail about code or environment. It should be applied to all type of API call.

This question was asked on SE exchange, but it is off topic so I repost a new one here as suggested (with adjustment to the question). I don't delete the question on SE to preserve the answers. My GitHub project: https://github.com/hunghvu/dynamic-wallpaper

  1. Let's say I make a call to Lorem Picsum (a public free image API without API key) in my code. My intention is to implement the feature that get a picture from an API call and make it as wallpaper.
  • Is it legal to push the codebase to GitHub public repository (without executable file)?
  • Is it legal to make an executable file and put to release section?

I cannot find any clear information about these, since they don't have Q&A section.

When I look at other APIs like Placeholder or Pexels, it seems like there is a restriction when putting the application to production server, or the application has a high amount of request to the API server, which make senses (rate, access limit, etc).

The thing is, an application, or code snippet, I want to publish are simply out-of-class/personal/student project that I make during spare times. Certainly, it isn't the same as what commercial apps do (high amount of API call, etc); well, unless my repository somehow becomes popular and my application is downloaded/used 1 million times, then it will be a different story.

  1. Because Lorem Picsum uses database of Unsplash, how will this relationship affect the rules? I choose Lorem Picsum because they don't require Authorization, so it is safe to publish code on GitHub (or is it?), and I can ignore the complexity of applying authorization process into the code (I'm learning about API).

  2. For the matter that I asked in question 1 and 2, can they be applied to all public API, or will it vary from one to another?

Improve this question

1 Answer 1

Reset to default
4

  1. As far as I can tell, it's legal, at least until it causes them a problem. Then it might not be.

  2. What Lorem Picsum do around the back is their problem, not yours. You're using their service, is all.

  3. That's too general a question to answer.

As for best practice, I'll consider a similar situation: the NTP Pool Service. They run a volunteer global network of timeservers which no permission is required to use; anyone who wants to may configure their own clocks to sync from the server pool, with no registration or request required, which seems much like the Lorem Picsum service.

They are pretty clear that people who sell equipment, or distribute code, that wants to know what time it is "must absolutely not use the default pool.ntp.org zone names as the default configuration in [their] application or appliance".

Instead, the project has a procedure where any vendor can apply for a pool DNS zone of their own. The Acme Corp. then configures their FooBoxes to get time from [0123].acme.pool.ntp.org. The servers returned by the query are just ordinary pool servers, but because they're reached through a vendor-specific DNS lookup, if/when FooBoxes malfunction and do thousands more NTP queries than they should, this can be detected and mitigated through the DNS. When people sidestep this policy, either deliberately or by failure to know it exists, things can go badly wrong (full disclosure: I wrote the linked article).

So with regard to you and Lorem Picsum, I think the thing to do is ask them what they would like you to do. Be prepared for the answer to take some time coming: if they've not been asked before, it may take them time to formulate policy; indeed, it may even take them time to decide how to formulate policy. Be prepared for them to say no, and honour their wishes if they do so. Don't release code that uses their servers until they have given clear approval for you to do so.

If you allow this relationship to become adversarial, you risk your installed user base suddenly having dead picture links spring up all over, when Lorem Picsum work out how to block your users' requests.

Improve this answer
2
  • Very appreciate the detailed response (and edit). In fact, I tried to find a way to contact them before but since there is no Q&A section as mentioned, they also don't provide the contact information to the representative. I might be able to contact GitHub contributors of the project, but still, I don't know who is the right person to ask. For now, I think I will just publish the code and mention this matter in a README. As this project is for self-learn purpose, it shouldn't cause any big trouble. Still, I ask the questions to ensure that I don't violate anything, as that is important too.
    – Hung Vu
    Sep 3, 2020 at 21:57
  • 1
    @HungVu if you're minded to go that route, at least ship it with the name of the server in a config file, commented out and replaced with a dummy one that doesn't resolve. Instructions for the initial install can include uncommenting the real server. If the project takes off and finds millions of users, at least you won't be responsible for changing all those configs to point at some poor third party server.
    – MadHatter ♦
    Sep 4, 2020 at 5:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.