Pastebin: getting unlisted paste without authentication

[wayneyaoo]

Hi, just wanna confirm if this is by design.

So I see an API to retrieve the entire Pastebin of a given account. Assume the token is for the user, I observe the following: If bearer token is passed, all (including unlisted) pastes will be shown; If no token is passed, only "listed" (I interpret this as "public") pastes are shown.

Then in another API of retrieving a specific paste. If the paste is "public", whether or not token is passed, it'll be returned. This makes sense. But if the paste is unlisted (is it equivalent to private?), not passing a token will still get it. Is this by design?

If it is, it's a little bit weird since the "list all" API is access controlled but "getting one paste" is not. (Though it still makes sense.. since pastebin is by nature a somewhat "public" service. Do we need to consider removing the ACL on "list all" API?)

if it is not, I'll need to file a bug?

[newbold]

It’s by design, yes. Everyone can access any paste if they know the paste name, whether via the web interface or the API. And if you know a person’s address, you can view their listed pastes — again, via the web or the API. But the only way to view a full list of all pastes (including unlisted ones) for an address is to either be logged into the web interface or use an API key. With this design, access to information is consistent across web UI and API.

[wayneyaoo]

Cool thanks for confirming.

But the only way to view a full list of all pastes (including unlisted ones) for an address is to either be logged into the web interface or use an API key.

Why is it designed that way? Essentially every paste is public. It's just whether you can figure out the name. Why not just .. list everything to be consistent? 😀 but yeah it's nitpicking.

[wayneyaoo]

Oh to be clear, the "consistency" I refer to is from consumer perspective, not the paste owner. From consumer perspective, he might be given a paste name but when he tries to find the paste when listing the pastebin, it'll be a bit confusing if he couldn't find it.

[newbold]

The distinction is between “public” and “promoted”. Listed pastes are actively promoted; their owners want to actively share them with others. All other pastes, while publicly available, are not actively promoted. To include them all in an unauthenticated API response would kind of miss the point of having the “listed” feature.

A while back, the phone company used to publish a written directory of people’s phone numbers. Technically every phone number is “public” (since you can just punch in the numbers and call them), but many people didn’t want to be included in the telephone directory for various reasons. It’s a similar situation with the pastebin; every paste is technically public but not everyone wants to advertise or promote the existence of some or all of their pastes.

I hope this helps!

[wayneyaoo]

Understood. So this is not between "public" and "private" but "promoted" and "not promoted". Thanks! That makes a lot sense now.