Is legal to use contents retrieved from a not protected url (no authentication involved, just a public accessible URL) from the content owner's server?
Is legal to distribute urls pointing to that resources? Is legal to develop applications using that contents?
In the past I would have said, "All answers point to yes".
However, due to the somewhat recent sentence handed to Andrew Auerheimer last year, I would say the answer is "no".
http://www.net-security.org/secworld.php?id=14614
"The facts are simple. In June of 2010, Andrew Auernheimer’s co-defendant Daniel Spitler discovered that AT&T’s servers were publishing email addresses of iPad subscribers on the servers authentication log in page when queried with a SIM card number that matched an existing AT&T subscriber’s SIM card number. Upon discovering this, Spitler wrote an iterative script that queried AT&T’s publicly accessible iPad servers and copied over 120,000 email addresses. No password or any type of security was ever hacked, nor was any attempt ever made to hack any password or bypass any existing security measures. In essence, what Spitler’s script did could be done by anyone with a web browser who entered in the right combination of numbers into a URL,"
"If merely visiting an unrestricted web page to copy an email address counts an unauthorized access, the legal line between intrusive hacking and testing websites for vulnerabilities--or merely visiting a website at all--could be blurred"
The answer is often no as pointed out by k1DBLITZ. Consider also the insecure direct object reference exposed by Australian information security professional Patrick Webster. He was visited by NSW Police officers following his disclosure of an embarrassing Web application security bug to his superannuation fund. Details here - http://risky.biz/fss_idiots.
As commented, 'legal' varies by jurisdiction and should be addressed by a qualified lawyer. These examples do support doing just that.
