I think Twitter’s OAuth-only Access is a Waste of Time
simplechatter.com
I think Twitter’s OAuth-only Access is a Waste of Time
1–10 of 33 posts
Re: I think Twitter’s OAuth-only Access is a Waste of Time
#2I assume xAuth was put in place for the apps that the user really only accesses directly when they need to change something - things like RSS -> Twitter reposters. In this case an app may not be able to get in touch with a user to inform them they need to authenticate using OAuth. However this could be solved by having the developer email their users to tell them they need to re-authenticate.
Is there an actual reason to use xAuth over OAuth aside from having to put users through the trouble of re-authenticating? You have to have special permission from Twitter to use xAuth but who knows how easily they hand it out.
Re: I think Twitter’s OAuth-only Access is a Waste of Time
#3Twitter's OAuth is a total pain to implement.
If they had just upgraded to OAuth 2.0 like Facebook recently launched, I'd be happy.
Facebook's OAuth can be done in like 10-20 lines of code. Twitter's takes like 100 (in PHP+Curl).
(essentially OAuth 2.0 just relies on https SSL instead of directly encrypting tokens via code before they are sent)
Re: I think Twitter’s OAuth-only Access is a Waste of Time
#4I assume xAuth was put in place for the apps that the user really only accesses directly when they need to change something - things like RSS -> Twitter reposters. In this case an app may not be able to get in touch with a user to inform them they need to authenticate using OAuth. However this could be solved by having the developer email their users to tell them they need to re-authenticate. Is there an actual reaso…
From what I've gathered, if OAuth is the only authentication mechanism and you can't easily redirect a user to a browser and back then xAuth is your best option. Though I suppose you could so something funky like emailing a user a link and have them return back with the PIN (for the Out-of-Band workflow).
Reading the API mailing list it sounds like Twitter is granting xAuth access on a 1-2 week timeline. Though that may be based on the size of the email queues.
Re: I think Twitter’s OAuth-only Access is a Waste of Time
#5Twitter's OAuth is a total pain to implement. If they had just upgraded to OAuth 2.0 like Facebook recently launched, I'd be happy. Facebook's OAuth can be done in like 10-20 lines of code. Twitter's takes like 100 (in PHP+Curl). (essentially OAuth 2.0 just relies on https SSL instead of directly encrypting tokens via code before they are sent)
I haven't worked with OAuth 2.0 yet, but I've been meaning to take a look at it with Facebook's update.
However in Ruby/Rails OAuth isn't that bad using http://twitter.rubyforge.org/ . And aside from a couple hiccups, I haven't had any problems with http://code.google.com/p/oauthconsumer/wiki/UsingOAuthConsum... on iPhone/iPad (I'm using the Browser redirect and re-launching the application from a custom application protocol).
Re: I think Twitter’s OAuth-only Access is a Waste of Time
#6Twitter's OAuth is a total pain to implement. If they had just upgraded to OAuth 2.0 like Facebook recently launched, I'd be happy. Facebook's OAuth can be done in like 10-20 lines of code. Twitter's takes like 100 (in PHP+Curl). (essentially OAuth 2.0 just relies on https SSL instead of directly encrypting tokens via code before they are sent)
Yes, the most painful part is having to copy the pin number manually for non web apps, a real pain. I read twitter is working on the oauth 2.0 spec themselves with facebook and google, so we may get some relief soon.
Re: I think Twitter’s OAuth-only Access is a Waste of Time
#7OAuth is also a huge pain for those "I just want to write a little Twitter API script in 5 minutes" things. To the extent that I've thought about writing a couple lately, but chose not to because I didn't want to deal with OAuth (and they were scripts I'd want to work in the future).
It seems like there should be some solution that lets me use basic auth for those little scripts. Maybe tell Twitter IP's from which I want to be able to use basic auth? It would be a bit of a pain since most people have dynamic IP's, but it would be better than nothing, and it would at least make it simple to run basic auth scripts on my VPS (which obviously has a static IP).
Re: I think Twitter’s OAuth-only Access is a Waste of Time
#8OAuth is also a huge pain for those "I just want to write a little Twitter API script in 5 minutes" things. To the extent that I've thought about writing a couple lately, but chose not to because I didn't want to deal with OAuth (and they were scripts I'd want to work in the future). It seems like there should be some solution that lets me use basic auth for those little scripts. Maybe tell Twitter IP's from which I…
One pain point I've had since switching from Basic Auth has the lack of debugging via a terminal and curl. That was pretty useful.
For Ruby-minded folks there's http://github.com/marcel/twurl which is effectively curl that uses OAuth - though it isn't the same.
John Nunemaker wrote a tutorial on how to get get up and running with OAuth pretty quickly (though it is for the Ruby/Rails audience) http://railstips.org/blog/archives/2009/03/29/oauth-explaine... .
I'll admit getting started with OAuth takes some time to ramp up at first, but that ramp up time gets smaller each subsequent app.
Re: I think Twitter’s OAuth-only Access is a Waste of Time
#9OAuth is also a huge pain for those "I just want to write a little Twitter API script in 5 minutes" things. To the extent that I've thought about writing a couple lately, but chose not to because I didn't want to deal with OAuth (and they were scripts I'd want to work in the future). It seems like there should be some solution that lets me use basic auth for those little scripts. Maybe tell Twitter IP's from which I…
There's an oauth curl to write script quickly with oauth and curl http://code.google.com/p/oacurl/
Re: I think Twitter’s OAuth-only Access is a Waste of Time
#10yep.I agree.overkill