Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear “API providers”, I don’t want a relationship.

tommorris.org

Post reply on HN
Print view View original

21–30 of 52 posts

Re: Dear “API providers”, I don’t want a relationship.

#21

Post by eps »

tommorris wrote: post #12
duiker101 wrote: post #2

This is a quite arrogant post. I do not make APIs but I can understand some needs of the API providers. First of all you are being arrogant because you if you just want an URL and nothing more means that for you every API must be free and this is totally bullshit. Also giving you a URL and nothing more gives me no control on what you do. You could harm my service by doing too many request or god knows what and I coul…

There's a few things I'll push back on: I could harm your service by making too many API-key signed, OAuth-signed requests too. I could harm your service by hitting your website a lot too. We have ways of dealing with people who intentionally or unintentionally launch the equivalent of denial of service attacks: you block their IPs and move on. There's no need to have a special magical way of doing it with an API. Th…

Psst... Not sure if you care, but viewing your site on iPad shows links overlapping with surrounding text, some text inexplicably clipped as well as few other rendering issues.

Re: Dear “API providers”, I don’t want a relationship.

#22

Post by tommorris »

TazeTSchnitzel wrote: post #19
tommorris wrote: post #16

Earlier quoted context omitted.

Well, in the case of Twitter: Justin Bieber happened.

Eh?

Justin Bieber is my internal shorthand for: Twitter's API changes are based around the fact that they care more about celebrities and media than around being a good web API citizen or whatever. ;-)

Re: Dear “API providers”, I don’t want a relationship.

#23

Post by tommorris »

eps wrote: post #21
tommorris wrote: post #12

Earlier quoted context omitted.

There's a few things I'll push back on: I could harm your service by making too many API-key signed, OAuth-signed requests too. I could harm your service by hitting your website a lot too. We have ways of dealing with people who intentionally or unintentionally launch the equivalent of denial of service attacks: you block their IPs and move on. There's no need to have a special magical way of doing it with an API. Th…

Psst... Not sure if you care, but viewing your site on iPad shows links overlapping with surrounding text, some text inexplicably clipped as well as few other rendering issues.

Yep, I need to fix that. Sorry about that. I was going to do iPad testing yesterday.

Re: Dear “API providers”, I don’t want a relationship.

#24

Post by lazyjones »

tommorris wrote: post #12
duiker101 wrote: post #2

This is a quite arrogant post. I do not make APIs but I can understand some needs of the API providers. First of all you are being arrogant because you if you just want an URL and nothing more means that for you every API must be free and this is totally bullshit. Also giving you a URL and nothing more gives me no control on what you do. You could harm my service by doing too many request or god knows what and I coul…

There's a few things I'll push back on: I could harm your service by making too many API-key signed, OAuth-signed requests too. I could harm your service by hitting your website a lot too. We have ways of dealing with people who intentionally or unintentionally launch the equivalent of denial of service attacks: you block their IPs and move on. There's no need to have a special magical way of doing it with an API. Th…

In general, blocking IPs is not really useful anymore since far too much abuse comes over Tor, open proxies, or potentially short-lived dynamic IPs (major German ISPs let you switch IPs as often as you want) and if you care about legitimate users, you cannot block these.

The point that websites without API-key get hit by this anyway is valid though and legitimate users won't be annoyed too much by IP-blocking abusers of the API for API access only (block all Tor exit nodes for the API too, who cares ...).

You could also mention that authentication, registration etc. probably make APIs slower and more of a burden for the servers too ...

Re: Dear “API providers”, I don’t want a relationship.

#25

Post by lazyjones »

overbroad wrote: post #10

Ha. I've had the same thoughts many times. Never thought anyone else felt this way. At some stage, people started to get weird ideas about URL schemes (aka "API's") like it's some sort of marketing thing. API keys. WTF? Imagine if early Google was required to get an "API key" for every site they crawled. Who came up with this silly idea of "API keys"? In the 90's, I remember decipering URL schemes in order to do craw…

API keys are a perfectly valid and useful concept for a situation where you, as the owner of a (possibly paid) account can create those keys and hand them to 3rd parties or programs that provide a service using (reading only) some of the data related to your account (you don't want to give them your login info, right?).

Example: http://wiki.eveonline.com/en/wiki/EVE_API_Functions

Re: Dear “API providers”, I don’t want a relationship.

#26

Post by tehwebguy »

georgebashi wrote: post #18
tommorris wrote: post #12

Earlier quoted context omitted.

There's a few things I'll push back on: I could harm your service by making too many API-key signed, OAuth-signed requests too. I could harm your service by hitting your website a lot too. We have ways of dealing with people who intentionally or unintentionally launch the equivalent of denial of service attacks: you block their IPs and move on. There's no need to have a special magical way of doing it with an API. Th…

I think the point of API keys is so that if you were to build and publish an abusive client (think badly written iOS app), it's easier to stop the DDoS, rather than having to ban thousands of end-user IPs.

Absolutely!

This helps stop developers from putting lazy API calls on the client side instead of caching, for example.

For instance if my website includes a feed of my latest posts to a third party service I should be caching them myself and serving direct to visitors, rather than using a client side request coming from every visitor's browser.

Obviously this sounds like common sense but you might be surprised :)

Re: Dear “API providers”, I don’t want a relationship.

#27

Post by tommorris »

lazyjones wrote: post #24
tommorris wrote: post #12

Earlier quoted context omitted.

There's a few things I'll push back on: I could harm your service by making too many API-key signed, OAuth-signed requests too. I could harm your service by hitting your website a lot too. We have ways of dealing with people who intentionally or unintentionally launch the equivalent of denial of service attacks: you block their IPs and move on. There's no need to have a special magical way of doing it with an API. Th…

In general, blocking IPs is not really useful anymore since far too much abuse comes over Tor, open proxies, or potentially short-lived dynamic IPs (major German ISPs let you switch IPs as often as you want) and if you care about legitimate users, you cannot block these. The point that websites without API-key get hit by this anyway is valid though and legitimate users won't be annoyed too much by IP-blocking abusers…

So, on the Tor front: Wikipedia has blocked Tor users from editing since, well, since forever. For the occasional Chinese dissident or whoever who actually wants to legitimately edit over Tor or another blocked IP from an account, they can request IP block exemption from an administrator.

Another solution is to actually use User-Agent strings. Nominatim, OpenStreetMap's reverse geocoder, recommends that legitimate users put an email address in their User-Agent string. So it might read "My Craptastic Mashup v1. Maintained by: ". If there's a legitimate problem, email them.

Re: Dear “API providers”, I don’t want a relationship.

#28

Post by overbroad »

tommorris wrote: post #12
duiker101 wrote: post #2

This is a quite arrogant post. I do not make APIs but I can understand some needs of the API providers. First of all you are being arrogant because you if you just want an URL and nothing more means that for you every API must be free and this is totally bullshit. Also giving you a URL and nothing more gives me no control on what you do. You could harm my service by doing too many request or god knows what and I coul…

There's a few things I'll push back on: I could harm your service by making too many API-key signed, OAuth-signed requests too. I could harm your service by hitting your website a lot too. We have ways of dealing with people who intentionally or unintentionally launch the equivalent of denial of service attacks: you block their IPs and move on. There's no need to have a special magical way of doing it with an API. Th…

"cargo-cult". That's the term I was looking for. Monkey see, monkey do. Code monkey mimicry.

If thinking for yourself is "arrogance", then we need more "arrogant" people involved in web design.

It's not the "API" that is the method of providing and restricting access. It's the IP address. Any reasonably smart user can figure out the "API". They do not need a lengthy manual. A few examples, mere hints, is all that is needed.

Re: Dear “API providers”, I don’t want a relationship.

#29

Post by tommorris »

lazyjones wrote: post #25
overbroad wrote: post #10

Ha. I've had the same thoughts many times. Never thought anyone else felt this way. At some stage, people started to get weird ideas about URL schemes (aka "API's") like it's some sort of marketing thing. API keys. WTF? Imagine if early Google was required to get an "API key" for every site they crawled. Who came up with this silly idea of "API keys"? In the 90's, I remember decipering URL schemes in order to do craw…

API keys are a perfectly valid and useful concept for a situation where you, as the owner of a (possibly paid) account can create those keys and hand them to 3rd parties or programs that provide a service using (reading only) some of the data related to your account (you don't want to give them your login info, right?). Example: http://wiki.eveonline.com/en/wiki/EVE_API_Functions

I have to admit, I do actually really like the EVE API a lot. It's very simple, but the community has done amazing things with it: iOS and Android clients, EVE Fitting Tool, EVEMon and many other things.

Oh god, I'm being tempted back to exploring New Eden again.

For non-EVE players: http://wiki.eveonline.com/en/wiki/3rd_party_tools

Re: Dear “API providers”, I don’t want a relationship.

#30

Post by alexchamberlain »

cousin_it wrote: post #13
duiker101 wrote: post #2

This is a quite arrogant post. I do not make APIs but I can understand some needs of the API providers. First of all you are being arrogant because you if you just want an URL and nothing more means that for you every API must be free and this is totally bullshit. Also giving you a URL and nothing more gives me no control on what you do. You could harm my service by doing too many request or god knows what and I coul…

Paid APIs should have the minimum amount of bullshit to determine who pays what. Free APIs should have no bullshit. Request throttling doesn't require API keys.

It depends what you are throttling by.
Post reply on HN