5 ms·

As a user of the gem I can say it was effectively deprecated over a year ago. I ended up just writing my own requests to do what I needed to do. But at least t

As a user of the gem I can say it was effectively deprecated over a year ago. I ended up just writing my own requests to do what I needed to do. But at least they now give you a notice. :)

minimaxir 11y ago
And the API end points are well-documented so it's not a big deal.
- petetnt 11y ago
  I wanted to do something with the Instagram API few weeks ago and it kinda surprised me how restrictive it is. You cannot do nearly anything without authentication and everything else is restricted by the TOS.
  - cmdrfred 11y ago
    As far as I know that seems to mimic the site itself, you can't do very much without being signed in.
  - derefr 11y ago
    Most sites build their anti-DDoS logic around per-user rate limits. This requires them to force all API requests—even ones for completely public data—through a user session, to give those requests a context to be rate-limited by. Allowing 'anonymous, public' APIs either requires that you rate-limit either too conservatively (e.g. by client ID—so clients with more users hit rate limits) or too liberally (e.g. by IP—so truly malicious clients can just hit you with a botnet.) The only good way to provide a registration-less public API boils down to pairing—effectively "registering the machine" by handing it a token, and then relying on supercookies or frequently-revalidated 2FA tokens to persist the session. But this only works if you can reasonably expect a person to only want to query your API from one device at a time. If there are real use-cases for which your clients will want to hit you from random new machines (e.g. CoreOS's hosted etcd) then pairing won't help you.
  - minimaxir 11y ago
    I'm not happy about the restrictiveness either. (Especially the new Sandbox rate limitations)
    - cowholio4 11y ago
      Me neither but it seems like it's Instagram's attempt to stop the spammers. Unfortunately, I have not seen a significant decrease in Instagram spam since the changes. So the changes just hurt legitimate developers.

As a user of the gem I can say it was effectively deprecated over a year ago. I ended up just writing my own requests to do what I needed to do. But at least they now give you a notice. :)

minimaxir 11y ago

And the API end points are well-documented so it's not a big deal.

petetnt 11y ago
I wanted to do something with the Instagram API few weeks ago and it kinda surprised me how restrictive it is. You cannot do nearly anything without authentication and everything else is restricted by the TOS.
- cmdrfred 11y ago
  As far as I know that seems to mimic the site itself, you can't do very much without being signed in.
- derefr 11y ago
  Most sites build their anti-DDoS logic around per-user rate limits. This requires them to force all API requests—even ones for completely public data—through a user session, to give those requests a context to be rate-limited by. Allowing 'anonymous, public' APIs either requires that you rate-limit either too conservatively (e.g. by client ID—so clients with more users hit rate limits) or too liberally (e.g. by IP—so truly malicious clients can just hit you with a botnet.) The only good way to provide a registration-less public API boils down to pairing—effectively "registering the machine" by handing it a token, and then relying on supercookies or frequently-revalidated 2FA tokens to persist the session. But this only works if you can reasonably expect a person to only want to query your API from one device at a time. If there are real use-cases for which your clients will want to hit you from random new machines (e.g. CoreOS's hosted etcd) then pairing won't help you.
- minimaxir 11y ago
  I'm not happy about the restrictiveness either. (Especially the new Sandbox rate limitations)
  - cowholio4 11y ago
    Me neither but it seems like it's Instagram's attempt to stop the spammers. Unfortunately, I have not seen a significant decrease in Instagram spam since the changes. So the changes just hurt legitimate developers.