8 ms·

And importing a new library into my codebase is a non-trivial activity. I need to vet it, ensure it will be supported and updated, and that well, it actually wo

And importing a new library into my codebase is a non-trivial activity. I need to vet it, ensure it will be supported and updated, and that well, it actually works. It makes Twitter implementation from "pretty much trivial in any language/device under the sun" into "Pain in the ass". I don't mind supporting new APIs when they offer a solution to a real problem. As I've asked in my other comment, how many people have really lost their credentials via basic auth? Edit: I can't seem to reply to steveklabnik's post below, so I do it inline by emphasising importing a new library is a non-trivial activity. I'm afraid that mass importing of external code into my projects is not something I undertake lightly; unless it's a platform supported (or very widely used) library, it requires a reasonable amount of vetting to ensure that it a) Works b) Does't break anything else c) will continue to work in the future. My question remains: Why? What is the insanely pressing need to move to OAuth when users don't really seem to care and I can't find any evidence that it's been a real security problem? I completely agree that it's nicer in theory, but as mentioned in my other post, I don't actually see that it's any more secure. Unless I'm being highly dense, it would fall to a completely trivial quazi-social engineering hack in almost all end user cases.

steveklabnik 16y ago
Have you actually done an OAuth integration yet? It could just be that I happened upon great support, but adding it to an app was just "require this library, update a config option, add a different link here and there." It was half a dozen steps, tops. And OAuth is a solution to a real problem. I don't want to provide my username/password to people who aren't Twitter.
steveklabnik 16y ago
To reply to your edit, which is strange... I can see the "reply" link to myself. I guess we have different opinions on libraries. I come primarily from Ruby, where testing is heavily emphasized. I don't mind adding stuff to my app because I'm constantly testing it against things breaking. In addition, most libraries come with their own tests, so I can verify for myself that libraries work. The whole reason I use libraries is that they're a black box. I shouldn't have to worry if the library is broken or not, because they should be working. Maybe I've only used high quality libraries, but I can't remember the last time I came across a library bug. Anyway, I don't have any stats to back things up, but users do care. "Login via Twitter" is so much nicer than "put in your twitter name and password." I'd be very hesitant to do the second, but not the first.
- Hoff 16y ago
  I come from the end of the universe furthest from Ruby. If I had access to a library, I'd use it. Now I have to go find one, port it, debug it, test it, review it, and deploy it. Or drop the feature. And if I have to go through the whole process here, I'm going to look at competing communications platforms, too. And as many folks have found, forcing an update or a port means some applications will be ported off your platform, too. This change within Twitter will derail at least some of those environments.

steveklabnik 16y ago

Have you actually done an OAuth integration yet? It could just be that I happened upon great support, but adding it to an app was just "require this library, update a config option, add a different link here and there." It was half a dozen steps, tops. And OAuth is a solution to a real problem. I don't want to provide my username/password to people who aren't Twitter.

steveklabnik 16y ago

To reply to your edit, which is strange... I can see the "reply" link to myself. I guess we have different opinions on libraries. I come primarily from Ruby, where testing is heavily emphasized. I don't mind adding stuff to my app because I'm constantly testing it against things breaking. In addition, most libraries come with their own tests, so I can verify for myself that libraries work. The whole reason I use libraries is that they're a black box. I shouldn't have to worry if the library is broken or not, because they should be working. Maybe I've only used high quality libraries, but I can't remember the last time I came across a library bug. Anyway, I don't have any stats to back things up, but users do care. "Login via Twitter" is so much nicer than "put in your twitter name and password." I'd be very hesitant to do the second, but not the first.

Hoff 16y ago
I come from the end of the universe furthest from Ruby. If I had access to a library, I'd use it. Now I have to go find one, port it, debug it, test it, review it, and deploy it. Or drop the feature. And if I have to go through the whole process here, I'm going to look at competing communications platforms, too. And as many folks have found, forcing an update or a port means some applications will be ported off your platform, too. This change within Twitter will derail at least some of those environments.