3 ms·
> If Twitter did not have an API key, they would spend 2x the money on absorbing & defending against DDoSes and security vulnerabilities. That cost would get pa
by benchaney 9y ago
> If Twitter did not have an API key, they would spend 2x the money on absorbing & defending against DDoSes and security vulnerabilities. That cost would get passed on to us with frequent outages and many more ads in our feeds. Or a leak of someones DMs.
This is complete nonsense. Attackers aren't going to follow your TOS, so what possible benefit could asking your users to do it on little more than the honor system provide?
- a_t48 9y agoStopping a DOS is easier if you can tie whatever expensive operations that are happening to a single user.
- benchaney 9y agoExcept you can't actually figure out which user it is.
- deleted 9y ago[deleted]
- rpedela 9y agoAPI key != TOS
- benchaney 9y agoThe TOS is the reason that people use API keys instead of just reverse engineering the protocol (which is what an attacker will do).
- rypskar 9y agoNo, CSFR tokens, validating API keys, restricting the origin of request, etc is how to restrict access to the API. TOS is only text to keep the honest honest, the security layer is to keep the attackers and others without access out. A TOS is the web-site telling how it want you to behave, and all it can do if you don't behave that way is to do its best to not let you in. Nothing of this stops you from trying to reverse engineer the protocol. The best part with using an API is that, at least in theory, it is stable and will not have changes that breaks your integration with it
- deleted 9y ago[deleted]