6 ms·

Dear Twitter: Stop screwing over your developers

152 points by dochtman 16y ago

terra_t 16y ago
I thought this was all just a scam to turn off TweetAdder, or at least force TweetAdder off the API.
tumult 16y ago
The Twitter people continuously surprise me with their incompetence. And yet, we keep using the service. Hrm.
- barrkel 16y ago
  I think it's pretty clear that there's someone high up in the food chain making executive decisions based on personal technical skills they're not competent with. More hirings etc doesn't seem to be having the right effect. I think you need meddling to make things this bad.
- bconway 16y ago
  And yet, we keep using the service. Hrm. I like http://identi.ca/ http://identi.ca/, an implementation of http://status.net/ http://status.net/ .
  - patrickaljord 16y ago
    You mean an installation of status.net.
carson 16y ago
The easy answer to this is to just stop developing for their platform.
- hga 16y ago
  This HN submission suggests that's exactly what is happening: http://news.ycombinator.com/item?id=1681844 http://news.ycombinator.com/item?id=1681844
- sabat 16y ago
  As with all easy answers, it ain't necessarily that simple. What if you have a startup that's based on the Twitter API? Where do you go? Plurk? Facebook has its own API issues, of course.
  - carson 16y ago
    I think it is that simple. You don't build your startup solely on a free service that someone else has complete control of.
    - sabat 16y ago
      You don't build your startup solely on a free service that someone else has complete control of. Sound advice. When a lot of these startups were conceived, that wasn't as obvious as it seems now.
      - plorkyeran 16y ago
        That's been obvious since well before Twitter was created.
- ivanstojic 16y ago
  Personally I think I heard the phrase "don't be dependent on other companies' platforms" enough times to feel it in my bones. Some people obviously didn't. On the other hand, that's morally draining - particularly when one works on something that's open source.
mcyger 16y ago
I thought the difficulty the author stated related to OAuth and desktop apps was the reason Twitter launched XAuth?
- mikeyk 16y ago
  Nope; xauth reduces the number of steps a user has to go through for your service to obtain an access token for them (you can prompt them for their username and password rather than launch a web view pointing at Twitter.com). You still need to ship your consumer key with the app, even with Xauth.
tibbon 16y ago
Oauth is fine as an option, but when writing server-only analysis and mining tools its creates an unneeded step in the authentication process.
- jalada 16y ago
  You can obtain one time keys via Twitter's own website for your app, then you just need to sign your requests, which isn't too bad (there are libraries for most languages).
  - barrkel 16y ago
    I have not seen a library for bash, however, which is all the previous API needed.
mcantelon 16y ago
So can still use basic auth, if you use a trick. Good to know for one-off scripts.
sabat 16y ago
Twitter's behavior in the past year has given me pause. However, as to the claim that it's not yet and never will be mainstream: Oprah has not done shows on Facebook [edit: to my knowledge, anyway; don't watch Oprah myself]. Celebrities don't talk to their fanbase on Facebook. We don't go looking for instant news on Facebook (or on Google) -- good recent example for the Bay Area: http://search.twitter.com/search?q=%23sanbrunofire http://search.twitter.com/search?q=%23sanbrunofire Twitter is as mainstream as Facebook. Or darn close.
- bmelton 16y ago
  We don't go looking for instant news on Facebook (or on Google) I don't know if it's related to Google Instant, or preference to Git's servers, or if it's just a part of their strategy to be trending more things real time, but I posted my first public git repo last night. Shortly after, I was concerned that the name I made up on the spot might have been taken by somebody before me, and (worried that) they might be overly litigious, so I went and googled for the project name, only to find my hours-old project the #4 Google result for the term. I was shocked and dumb-founded (and very, very tired), but it was 100% awesome to see that technology could even be that much faster than expected. We live in very fantastical times.
  - yesbabyyes 16y ago
    We live in very fantastical times. We do, indeed. I'm not sure how Github announces additions/changes to Google, but if you notify Google of new/updated content, we're pretty close to that being instantaneous. Of course, as a programmer and nerd I'm always frustrated we're not quite there yet. I'd like to type in a query into Google, click on sort by newest, and see everything new streaming in.
sahillavingia 16y ago
Preferential treatment. This is the main reason I stopped developing my twitter app. Ugh Twitter, you were doing such a good job with your API, and you let it all go... Sigh.
js2 16y ago
Faced with: "If I want to distribute an open-source application, Twitter requires that I do not distribute a consumer secret, but rather require every user who downloads my source to register their own app" and "Twitter for Android: As mentioned, their keys are in the app’s classes.dex file in plain text. Their keys have been published online, but apparently Twitter doesn’t care." A developer might consider shipping with a "sample" key pair.
- tofumatt 16y ago
  I run an open-source Twitter service (http://preyfetcher.com http://preyfetcher.com) and that's exactly what I do. I don't store my consumer key/secret in the public source, same goes for my DB/Twitter Streaming API credentials. Again, for client apps it sucks because having to register your own API Client is silly for the common user (I would ignore a client that made me do it and I'm a developer). But it's not like it's an issue for _every_ OSS Twitter app.
patrickaljord 16y ago
Also, all firefox, chrome and safari extensions use javascript and you can read the secret keys in plain text. That include chromed bird, tweetbar and many others. And some of these are not even open source, they just happen to be written in javascript.
- yv 16y ago
  Our firefox add-on, Foxy140[1], fetches the consumer key and secret from our server when it starts for the first time. This enables us to change them if they are ever disabled. [1] http://foxy140.com/ http://foxy140.com/
allertonm 16y ago
Surprised at the amount of agreement with this article, and the cries of "incompetence". ISTM in a desktop app context, the consumer key/secret combination effectively becomes a complicated equivalent to your browser's "User Agent" string and yes, only slightly more difficult to spoof. So what Twitter is asking for is that in order to authenticate a user (with additional credentials) you give them a valid "user agent" that was assigned by Twitter. This at least allows them to understand, when they get traffic, who wrote the app that's sending it. It's obviously not perfect in a desktop case but then neither is user agent - but there is no perfect solution for the desktop case, and Twitter's choice allows them use a consistent mechanism for client and server apps. (Edit: the OA responds below and says I'm wrong about this part. I'll take his word for it.) I suspect the OA's problem is more with being a) asked to do this nasty complicated Oauth thing and b) with the idea of Twitter wanting to know who he is - and he'd rather they just let him keep on persisting user's twitter creds himself. Conflating this consumer key with DRM is a bit of a giveaway. (Updated: The important point here is that the author's app is open-source and he chose to distribute the keys with the source code, rather than require each person who builds it from source to get their own API keys. I think Twitter's position - that the author should not have done this - is completely reasonable.)
- Tichy 16y ago
  I read it as the problem being that Twitter might ban your app if they find that you published your oAuth secrets, which is impossible to avoid.
- nelhage 16y ago
  > So what Twitter is asking for is that in order to authenticate a user (with additional credentials) you give them a valid "user agent" that was assigned by Twitter. No. What Twitter is asking for is that you keep that "user agent" secret, even though you have to distribute it to everyone who uses your app. And they have demonstrated that they will happily block that user agent value if you don't do so. I would be perfectly happy identifying my app to Twitter, and I'm more than happy using OAuth -- it's technically a much better choice than plain passwords. I'm not happy that I have to fulfill an impossible requirement or have my app disabled, and more so that that requirement isn't applied to Twitter themselves or to the other large players they have partnerships with.
deleted 16y ago
[deleted]
deleted 16y ago
[deleted]
flacon 16y ago
Building a startup with a business model that is totally reliant on another startup seems like a bad decision. Might be better to diversify at this point.
ryanwaggoner 16y ago
I think Facebook is worse. For the scale at which the platform operates, the quality of the documentation is abysmal. They're constantly breaking things and making huge shifts in how the platform works, or even just where they're focus is. Very frustrating, especially when you have to explain to a client that you have no idea why feature X just stopped working, despite no one touching any of your code.
- tres 16y ago
  +1 Yeah, where else can you develop for an API whose main features go from brand-new to unsupported in less than 12 months? (Not just deprecated, but completely unsupported...) Developing for Facebook essentially soured me to any social API. & Twitter API horror stories have been all too common since way back when the fail whale was still a daily occurrence. Sorry Facebook, I don't have time to walk your treadmill for a pot of social fool's gold; I have no plans to include Facebook in my apps anymore. And Twitter? There's lots of people already trying to figure out how to monetize the service itself & thus far haven't really come up with anything that seems like it will really work... Not really the kind of foundation I want to build on.
msort 16y ago
Maybe someone will start to make an open-source Twitter alternative.
- rdiedrich 16y ago
  Already done: http://identi.ca/ http://identi.ca/
sidwyn 16y ago
Anyone knows if the Twitter for iPhone/Android get a significantly higher quota of API calls per hour?

152 points by dochtman 16y ago

terra_t 16y ago

I thought this was all just a scam to turn off TweetAdder, or at least force TweetAdder off the API.

tumult 16y ago

The Twitter people continuously surprise me with their incompetence. And yet, we keep using the service. Hrm.

barrkel 16y ago
I think it's pretty clear that there's someone high up in the food chain making executive decisions based on personal technical skills they're not competent with. More hirings etc doesn't seem to be having the right effect. I think you need meddling to make things this bad.
bconway 16y ago
And yet, we keep using the service. Hrm. I like http://identi.ca/ http://identi.ca/, an implementation of http://status.net/ http://status.net/ .
- patrickaljord 16y ago
  You mean an installation of status.net.

carson 16y ago

The easy answer to this is to just stop developing for their platform.

hga 16y ago
This HN submission suggests that's exactly what is happening: http://news.ycombinator.com/item?id=1681844 http://news.ycombinator.com/item?id=1681844
sabat 16y ago
As with all easy answers, it ain't necessarily that simple. What if you have a startup that's based on the Twitter API? Where do you go? Plurk? Facebook has its own API issues, of course.
- carson 16y ago
  I think it is that simple. You don't build your startup solely on a free service that someone else has complete control of.
  - sabat 16y ago
    You don't build your startup solely on a free service that someone else has complete control of. Sound advice. When a lot of these startups were conceived, that wasn't as obvious as it seems now.
    - plorkyeran 16y ago
      That's been obvious since well before Twitter was created.
ivanstojic 16y ago
Personally I think I heard the phrase "don't be dependent on other companies' platforms" enough times to feel it in my bones. Some people obviously didn't. On the other hand, that's morally draining - particularly when one works on something that's open source.

mcyger 16y ago

I thought the difficulty the author stated related to OAuth and desktop apps was the reason Twitter launched XAuth?

mikeyk 16y ago
Nope; xauth reduces the number of steps a user has to go through for your service to obtain an access token for them (you can prompt them for their username and password rather than launch a web view pointing at Twitter.com). You still need to ship your consumer key with the app, even with Xauth.

tibbon 16y ago

Oauth is fine as an option, but when writing server-only analysis and mining tools its creates an unneeded step in the authentication process.

jalada 16y ago
You can obtain one time keys via Twitter's own website for your app, then you just need to sign your requests, which isn't too bad (there are libraries for most languages).
- barrkel 16y ago
  I have not seen a library for bash, however, which is all the previous API needed.

mcantelon 16y ago

So can still use basic auth, if you use a trick. Good to know for one-off scripts.

sabat 16y ago

Twitter's behavior in the past year has given me pause. However, as to the claim that it's not yet and never will be mainstream: Oprah has not done shows on Facebook [edit: to my knowledge, anyway; don't watch Oprah myself]. Celebrities don't talk to their fanbase on Facebook. We don't go looking for instant news on Facebook (or on Google) -- good recent example for the Bay Area: http://search.twitter.com/search?q=%23sanbrunofire http://search.twitter.com/search?q=%23sanbrunofire Twitter is as mainstream as Facebook. Or darn close.

bmelton 16y ago
We don't go looking for instant news on Facebook (or on Google) I don't know if it's related to Google Instant, or preference to Git's servers, or if it's just a part of their strategy to be trending more things real time, but I posted my first public git repo last night. Shortly after, I was concerned that the name I made up on the spot might have been taken by somebody before me, and (worried that) they might be overly litigious, so I went and googled for the project name, only to find my hours-old project the #4 Google result for the term. I was shocked and dumb-founded (and very, very tired), but it was 100% awesome to see that technology could even be that much faster than expected. We live in very fantastical times.
- yesbabyyes 16y ago
  We live in very fantastical times. We do, indeed. I'm not sure how Github announces additions/changes to Google, but if you notify Google of new/updated content, we're pretty close to that being instantaneous. Of course, as a programmer and nerd I'm always frustrated we're not quite there yet. I'd like to type in a query into Google, click on sort by newest, and see everything new streaming in.

sahillavingia 16y ago

Preferential treatment. This is the main reason I stopped developing my twitter app. Ugh Twitter, you were doing such a good job with your API, and you let it all go... Sigh.

js2 16y ago

Faced with: "If I want to distribute an open-source application, Twitter requires that I do not distribute a consumer secret, but rather require every user who downloads my source to register their own app" and "Twitter for Android: As mentioned, their keys are in the app’s classes.dex file in plain text. Their keys have been published online, but apparently Twitter doesn’t care." A developer might consider shipping with a "sample" key pair.

tofumatt 16y ago
I run an open-source Twitter service (http://preyfetcher.com http://preyfetcher.com) and that's exactly what I do. I don't store my consumer key/secret in the public source, same goes for my DB/Twitter Streaming API credentials. Again, for client apps it sucks because having to register your own API Client is silly for the common user (I would ignore a client that made me do it and I'm a developer). But it's not like it's an issue for _every_ OSS Twitter app.

patrickaljord 16y ago

Also, all firefox, chrome and safari extensions use javascript and you can read the secret keys in plain text. That include chromed bird, tweetbar and many others. And some of these are not even open source, they just happen to be written in javascript.

yv 16y ago
Our firefox add-on, Foxy140[1], fetches the consumer key and secret from our server when it starts for the first time. This enables us to change them if they are ever disabled. [1] http://foxy140.com/ http://foxy140.com/

allertonm 16y ago

Surprised at the amount of agreement with this article, and the cries of "incompetence". ISTM in a desktop app context, the consumer key/secret combination effectively becomes a complicated equivalent to your browser's "User Agent" string and yes, only slightly more difficult to spoof. So what Twitter is asking for is that in order to authenticate a user (with additional credentials) you give them a valid "user agent" that was assigned by Twitter. This at least allows them to understand, when they get traffic, who wrote the app that's sending it. It's obviously not perfect in a desktop case but then neither is user agent - but there is no perfect solution for the desktop case, and Twitter's choice allows them use a consistent mechanism for client and server apps. (Edit: the OA responds below and says I'm wrong about this part. I'll take his word for it.) I suspect the OA's problem is more with being a) asked to do this nasty complicated Oauth thing and b) with the idea of Twitter wanting to know who he is - and he'd rather they just let him keep on persisting user's twitter creds himself. Conflating this consumer key with DRM is a bit of a giveaway. (Updated: The important point here is that the author's app is open-source and he chose to distribute the keys with the source code, rather than require each person who builds it from source to get their own API keys. I think Twitter's position - that the author should not have done this - is completely reasonable.)

Tichy 16y ago
I read it as the problem being that Twitter might ban your app if they find that you published your oAuth secrets, which is impossible to avoid.
nelhage 16y ago
> So what Twitter is asking for is that in order to authenticate a user (with additional credentials) you give them a valid "user agent" that was assigned by Twitter. No. What Twitter is asking for is that you keep that "user agent" secret, even though you have to distribute it to everyone who uses your app. And they have demonstrated that they will happily block that user agent value if you don't do so. I would be perfectly happy identifying my app to Twitter, and I'm more than happy using OAuth -- it's technically a much better choice than plain passwords. I'm not happy that I have to fulfill an impossible requirement or have my app disabled, and more so that that requirement isn't applied to Twitter themselves or to the other large players they have partnerships with.

deleted 16y ago

[deleted]

deleted 16y ago

[deleted]

flacon 16y ago

Building a startup with a business model that is totally reliant on another startup seems like a bad decision. Might be better to diversify at this point.

ryanwaggoner 16y ago

I think Facebook is worse. For the scale at which the platform operates, the quality of the documentation is abysmal. They're constantly breaking things and making huge shifts in how the platform works, or even just where they're focus is. Very frustrating, especially when you have to explain to a client that you have no idea why feature X just stopped working, despite no one touching any of your code.

tres 16y ago
+1 Yeah, where else can you develop for an API whose main features go from brand-new to unsupported in less than 12 months? (Not just deprecated, but completely unsupported...) Developing for Facebook essentially soured me to any social API. & Twitter API horror stories have been all too common since way back when the fail whale was still a daily occurrence. Sorry Facebook, I don't have time to walk your treadmill for a pot of social fool's gold; I have no plans to include Facebook in my apps anymore. And Twitter? There's lots of people already trying to figure out how to monetize the service itself & thus far haven't really come up with anything that seems like it will really work... Not really the kind of foundation I want to build on.

msort 16y ago

Maybe someone will start to make an open-source Twitter alternative.

rdiedrich 16y ago
Already done: http://identi.ca/ http://identi.ca/

sidwyn 16y ago

Anyone knows if the Twitter for iPhone/Android get a significantly higher quota of API calls per hour?