4 ms·
I respect and appreciate no API key being needed, but how will you prevent excessive usage? I'll just say that it's been a battle on my end to stop people abusi
by classichasclass 5y ago
I respect and appreciate no API key being needed, but how will you prevent excessive usage? I'll just say that it's been a battle on my end to stop people abusing APIs I deploy. It's why we can't have nice things.
- Wowfunhappy 5y agoLimit per IP address?
- deleted 5y ago[deleted]
- ianlevesque 5y agoCGNAT has made the blast radius of that technique really large.
- Wowfunhappy 5y agoIdk, Github's API does it, seems to be working. You can always offer an API key as an alternative option.
- Arnavion 5y agoWebsites being unusable for CGNAT'd users is good for persuading said carriers to start using IPv6 already.
- cube00 5y agoThe API responded to me over IPv6 so while the consumer market will take time to get over to full IPv6 you can still setup your server today to offer IPv4/6 to your users and connect to this API via IPv6 which will eliminate you getting blocked in a CGNAT blast radius.
- deleted 5y ago[deleted]
- stavros 5y agoFor a data point, as a user, I think requiring an API key is fine if the process to create and use a key is simple. Having to use one to prevent abuse is fair enough.
- Wowfunhappy 5y agoIt's a problem if the code runs client-side and so there's no way to hide the key. I've run into this problem making widgets for the old OS X dashboard, and Javascript Pebble apps.
- meteo-jeff 5y agoThis is indeed a concern to me. As others pointed out, blocking IP addresses is an option. Blocking access based on the HTTP Origin header is also possible. I hope I can go on for some time without being to restrictive. With a fairly quick API that can scale with cheap VMs it should be feasible to keep it running at low expenses even at higher utilisation.