4 ms·
I am pretty certain that I can prove any client as harmful. I have been on the receiving end of apps misbehaving plenty of times, no matter which platform (JS,
by aeyes 4y ago
I am pretty certain that I can prove any client as harmful. I have been on the receiving end of apps misbehaving plenty of times, no matter which platform (JS, iOS, Android). And these were official apps with dedicated development teams.
Endless loops which flood you with API calls are a common issue, managing state is hard. Rate-limiting does not completely solve this.
- MajorBee 4y agoPlus you can land in a situation where a user might associate bad experiences with an unofficial client with the actual service and thus leave with a bad impression overall.
- ungamedplayer 4y agoI dont imagine that most users start with the unofficial client.
- amatecha 4y agoYeah, I was thinking as I wrote it, "official clients can probably fulfill that bullet point" hahaha
- wildmanx 4y agoDoesn't your API have a problem if it can be misused that way? In other words, shouldn't your backend by default distrust the client using its API, no matter whether it's the official one or anything else? Even the official client can have bugs that bring down your backend. That's what the "zero trust" philosophy is about.
- Joeri 4y agoThis is the same argument AT&T used to forbid third party telephones on their network. It didn’t convince then, and it does not convince now. Tolerating third party clients should just be part of the cost of doing business and part of the design of robust protocols.
- masukomi 4y agocouldn't this be addressed to some reasonable agree by requiring someone to register their client and providing a fee schedule for "misbehavior" eg. if you send more than X requests per day per user you need to pay us $y per 100,000 requests over the limit (or whatever). the only requirement would be registering and providing billing info, which wouldn't be used if they behaved.