9 ms·
But I get to refuse to turn OAuth into a cross-cutting concern in my application. You won't see refresh tokens referenced in the UI code. And I get to use a 3rd
by hbrn 4y ago
But I get to refuse to turn OAuth into a cross-cutting concern in my application. You won't see refresh tokens referenced in the UI code. And I get to use a 3rd-party library that solves 90% of the pain for me.
I strongly disagree on the ratio. If you're building Mastodon client, most of your effort should be spent on features and UX, not on OAuth and the like. If half of your time is spent on those, either you're at the beginning of the project, or you're at the beginning of your career. Or maybe you just care about engineering itself more than the end product.
- turnsout 4y agoIf you peek at that third party OAuth library, you will discover… it's complex. This is what I mean about pushing the complexity around on your plate. You can make it someone else's problem (and become dependent on them), but the complexity is still there. There is a minimum level of complexity that any OAuth system needs to have in order to function. QED
- hbrn 4y agoOAuth library is a perfect example of lousy engineers inventing complexity. Here's a talk where Jack Diederich mentions it: https://youtu.be/o9pEzgHorH0?t=870 https://youtu.be/o9pEzgHorH0?t=870 It is indeed complex: 200+ classes. Plenty of unit tests and mocks. And then there's his implementation: - 0% unit test coverage. - Lightweight at less than 200 lines, including blanks and docstrings. QED.