5 ms·

> Unfortunately with today's SPA apps we don't even get the HTML directly It works the other way: with today's SPAs the API (that powers the frontend) is expos

> Unfortunately with today's SPA apps we don't even get the HTML directly It works the other way: with today's SPAs the API (that powers the frontend) is exposed for us to use directly, without going through the HTML - just use your browser's devtools to inspect the network/fetch/XHR requests and build your own client. ----- On an related-but-unrelated note: I don't know why so many website companies aren't allowing users to pay to use their own client: it's win-win-win: the service operator gets new revenue to make-up for the lack of ads in third-party clients, it doesn't cost the operator anything (because their web-services and APIs are already going to be well-documented, right?), and makes the user/consumer-base happy because they can use a specialized client. Where would Twitter be today if we could continue to use Tweetbot and other clients with our own single-user API-key or so?

poyu 3y ago
> Where would Twitter be today if we could continue to use Tweetbot and other clients with our own single-user API-key or so? So like OAuth? IIRC Twitter used that with all the 3rd party clients. I think the problem is that 3rd party clients filters out ad posts one way or the other. Your other point still stands though, just charge the user API access.
nomel 3y ago
> inspect the network/fetch/XHR requests and build your own client The purpose of an API is the agreement, more than the access. You can always reverse engineer something, but your users won't be too happy when things randomly stop working, whenever reddit chooses.
- matheusmoreira 3y ago
  Total non-issue. If it breaks, people will fix it. There's people out there maintaining immense ad filter lists and executable countermeasures against ad blocker detection. Someone somewhere will care enough to fix it.
  - chromoblob 3y ago
    There are only so many programmers, who will fix the client, per 1 person. This fraction, when inverted, will be a rough threshold for the client's audience size for continued fixes to be there.
    - matheusmoreira 3y ago
      And yet these people somehow maintain immense amounts of ad blocking filters and code, including active counter measures which require reverse engineering web site javascripts. I gotta wonder what would happen if they started making custom clients for each website instead.
      - chromoblob 3y ago
        Adblockers' audience is huge, much more than any single site's audience, and they probably wouldn't care about most single sites (to care, you have to be in the audience, and most sites have small audiences).
        matheusmoreira 3y ago
        Someone cared enough to defeat annoying blocker blockers of sites. If they care just a little bit more, they could replace the web developer's code with their own minimal version. Chances are the site doesn't actually need most of the code it includes anyway. What I'm talking about already exists by the way. Stuff like nitter, teddit, youtube downloaders. I once wrote one for my school's shitty website.
  - nomel 3y ago
    > There's people out there maintaining immense ad filter lists and executable countermeasures against ad blocker detection. This is not a useful comparison. A failure of an ad blocker means you don't see an ad while using the service. Big deal. A failure of a reverse engineered glorified web scraper is that the app stops working, completely, for all users of the client, at once, until someone fixes it. Yes, it could be democratized, but most users wouldn't understand any of this, and say "ugh, this app never works". It would be a user experience that reddit could make as terrible as they wanted.
makeitdouble 3y ago
> allowing users to pay to use their own client On the user side you need to: - pay the service a recurring fee - pay the client probably a recurring fee (x2 or x3 if you use multiple clients on different platform) - mix and match the above and manage when it falls out of sync It's totally possible, but how many users are willing to go that route ? Weather apps could be an example of that with the pluggable data sources, but that's to me a crazy small niche.
kmeisthax 3y ago
There's two reasons why they don't want third-party clients as a pro feature: - It's a very niche thing to charge for, and merely charging for something means having to support it, so you can be underwater on support costs alone - Users on third-party clients are resistant to enshittification The business model of any Internet platform is to reintermediate: find a transaction that is being done direct-to-consumer, create a platform for that transaction, and get everyone on both ends of the transaction to use your platform yourself. You get people hooked to your platform by shifting your surpluses around, until everyone's hooked and you can skim 30% for yourself. But you can't really do this if a good chunk of your users have third-party clients. This is usually phrased as "third-party clients don't show ads", but it extends way broader than that. If it was just ads, you could just charge $x.99/mo and make it profitable. But there's plenty of other ways to make money off users that isn't ads. For example, you might want to open a new vertical on your site to attract new creators. Think like Facebook's "pivot to video", how every social network added Stories, or YouTube Shorts. Those sorts of strategic moves are very unlikely to be properly supported by third-party clients, because nobody actually wants Twitter to become Snapchat. So your most valuable power users would be paying you money in order to... become less valuable users! If social media businesses worked how they said they worked, then yes, this would actually be a good idea. But it isn't. Platform capitalism is entirely a game of butting yourself in to every transaction and extracting a few pennies off the top of everything.
renewiltord 3y ago
> I don't know why so many website companies aren't allowing users to pay to use their own client... If you do that, I'm going to make a client that uses a rotating set of accounts and masquerades as a different client. I am then going to make content available through my client for free, and I'm going to put ads on it so that I can make money. With some small number of accounts, I will serve perhaps x1000 users and you can't do anything about it. In time, perhaps I will lock the users into my platform. They will talk about how the community on Reddit doesn't understand Reneit and how all the memes come from Reneit. If I win, I'll be Reddit over Digg. If I lose I'll be Imgur. So go ahead. You'll be Invision to Tapatalk and you will die.
drozycki 3y ago
They sort of are allowing users to pay to use their own client by charging for API access. It will be interesting to see how Apollo adapts to this new reality.
jakear 3y ago
CORS ruined this pipe dream. Ideally you’d be able to tell your browser that website X loading content from site Y was a-okay and exactly what you want to happen because site Y is user-hostile and site X addresses all those issues, but alas. Now the only way to access site Y is by a) routing all your data through some third party server, or b) installing a native application which has way more access to your machine than the web app would. Some days you gotta wonder if anyone on the web committees has any interest in end-users.
- dragonwriter 3y ago
  > Now the only way to access site Y is by a) routing all your data through some third party server, or b) installing a native application which has way more access to your machine than the web app would. Or installing a browser extension that allows rewriting CORS headers. > Some days you gotta wonder if anyone on the web committees has any interest in end-users. Oh, they do. The defaults are much safer for end-users than they used to be. Who they mostly leave out is a narrow slice of power users with use cases where bypassing make sense, and the extension facilities available address some of that.
  - jakear 3y ago
    From what I can tell there’s no such extension on iOS. I think it should be part of the standard, not a hole left for extensions to fill in. The slice is only narrow because it’s practically impossible. If there were an option presented to end users “let X.com read data from Y.com?” there would be a rich ecosystem of alternative UI’s for any website you could think of. These alt-UI’s would be likely to have better security practices than the original, or at the very least introduce competition to drive privacy/security/accessibility standards up for everyone. Whereas currently if the Origin has the data, they have full ability to impose whatever draconian practices they want on people who desire to access that data.
- minhazm 3y ago
  Technically you can still do that by launching chrome with some special flags or with a chrome extension. But I do agree that CORS is being hijacked/abused for this purpose. But at the same time it's an important security feature. It prevents the scenario where you visit some website and some malicious javascript starts making calls to some-internal-site/api/... and exfiltrating data.
theage 3y ago
The reason there will always be ads: average consumers are never willing to pay as much to keep their eyes clean as others are willing to pay to dirty them.

poyu 3y ago

> Where would Twitter be today if we could continue to use Tweetbot and other clients with our own single-user API-key or so? So like OAuth? IIRC Twitter used that with all the 3rd party clients. I think the problem is that 3rd party clients filters out ad posts one way or the other. Your other point still stands though, just charge the user API access.

nomel 3y ago

> inspect the network/fetch/XHR requests and build your own client The purpose of an API is the agreement, more than the access. You can always reverse engineer something, but your users won't be too happy when things randomly stop working, whenever reddit chooses.

matheusmoreira 3y ago
Total non-issue. If it breaks, people will fix it. There's people out there maintaining immense ad filter lists and executable countermeasures against ad blocker detection. Someone somewhere will care enough to fix it.
- chromoblob 3y ago
  There are only so many programmers, who will fix the client, per 1 person. This fraction, when inverted, will be a rough threshold for the client's audience size for continued fixes to be there.
  - matheusmoreira 3y ago
    And yet these people somehow maintain immense amounts of ad blocking filters and code, including active counter measures which require reverse engineering web site javascripts. I gotta wonder what would happen if they started making custom clients for each website instead.
    - chromoblob 3y ago
      Adblockers' audience is huge, much more than any single site's audience, and they probably wouldn't care about most single sites (to care, you have to be in the audience, and most sites have small audiences).
      - matheusmoreira 3y ago
        Someone cared enough to defeat annoying blocker blockers of sites. If they care just a little bit more, they could replace the web developer's code with their own minimal version. Chances are the site doesn't actually need most of the code it includes anyway. What I'm talking about already exists by the way. Stuff like nitter, teddit, youtube downloaders. I once wrote one for my school's shitty website.
- nomel 3y ago
  > There's people out there maintaining immense ad filter lists and executable countermeasures against ad blocker detection. This is not a useful comparison. A failure of an ad blocker means you don't see an ad while using the service. Big deal. A failure of a reverse engineered glorified web scraper is that the app stops working, completely, for all users of the client, at once, until someone fixes it. Yes, it could be democratized, but most users wouldn't understand any of this, and say "ugh, this app never works". It would be a user experience that reddit could make as terrible as they wanted.

makeitdouble 3y ago

> allowing users to pay to use their own client On the user side you need to: - pay the service a recurring fee - pay the client probably a recurring fee (x2 or x3 if you use multiple clients on different platform) - mix and match the above and manage when it falls out of sync It's totally possible, but how many users are willing to go that route ? Weather apps could be an example of that with the pluggable data sources, but that's to me a crazy small niche.

kmeisthax 3y ago

There's two reasons why they don't want third-party clients as a pro feature: - It's a very niche thing to charge for, and merely charging for something means having to support it, so you can be underwater on support costs alone - Users on third-party clients are resistant to enshittification The business model of any Internet platform is to reintermediate: find a transaction that is being done direct-to-consumer, create a platform for that transaction, and get everyone on both ends of the transaction to use your platform yourself. You get people hooked to your platform by shifting your surpluses around, until everyone's hooked and you can skim 30% for yourself. But you can't really do this if a good chunk of your users have third-party clients. This is usually phrased as "third-party clients don't show ads", but it extends way broader than that. If it was just ads, you could just charge $x.99/mo and make it profitable. But there's plenty of other ways to make money off users that isn't ads. For example, you might want to open a new vertical on your site to attract new creators. Think like Facebook's "pivot to video", how every social network added Stories, or YouTube Shorts. Those sorts of strategic moves are very unlikely to be properly supported by third-party clients, because nobody actually wants Twitter to become Snapchat. So your most valuable power users would be paying you money in order to... become less valuable users! If social media businesses worked how they said they worked, then yes, this would actually be a good idea. But it isn't. Platform capitalism is entirely a game of butting yourself in to every transaction and extracting a few pennies off the top of everything.

renewiltord 3y ago

> I don't know why so many website companies aren't allowing users to pay to use their own client... If you do that, I'm going to make a client that uses a rotating set of accounts and masquerades as a different client. I am then going to make content available through my client for free, and I'm going to put ads on it so that I can make money. With some small number of accounts, I will serve perhaps x1000 users and you can't do anything about it. In time, perhaps I will lock the users into my platform. They will talk about how the community on Reddit doesn't understand Reneit and how all the memes come from Reneit. If I win, I'll be Reddit over Digg. If I lose I'll be Imgur. So go ahead. You'll be Invision to Tapatalk and you will die.

drozycki 3y ago

They sort of are allowing users to pay to use their own client by charging for API access. It will be interesting to see how Apollo adapts to this new reality.

jakear 3y ago

CORS ruined this pipe dream. Ideally you’d be able to tell your browser that website X loading content from site Y was a-okay and exactly what you want to happen because site Y is user-hostile and site X addresses all those issues, but alas. Now the only way to access site Y is by a) routing all your data through some third party server, or b) installing a native application which has way more access to your machine than the web app would. Some days you gotta wonder if anyone on the web committees has any interest in end-users.

dragonwriter 3y ago
> Now the only way to access site Y is by a) routing all your data through some third party server, or b) installing a native application which has way more access to your machine than the web app would. Or installing a browser extension that allows rewriting CORS headers. > Some days you gotta wonder if anyone on the web committees has any interest in end-users. Oh, they do. The defaults are much safer for end-users than they used to be. Who they mostly leave out is a narrow slice of power users with use cases where bypassing make sense, and the extension facilities available address some of that.
- jakear 3y ago
  From what I can tell there’s no such extension on iOS. I think it should be part of the standard, not a hole left for extensions to fill in. The slice is only narrow because it’s practically impossible. If there were an option presented to end users “let X.com read data from Y.com?” there would be a rich ecosystem of alternative UI’s for any website you could think of. These alt-UI’s would be likely to have better security practices than the original, or at the very least introduce competition to drive privacy/security/accessibility standards up for everyone. Whereas currently if the Origin has the data, they have full ability to impose whatever draconian practices they want on people who desire to access that data.
minhazm 3y ago
Technically you can still do that by launching chrome with some special flags or with a chrome extension. But I do agree that CORS is being hijacked/abused for this purpose. But at the same time it's an important security feature. It prevents the scenario where you visit some website and some malicious javascript starts making calls to some-internal-site/api/... and exfiltrating data.

theage 3y ago

The reason there will always be ads: average consumers are never willing to pay as much to keep their eyes clean as others are willing to pay to dirty them.