this post was submitted on 10 Jun 2023
1049 points (100.0% liked)
Technology
39461 readers
319 users here now
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
Subcommunities on Beehaw:
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I'm not super technical but can someone please explain why the third party apps can't just require each user to enter their own oauth token? That way all the API calls get tied to the users instead of the app and there's no cost. Am I misunderstanding something?
It's a good point, and could alleviate things a bit, but its not easy and still would have problems. The root of it is that there's a rate limit for normal accounts in the new data api, so you would quickly get a message saying you've done too much in one minute and basically stop working. This also assumes the app can move over to a user provided authentication within the time window of one month. Given many of the big apps use support servers thar help manage the api calls (such as apollo's), this can be a big ask depending on how it was coded, especially when they didn't need to in the past and have built up around the lack of a need for oath for a decade. There's also an education process to get users to request and wire in the oath (could be done well, but it would be much rougher than today).
Additionally, there is still the censorship of nsfw posts, which enforces a walled garden, so third party apps would always be inferior. This sets a precedent more so than a problem, because next up could be whole subreddits being omitted from the api because of future reason here.
Also there's legal concerns it might bring up like stated by andrew
I agree with all the responses but based on the Apollo post I think the average user was making something like 300 requests per day? Isn't the 100 per minute rate limit more than sufficient for the average user or am I missing something? Either way the timeline, NSFW restriction and everything else is just stupid so I fully agree on that. Was just not getting the pricing part. 😁
Apps are registered with a unique key per app, which devs have to get and use. Then, each app authenticates the specific user that is using the app.
Having users provide their own key would probably be considered circumventing the developer terms and open themselves up to a lawsuit
Not if the app went open source and each user was working on a dev version of the app.
RedReader is going to be like this somewhat going forward. Other developers of the app need their own API key, but QuantumBadger's version, the Fdroid and Google Play version will keep the same API key.
Yep, that's possible. An impassibly high barrier of entry for the average user, but technically possible.
I doubt that would be circumventing the developers terms of service since the user becomes the developer in that instance, but each user would need to register for paid API access which 99.9% of people wouldn't do.
Could be totally wrong about the terms, please lmk if I am.
You already got a good answer from @[email protected]
Another way to think of it is: Would Reddit really want to make an API Application Key for each user of their site when the point of the API change in the first place is to make Reddit profitable?
LIke, even if I could build an open source "Reddit App Whatever" from scratch when I got to use it I would need to request an Application Key from reddit.
Read about it here: https://github.com/reddit-archive/reddit/wiki/OAuth2