As a user of the gem I can say it was effectively deprecated over a year ago. I ended up just writing my own requests to do what I needed to do.
But at least they now give you a notice. :)
But at least they now give you a notice. :)
Allowing 'anonymous, public' APIs either requires that you rate-limit either too conservatively (e.g. by client ID—so clients with more users hit rate limits) or too liberally (e.g. by IP—so truly malicious clients can just hit you with a botnet.)
The only good way to provide a registration-less public API boils down to pairing—effectively "registering the machine" by handing it a token, and then relying on supercookies or frequently-revalidated 2FA tokens to persist the session. But this only works if you can reasonably expect a person to only want to query your API from one device at a time. If there are real use-cases for which your clients will want to hit you from random new machines (e.g. CoreOS's hosted etcd) then pairing won't help you.
Unfortunately, I have not seen a significant decrease in Instagram spam since the changes. So the changes just hurt legitimate developers.