I think it's a huge mistake. Mainly because when I write some random application (bot or something) I really don't want to mess with oauth when I just want to send a tweet. Plain.
Please, twitter. Don't.
Please, twitter. Don't.
If Twitter's going to be a serious platform, it needs to stop requiring me to hand my password to every Tom, Dick, and Harry app that I want to try out. That's what oAuth accomplishes.
I really see the point of using oauth for almost any web-based apps, and now also for desktop-based ones. Adium does it pretty well (but one day the twitter support broke and I've been using Tweetie/Echofon since then). But it's still about access complexity: big apps have still months to rework functionality using basic auth, but in some cases, oauth is just hellish.
I repeat myself, yes. Please: opt-in, twitter, we need it.
It's somewhere in the middle between basic and o
This is why libraries exist. You shouldn't be implementing OAuth yourself.
I don't mind supporting new APIs when they offer a solution to a real problem. As I've asked in my other comment, how many people have really lost their credentials via basic auth?
Edit: I can't seem to reply to steveklabnik's post below, so I do it inline by emphasising importing a new library is a non-trivial activity. I'm afraid that mass importing of external code into my projects is not something I undertake lightly; unless it's a platform supported (or very widely used) library, it requires a reasonable amount of vetting to ensure that it a) Works b) Does't break anything else c) will continue to work in the future.
My question remains: Why? What is the insanely pressing need to move to OAuth when users don't really seem to care and I can't find any evidence that it's been a real security problem? I completely agree that it's nicer in theory, but as mentioned in my other post, I don't actually see that it's any more secure. Unless I'm being highly dense, it would fall to a completely trivial quazi-social engineering hack in almost all end user cases.
And OAuth is a solution to a real problem. I don't want to provide my username/password to people who aren't Twitter.
I guess we have different opinions on libraries. I come primarily from Ruby, where testing is heavily emphasized. I don't mind adding stuff to my app because I'm constantly testing it against things breaking. In addition, most libraries come with their own tests, so I can verify for myself that libraries work.
The whole reason I use libraries is that they're a black box. I shouldn't have to worry if the library is broken or not, because they should be working. Maybe I've only used high quality libraries, but I can't remember the last time I came across a library bug.
Anyway, I don't have any stats to back things up, but users do care. "Login via Twitter" is so much nicer than "put in your twitter name and password." I'd be very hesitant to do the second, but not the first.
If I had access to a library, I'd use it. Now I have to go find one, port it, debug it, test it, review it, and deploy it.
Or drop the feature.
And if I have to go through the whole process here, I'm going to look at competing communications platforms, too.
And as many folks have found, forcing an update or a port means some applications will be ported off your platform, too.
This change within Twitter will derail at least some of those environments.
Because that's what it's competing with, with Basic Authentication. A simple POST to statuses/update.xml with HTTP username and password, a wget one-liner.
Three or four lines. Not the end of the world.
I agree that it's not as easy and simple as HTTP Authentication, but it's much nicer from a user's standpoint.