This comment sounds really assholish. I apologize in advance.
This is why libraries exist. You shouldn't be implementing OAuth yourself.
This is why libraries exist. You shouldn't be implementing OAuth yourself.
Because that's what it's competing with, with Basic Authentication. A simple POST to statuses/update.xml with HTTP username and password, a wget one-liner.
Three or four lines. Not the end of the world.
I agree that it's not as easy and simple as HTTP Authentication, but it's much nicer from a user's standpoint.
I don't mind supporting new APIs when they offer a solution to a real problem. As I've asked in my other comment, how many people have really lost their credentials via basic auth?
Edit: I can't seem to reply to steveklabnik's post below, so I do it inline by emphasising importing a new library is a non-trivial activity. I'm afraid that mass importing of external code into my projects is not something I undertake lightly; unless it's a platform supported (or very widely used) library, it requires a reasonable amount of vetting to ensure that it a) Works b) Does't break anything else c) will continue to work in the future.
My question remains: Why? What is the insanely pressing need to move to OAuth when users don't really seem to care and I can't find any evidence that it's been a real security problem? I completely agree that it's nicer in theory, but as mentioned in my other post, I don't actually see that it's any more secure. Unless I'm being highly dense, it would fall to a completely trivial quazi-social engineering hack in almost all end user cases.
And OAuth is a solution to a real problem. I don't want to provide my username/password to people who aren't Twitter.
I guess we have different opinions on libraries. I come primarily from Ruby, where testing is heavily emphasized. I don't mind adding stuff to my app because I'm constantly testing it against things breaking. In addition, most libraries come with their own tests, so I can verify for myself that libraries work.
The whole reason I use libraries is that they're a black box. I shouldn't have to worry if the library is broken or not, because they should be working. Maybe I've only used high quality libraries, but I can't remember the last time I came across a library bug.
Anyway, I don't have any stats to back things up, but users do care. "Login via Twitter" is so much nicer than "put in your twitter name and password." I'd be very hesitant to do the second, but not the first.
If I had access to a library, I'd use it. Now I have to go find one, port it, debug it, test it, review it, and deploy it.
Or drop the feature.
And if I have to go through the whole process here, I'm going to look at competing communications platforms, too.
And as many folks have found, forcing an update or a port means some applications will be ported off your platform, too.
This change within Twitter will derail at least some of those environments.