Hacker News Reader

Comment by aeyes | Hacker News Reader

I am pretty certain that I can prove any client as harmful. I have been on the receiving end of apps misbehaving plenty of times, no matter which platform (JS, iOS, Android). And these were official apps with dedicated development teams.

Endless loops which flood you with API calls are a common issue, managing state is hard. Rate-limiting does not completely solve this.

View on HN

Plus you can land in a situation where a user might associate bad experiences with an unofficial client with the actual service and thus leave with a bad impression overall.

I dont imagine that most users start with the unofficial client.

This is the same argument AT&T used to forbid third party telephones on their network. It didn’t convince then, and it does not convince now. Tolerating third party clients should just be part of the cost of doing business and part of the design of robust protocols.

Doesn't your API have a problem if it can be misused that way? In other words, shouldn't your backend by default distrust the client using its API, no matter whether it's the official one or anything else? Even the official client can have bugs that bring down your backend.

That's what the "zero trust" philosophy is about.

couldn't this be addressed to some reasonable agree by requiring someone to register their client and providing a fee schedule for "misbehavior"

eg. if you send more than X requests per day per user you need to pay us $y per 100,000 requests over the limit (or whatever).

the only requirement would be registering and providing billing info, which wouldn't be used if they behaved.

Yeah, I was thinking as I wrote it, "official clients can probably fulfill that bullet point" hahaha

Reply on news.ycombinator.com