Hacker News Reader

I'm not totally thrilled about having a 'secret' key embedded in the app that's distributed publicly.

I had a brief skim over the code and I can't see any access control stuff so I'm guessing this key has full access.

If that's the case, I can't see how this could ever be suitable for use in any real app.

What's the difference to the "clientKey" of Parse's SDK? The requests should be served over SSL anyway, so if your point is you don't want to distribute a key you got the same problem with Parse. You can obfuscate the key though.

It doesn't matter whether you use SSL or not. If it's in your app, it can be found quite easily.

Parse provides you with a few different keys and also offers ACL functionality. I'm still not too crash hot on expecting the client to setup an ACL on their own objects though...

can you propose how an client can authenticate with this type of service without a key?

Reply on news.ycombinator.com