|
|
|
|
|
by claytoneast
1802 days ago
|
|
What's wrong with: anything a user can do on your app in the interface must also be doable via API call by that user. You don't have to map everything so the platform interactions are the same, simply make them equal-access via API call. It seems flawless to me but I also only spent the time I took to type this thinking about it, so it may be 98% flawed. |
|
Your solution creates the new problem that normal users don't understand what access they're granting to an API. Every API you expose is a tool for an unscrupulous app to exfiltrate data about you or your contacts. It's an avenue for sending spam. It's an avenue for monetizing your account's reputation by taking actions such as liking content, following/subscribing channels to boost their engagement numbers, scraping content that your contacts had not shared publicly.
It makes abuse-fighting much harder, since you can no longer trust the application to collect any kind of bot detection signals, and since huge tons of user interactions will be getting artifically concentrated at a few API gateways.
And finally, while nobody has a right to their business model, it's maybe useful to consider what the implications would be. It basically makes ad-supported services impossible, since somebody will inevitably implement an ad-free client for the service. (Or even worse, a client that just shows their own ads instead). Do you think we're really willing to go back to a world where the only free (as in money) services are ones that are being subsidized?