Hacker News new | ask | show | jobs
by Diggsey 1547 days ago
As someone who works on a SaaS product, one of our biggest costs is our stable API surface. Internal APIs are essentially free, but for a public API we have to:

- Implement a conversion layer from our internal representation so we can keep it stable.

- Complicate all further feature work because we have to consider how it will affect existing customers of the API.

- Write and maintain documentation for the API.

- Keep the API working even after we no longer use it.

- Maintain multiple versions of the API in parallel.

- Make sure our error messages make sense to people not familiar with our internal systems.

- Be more careful with validation - for our internal APIs it's not the end of the world if a bad request results in a 500 rather than a 400, but it matters a lot for public APIs.

- Be more careful with rate limiting and other defenses against API misuse.

And this is to name just a few. A requirement that everyone expose a public API is pointless if it doesn't include a stability guarantee, and overly burdensome if it does.

3 comments

> A requirement that everyone expose a public API is pointless if it doesn't include a stability guarantee, and overly burdensome if it does.

This isn’t a requirement that everyone expose a public API . https://www.theverge.com/2022/3/24/22994234/eu-antitrust-leg...:

“The DMA will force new obligations on companies deemed to be “gatekeepers” — a category defined by the legislation as firms with a market capitalization of at least €75 billion ($82 billion); at least 45 million monthly users; and a “platform” like an app or social network. Companies covered by this classification include well-known tech giants like Google, Microsoft, Meta, Amazon, and Apple, but also smaller entities like Booking.com.”

For smaller companies, I can see how that would be rough. However, for large tech companies, this law seems really necessary.

Also relevant: https://www.youtube.com/watch?v=rAlTOfl9F2w

It should be easy to make exceptions for smaller companies/services, and put the rule into force for larger services. Also, the API doesn't need to be stabilized. If Whatsapp wouldn't send DCMA notices to developers of third party clients, and ban users of such, it would be a good start already.
It’s worth noting that this (proposed) law already only applies to large companies, as I noted upthread. This is something that a lot of folks in this thread are missing, but which I think is pretty crucial.

> Included in the rules' scope will be platforms with a market capitalization of €75 billion or turnover in the European Economic Area equal to or above €7.5 billion. [0]

[0] https://www.politico.eu/article/eus-digital-markets-act-adop...