| OP here. I think this is very naive/utopian. Yes, be super focused in your design. Yes, only expose APIs you have clear use cases for. Yes, keep the surface area as small as possible. Yes, have very focused requirements. Yes, document the hell out of things. Yes, implement strong parameter validation and other things to try to reduce the chance people do bad things. Do all these things and more (these are all part of what makes exposing APIs hard work, that many people don't do). But do not, for one second, believe that someone still won't do it wrong or abuse your perfectly designed API eventually... especially if it is successful. |
Microsoft failed at keeping the surface area as small as possible. When their surface area expanded to a hack to deal with Adobe's hack of replacing code behind Microsoft's back, they went into very dangerous territory.