More Twitter OAuth Stupidity

To borrow from Douglas Adams, Twitter is run by "a bunch of mindless jerks who’ll be the first against the wall when the revolution comes."

Twitter uses the OAuth consumer key to identify client applications. Now they've gone a step further, and are revoking the consumer keys of open source clients that fail to adequately obfuscate the key in the source code. Twidge was disabled yesterday. It was fixed a day later after the developer modified the source to comply with Twitter's requirements. So far, I haven't heard of any other open source clients having problems.

I don't know what Twitter hopes to accomplish with this ridiculous obfuscation requirement. Even if the key is hidden in the source code, it's still available to any one who examines the code. Does the requirement apply to closed source clients? In the above article, the author extracted the consumer key from the binary of the official Twitter Android client. Anyone want to bet it hasn't been fixed?

Useless Statistics

So, apparently only 29% of Twitter posts get any responses. What a useless statistic. Of course, if you are looking at Twitter as a marketing platform then I'm sure these kinds of statistics are very important to you. But always remember that lies and statistics go hand in hand. It's extremely easy for an unscrupulous agency to game the system on Twitter making it look like your advertising is reaching a huge number of people. Fake accounts, anyone?

How Not To Use OAuth

The OAuth protocol avoids the problem of giving your credentials to third party client applications and web sites when you want them to access your data on another site. Twitter is an example of how not to use OAuth.

It seems the genii who run Twitter require client software identify themselves with a consumer secret and key, which has to be embedded in the application somehow. Obviously, this is huge problem for open source applications, since it is impossible to obfuscate anything when people can see the source code.

As the article points out, the OAuth RFC actually recommends against using the consumer key protocol to identify application as Twitter is doing. Isn't it great when companies ignore standards for the sake of their own business goals? ^_^

OAuthpocalypse

Well, since yesterday Gwibber in the Debian sid distribution is no longer able to access Twitter. The OAuthpocalypse has finally arrived. Twitter has disabled the old HTTP Basic Authentication method and will only accept OAuth. This isn't a surprise; the Debian bug report is a couple of months old already.

I've been thinking of ditching Gwibber for a simpler client for while now, but haven't found a replacement yet. I prefer a console only program but it must be support multiple services the same way Gwibber does. Gwibber's multi-service capability is actually the only feature I really like about it.

I'm using Twidge, a command line program, to read and post on Twitter for the time being. Twidge switched to OAuth a long time ago already. If I feel ambitious I might write some scripts around Twidge to get the features I want. Ambitious. Right.

But really, the reason for this post is that I want to know who on earth came up with the word "OAuthpocalypse." ^__^

YouTube Unblocks My ISP

YouTube has lifted the restrictions on my ISP's IP 206.248.*.* block and I can watch videos without an annoying CAPTCHA request every time. So how did this get fixed? It seems that one way to get your complaint heard at YouTube, is to contact an employee directly. And just how do you do that? Apparently, the best way to contact YouTube support is via their Twitter accounts. That's right, you contact employees of Google, the world's biggest Internet company, via a back channel on a rival social networking service. That's just lame.

On the other hand, it got results and you can't argue with that.

Twidge

I was using Ping.fm to post to Twitter and Identica simultaneously. Ping.fm worked most of the time but occasionally it would suddenly became very unreliable for a few days. I decided that it was time to try a command line utility call Twidge, which has been on my play-with-this-cool-toy list for a while.

Twidge can post to both Twitter and Identica but can't do it with a single invocation. That's easily solved with a simple three line shell script taken from the Twidge web site. Or you can use the slightly more fancy script which gives a text length marker so you don't exceed the 140 character limit.

Of course, it was hard to resist "improving" things. ^_^ Here is my current script:

#!/bin/bash
tmpfile=$(mktemp)
trap "rm ${tmpfile}" EXIT
vim ${tmpfile}
if [ ! -s "${tmpfile}" ]; then
    echo "No text, aborting update."
    exit 1
fi
text=$(cat "${tmpfile}")
twidge -c "$HOME/.twidge/identica" update "${text}"
text=$(echo "${text}"|sed 's/\(^\| \)!\([[:alnum:]]\)/\1#\2/g')
twidge -c "$HOME/.twidge/twitter" update "${text}"

There basically two additions over the original script. First, the text for the post is created in the vim editor, which is a more comfortable writing enviroment and, more importantly, has a spell checker! The second addition is to convert Identica groups, which are specified as "!tag", into a Twitter "#tag", since Twitter doesn't have groups.

Hah, I hear you say! Why did my script become so complicated? But it is not really complicated once you realize these scripts are able to duplicate the basic functionality of Ping.fm, a complex web service, in a few lines of shell code. And so far, the script has proven to be more reliable that Ping.fm. The script is only as complicated as it needs to be, but no more.

Long live the command line!

Microblogging

Still haven't developed much feeling for Twitter. I often forget to post anything for days at a time although I didn't do too badly this week. Usually when I'm doing something, the last thing on my mind is, "Got to tell some about this!" Maybe this will change over time.

I found out Twitter has an XMPP gateway. That's handy, I thought. My IM client is always running so it would be more convenient than posting from my Twitter home page. Unfortunately, XMPP isn't a priority for the Twitter developers so the gateway doesn't work too well when it worked at all. Others such as tweet.im and twitterspy have step in to fill the need. Other microblogging sites like Identi.ca have an XMPP gateways and connect to Twitter. I decided to try Identi.ca first since you are posting to two sites at once. Hey, its hard to resist a two-for-one. ;)

So far my impression of Identi.ca is mixed. It has a much nice web UI than Twitter but the service became very unreliable just after I signed up. Twitter is can be slow but I haven't seen it become inaccessible yet. Identi.ca's XMPP gateway works and the posts are forwarded to Twitter, but the XMPP gateway is annoying. It constantly logs in and out for some reason. One post I made tonight showed up on Twitter a couple of hours later. Well, at least it showed up.

The two-for-one maybe wasn't a deal after all so I'll have to try the other options.