CEO Steve Huffman says tech giants should not be able to trawl Reddit’s huge store of data for free. But that information came from users, not the company

That “corpus of data” is the content posted by millions of Reddit users over the decades. It is a fascinating and valuable record of what they were thinking and obsessing about. Not the tiniest fraction of it was created by Huffman, his fellow executives or shareholders. It can only be seen as belonging to them because of whatever skewed “consent” agreement its credulous users felt obliged to click on before they could use the service.

Ouch

  • Pika@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    2
    ·
    edit-2
    1 year ago

    that’s how they did it. They put a 10 request a minute on bots and a higher oauth limit (100) for individuals. large User client type apps could have somewhat easily converted over to that system but due to time constraint they didn’t. I do think they extorted their third party devs sure but, honestly the individual user limit isn’t super unreasonable as long as you aren’t liking or disliking every post. the search api is 100 posts per Api request, it was more the no NSFW and the no advertising limits they put on it that sucked

    edit: its actually 10 or 100 per minute not hour

    • Sparking@lemm.ee
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      1
      ·
      1 year ago

      It’s not that simple, because the third party apps ship with a single api key. So I used Relay for reddit, and used the same api key as everyone else on that app. You could create an app, and then have everyone make their own key, but that is just asking for trouble. Definitely too technical for most people, and you would probably need to put in billing info for a scenario where you go above the free-tier call limit.

      • Pika@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        1 year ago

        Yeah but if you’re going to use the oauth 2 method you don’t use the same API key as everyone, how that works is you authorize your account with the bot, the company gives you a bearer token and then that token is what’s used for rate limits. The Bot client token is not used in that process, the oauth2 bearer token is

        this is taken from the reddit Api docs: As of July 1, 2023, we will enforce two different rate limits for those eligible for free access usage of our Data API. The limits are:

        If you are using OAuth for authentication: 100 queries per minute (QPM) per OAuth client ID
        If you are not using OAuth for authentication: 10 QPM
        

        so apperently I undershot it, it’s actually 100 requests per minute not per hour like I originally thought it was

        • Sparking@lemm.ee
          link
          fedilink
          English
          arrow-up
          0
          ·
          1 year ago

          Well, I don’t know how the Reddit API works, but what you described is generally bad practice, as is my understanding. The Oauth token’s allow the app to perform actions on the behalf of authenticated users, but they still need to use the reddit API, and I imagine an API key, to perform those actions. You generally aren’t supposed to use Oauth as a access authentication mechanism.

          At least pricing is per Oauth key, but still, the pricing burden is still going to fall on the developers for these apps who reddit now views as their “competitors”, despite making a product that supported reddit’s business for years.

          • Pika@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            Oauth 2 is an authorization standard, that’s basically what it is meant for. It’s intended to be used as a identification system for a client to be able to tell a first party hey I’m me through the usage of a third party without ever giving the third party to have your password.

            Discord, Facebook/Meta, Google(most services), Soundcloud, all those use Auth 2 based API’s, oauth 2 is used basically everywhere for the same focus that Reddit is trying to do

            Like you said it can be dangerous if you authorize a third party app, honestly I’m willing to bet that rif and Apollo both used the oauth2 API at least in some part, otherwise I don’t think it would have been able to allow you to upvote or downvote posts or post comments as you. A good way to tell if it was using it or not is if you had to login and it brought you to a page that said authorize this app with Reddit, if it showed that you were using oauth 2