With No Notice, Twitter Adds More Limits - Password Trouble Ensues
Twitter is up to their old antics of adding limits again, changing the API, and not telling developers as they do so. This morning Twitter released into production new limits around their verify_credentials() …
Context & Ripple Effects
Twitter enters July 2009 with a fragile operating reputation: back in October 2008 VentureBeat argued the service's recurring failures barely registered with users, and the company has since been living down an availability problem rather than a demand problem. The week of this story, that fragility turned internal — a confirmed report shows an employee's personal email was hacked and used to reach Twitter's Google Apps account, spilling more than 300 confidential documents and screenshots, alongside rumored internal forecasts of a billion users by 2013 and first revenue in Q3.
Into that window, Twitter quietly pushed new limits on its verify_credentials() endpoint into production with no notice to developers, breaking password verification for anyone relying on it. For a platform courting a third-party ecosystem, shipping an API change by silent fiat — two days after proving its own operational security could be breached — hands critics of its developer relations a concrete case study.
First-order effects
- Developers whose apps call verify_credentials() see legitimate logins fail against a changed limit nobody announced, and must reverse-engineer the new threshold because no changelog exists.
Second-order effects
- Third-party builders respond defensively — caching credentials, throttling their own call patterns — which shifts the cost of Twitter's unpredictability onto the ecosystem and lowers the trust value of any limit Twitter publishes going forward.
Third-order effects
- If unannounced production changes become routine, the developer base polarizes: well-resourced clients absorb breakage while small toolmakers treat the API as unreliable infrastructure, concentrating the ecosystem around players who can survive silent deprecations.
The trend: Twitter's pattern of altering its API without notice points toward a platform that treats developer access as an operational lever to be adjusted unilaterally rather than a contract negotiated with its ecosystem.