Gruber on Twitter's OAuth implementation for 3rd-party apps

"Twitter's Shit Sandwich":

OAuth is complicated and hard to summarize, but in a nut, Twitter currently offers third-party developers two ways to do authentication,OAuth and xAuth. xAuth allows the developer to simply ask the user for their Twitter username and password. If you use any of the popular third-party Twitter clients for the Mac or iOS — Twitterrific, Tweetbot, Hibari, etc. — you’ve seen xAuth in action. You launch the app, the app shows you a dialog box with fields for your Twitter username and password, you enter them, and then you’re in. Behind the scenes, the apps using xAuth do not store your username and password. Instead, they use them once to authenticate with Twitter’s API, and in return they receive from Twitter a key granting that app authentication for your account. The app needs only to store that key.

With OAuth, on the other hand, authentication must take place through a web browser and a session on twitter.com. The app forwards you to a web page at Twitter, you sign in to your Twitter account on the twitter.com website, and then you’re prompted, by Twitter on their website, to grant permission to the app in question to access your account.

I completely agree with his assessment and I sincerely hope that Twitter will rethink this decision. And since this ONLY affects 3rd-party apps and not their own, this just seems like another step in their recent campaign to destroy the 3rd-party app ecosystem altogether, which I find sad because that's the very thing that helped propel them to where they are.