Brent Sordyl's blog » api

Dos and Don’ts of Client Authentication on the Web

BrentSordyl — Thu, 05 Aug 2010 14:00:02 +0000

We propose a set of hints for designing a secure client
authentication scheme. Using these hints, we present the
design and analysis of a simple authentication scheme
secure against forgeries by the interrogative adversary.
In conjunction with SSL, our scheme is secure against
forgeries by the active adversary.
(Link: Dos and Don’ts of Client Authentication on the Web)

How do I prevent replay attacks? – Stack Overflow

BrentSordyl — Thu, 05 Aug 2010 14:00:02 +0000

(Link: How do I prevent replay attacks? – Stack Overflow)

Software Engineering Tips: API Design Tips

BrentSordyl — Thu, 22 Jul 2010 15:00:01 +0000

General-purpose APIs should be “policy-free;” special-purpose APIs should be “policy-rich.”

APIs should be designed from the perspective of the caller

Good APIs don’t pass the buck

A big problem with API documentation is that it is usually written after the API is implemented, and often written by the implementor
(Link: Software Engineering Tips: API Design Tips)

InfoQ: How to Design a Good API & Why it Matters

BrentSordyl — Sun, 14 Mar 2010 18:00:02 +0000

A well-written API can be a great asset to the organization that wrote it and to all that use it. Given the importance of good API design, surprisingly little has been written on the subject. In this talk (recorded at Javapolis), Java library designer Joshua Bloch teaches how to design good APIs, with many examples of what good and bad APIs look like.
(Link: InfoQ: How to Design a Good API & Why it Matters)

Bumper-Sticker API Design – InfoQ: Joshua Bloch

BrentSordyl — Sun, 14 Mar 2010 17:00:02 +0000

Names matter. Strive for intelligibility, consistency, and symmetry. Every API is a little language, and people must learn to read and write it. If you get an API right, code will read like prose.

If it’s hard to find good names, go back to the drawing board. Don’t be afraid to split or merge an API, or embed it in a more general setting. If names start falling into place, you’re on the right track.

When in doubt, leave it out. If there is a fundamental theorem of API design, this is it. It applies equally to functionality, classes, methods, and parameters. Every facet of an API should be as small as possible, but no smaller. You can always add things later, but you can’t take them away. Minimizing conceptual weight is more important than class- or method-count.

Keep APIs free of implementations details. They confuse users and inhibit the flexibility to evolve. It isn’t always obvious what’s an implementation detail: Be wary of overspecification.
(Link: Bumper-Sticker API Design – InfoQ: Joshua Bloch)

API Design Matters | Bad application programming interfaces plague software engineering. How do we get things right?

BrentSordyl — Sun, 10 Jan 2010 21:00:04 +0000

How to do Better
An API must provide sufficient functionality for the caller to achieve its task.
An API should be minimal, without imposing undue inconvenience on the caller.
APIs cannot be designed without an understanding of their context.
General-purpose APIs should be “policy-free;” special-purpose APIs should be “policy-rich.”
APIs should be designed from the perspective of the caller.
Good APIs don’t pass the buck.
APIs should be documented before they are implemented.
Good APIs are ergonomic.
(Link: API Design Matters | Bad application programming interfaces plague software engineering. How do we get things right?)

Apigee | Free, Self-service API management

BrentSordyl — Wed, 28 Oct 2009 14:00:05 +0000

Analytics and Protection for APIs and Mashups

Understand API usage.
Protect your apps and back-end.
Enforce API terms of use.
(Link: Apigee | Free, Self-service API management)

Online financial data APIs and resources

BrentSordyl — Wed, 08 Jul 2009 23:00:13 +0000

Anyone know where to get stock data in a standard API format (XML, JSON, etc)? Just looking for hi/lo/close data, not real-time.
(Link: Online financial data APIs and resources)

PlaneXML Flight Data API: Flight Tracking, Flight Scheduling, Online Flight Planning, Airport

BrentSordyl — Mon, 04 May 2009 14:00:05 +0000

fboweb is the longest-running web-based flight tracking provider on the net today. Since 2000, we’ve been supplying the aviation community with real-time flight tracking data, and our services and features have been seen on all the major new networks, including CNN, MSNBC, ABC, CBS, and NBC, and have been used in many forms of news media around the world, including such newspapers as the Washington Post, the Financial Times of London, the New York Times, and others, just to name a few.

fboweb is now making its flight data available to programmers and developers through its new PlaneXML Flight Data API . This API uses the common SOAP/WSDL technology used to deploy most of todays web services.
(Link: PlaneXML Flight Data API: Flight Tracking, Flight Scheduling, Online Flight Planning, Airport)

World Bank Open API 2.0 Launched

BrentSordyl — Tue, 14 Apr 2009 14:00:04 +0000

Exposed through the API as query “end-points” in a REST architecture.

Endpoints currently exposed by the API are: Countries, Photos, LendingTypes, IncomeLevels, Indicators[$type], Authors, Topics, Keywords, Sources. A simple API call like: http://open.worldbank.org/v2/countries?api_key=XXXX returns the list of countries in the system, with some vital details about each country like: the name, iso2 code, region, income level, capital city, the geo data of the location of the capital etc. To get specifics about a particular country, you can use the iso2 code captured from the country listing to construct your next query: http://open.worldbank.org/v2/countries/ge?api_key=XXXX gives data regarding a particular country.
(Link: World Bank Open API 2.0 Launched)

IP Address Location XML API :: IP Location Tools

BrentSordyl — Sat, 11 Apr 2009 21:00:07 +0000

Usage:
Simply do a query at this address : http://iplocationtools.com/ip_query.php?ip=74.125.45.100
(Link: IP Address Location XML API :: IP Location Tools)

Link: Embed Flash Games via the HeyZap API

BrentSordyl — Sun, 29 Mar 2009 21:00:02 +0000

Embed Flash Games via the HeyZap API
Now there’s a new API from HeyZap that lets publishers customize the look and selection of the games that are served through their system. It allows customization beyond the options that are available on their standard embed codes. In this sense it is much like the ShareThis API that we profiled earlier, allowing publishers with a little bit of technical savvy to shape embeddable content to fit their sites.

Link: PushButton Engine Flash Games API

admin — Sun, 29 Mar 2009 21:00:02 +0000

PushButton Engine Flash Games API
# Introduction
Summary of the engine, license and credits, and changes broken down by major version.
# Getting Started
How to get going with the engine. Where files are located. Information about the PushButton Manager.
# Components
How to write and use components.
# XML Level Format
How our level files are laid out; details on the serialization system.
# Resource Manager
How to load and use images, XML, sounds, and add your own resource types.
# Style Guide
How code ought to be written.

Link: Etsy Launches API: Handcraft Your Own Shopping Apps

admin — Tue, 24 Mar 2009 14:00:03 +0000

Etsy Launches API: Handcraft Your Own Shopping Apps
Etsy’s announcement gives examples of some possible uses for the API:

- Search product listings and get detailed product information
- Query and return details on Etsy shops
- Find items favorited by other users
- Identify items that are currently featured across the site

Link: Twitter / HTTP / REST API Invocation Infrastruture using data pipelines

admin — Tue, 17 Mar 2009 16:00:05 +0000

Twitter / HTTP / REST API Invocation Infrastruture using data pipelines
This blog post is not about twitter API programming, though thats what it does deal with. It focuses on the intermediate level infrastructure (ie. higher than the HTTP/REST APIs exposed by other sites but lower than the class libraries that surround those) necessary to work with HTTP/REST based APIs being offered by various web sites.