SSL support for Twitter

[ilf@…]

Twitter support should have a variable $ssl to user SSL for HTTP-Requests. In my view, this should also default to "on", since Twitter wants HTTP Authentication for pretty much every GET request.

[wilmer]

With OAuth this is a bit less of an issue IMHO, since OAuth headers can't be reused/replayed or whatever.

Still, https can be used now by setting the base_url to ​https://twitter.com/

Not sure if I'll do this by default since using HTTPS for every request *is* more expensive, especially since BitlBee can't do HTTPS resumes (I don't think GnuTLS does this transparently, at least?).

changeset:devel,587.

[ilf]

Ah, with "oauth off", it works. But not with OAuth :(

PS: My previous comment was eaten by Akismet because of "too many links" again.

[wilmer]

This was your comment:

Hm, this doesn't work for me. Neither with base_url ​https://twitter.com/ nor ​http://twitter.com/. I always get an Authentication failure:

<@ilf> account add twitter ilf oauth
<@root> Account successfully added
<@ilf> account set 4/mode chat
<@root> mode = `chat'
<@ilf> account on 4
-!- twitter_ilf [twitter_ilf@twitter] has joined &bitlbee
-!- ServerMode/&bitlbee [+v twitter_ilf] by localhost
<@root> twitter(ilf) - Logging in: Requesting OAuth request token
<@root> twitter(ilf) - Logging in: Connecting to Twitter
<@root> twitter(ilf) - Logging in: Logged in
<@ilf> account off 4
<@root> twitter(ilf) - Signing off..
-!- twitter_ilf [twitter_ilf@twitter] has quit [Leaving...]
<@ilf> account set 4/base_url ​https://twitter.com/
<@root> base_url = `​https://twitter.com/'
<@ilf> account on 4
-!- twitter_ilf [twitter_ilf@twitter] has joined &bitlbee
-!- ServerMode/&bitlbee [+v twitter_ilf] by localhost
<@root> twitter(ilf) - Logging in: Connecting to Twitter
<@root> twitter(ilf) - Couldn't log in: Authentication failure
<@root> twitter(ilf) - Logging in: Signing off..
-!- twitter_ilf [twitter_ilf@twitter] has quit [Leaving...]
<@ilf> account set 4/base_url ​http://twitter.com/
<@root> base_url = `​http://twitter.com/'
<@ilf> account on 4
-!- twitter_ilf [twitter_ilf@twitter] has joined &bitlbee
-!- ServerMode/&bitlbee [+v twitter_ilf] by localhost
<@root> twitter(ilf) - Logging in: Connecting to Twitter
<@root> twitter(ilf) - Couldn't log in: Authentication failure
<@root> twitter(ilf) - Logging in: Signing off..
-!- twitter_ilf [twitter_ilf@twitter] has quit [Leaving...]

[wilmer]

So I can probably relax that restriction a little bit since spam has gone down here since I enabled full Akismet checking.

Hm. Tricky. The problem here seems to be the trailing / . Can you remove it and try again?

[ilf]

Oh yes, that works. Thanks.

[anonymous]

Re-opening this case because I wanted to add a comment that I think "secure" should be the default state. Then allow people to move to insecure if they feel they need the extra performance of non-ssl. I guarantee 99.9% of people wont notice the "degradation" in performance by having SSL on by default... I certainly didn't notice the difference...

[ilf]

I like and second this. Then we only need to fix #369 :)

[wilmer]

If the user really wants SSL, s/he can easily enable this by hand. I don't see the added value of security here since Twitter is a public medium, not any IM protocol (except often XMPP) has their IMs on SSL, and even if your Tweets are marked private, the Twitter web service is still non-SSL by default.

If you really do feel strong about this, open a new bug with more convincing arguments. >-)

[ilf]

I guess our different views on this are rooted in different attitudes towards encryption in the first place.

In my view, everything should be encrypted by default, unless there are valid reasons against it. This is not yet mainstream view, especially since the internet started out unencrypted due to limited resources. But we are seeing increasing activity towards encryption as default, see ​https://www.eff.org/https-everywhere and ​https://www.accessnow.org/page/s/protectourprivacy

With that, the Twitter Web-Service is SSL only. And that's the way I use it. Also my Twitter profile is marked private, you can only follow and read my Tweets if I whitelist your account. That should counter your other arguments.

But really the difference is in the basic attitude towards encryption as default or nice option. I prefer default.

[anonymous]

The comment above by "ilf" exactly matches my own opinions on the matter.

[anonymous]

Strongly thirding ilf's comment.

[wilmer]

You might have noticed already that changeset:devel,985 did something in your favour..