I understand some of the use-cases for write-access in v2 of the API -- primarily to enable full access to StackExchange sites without a web browser. And I'm sure it will be a hit for people who want to access the site via a Chumby, for instance, or other hand-help mobile devices where the browsers aren't ideal (iPhone, PSP, etc.).
I'm also sure that Kevin et al. have discussed this to some extent, but I'd like to bring the discussion here as well.
What can (or will) be done to prevent abuse?
Surely you won't be able to connect to the API anonymously and ask or answer questions (as you can on the sites currently). Even requiring an OpenID won't really stop anything. And obviously there's no way to validate a user with a captcha, through a JSON interface.
The situation that I would most worry about would be spam. I would expect a slight increase in "typical" spam (fake Rolexes, Viagra, and the like), but the community is very good about closing/flagging/deleting those posts quickly.
It sounds as though the simplest solution would be to require a relatively high reputation threshold before allowing any write-access... But what's to stop someone from asking a few "gimme" questions, repping up, and then writing a script to go through every question tagged
[unit-testing] and posting an answer or comment like
SQLUnitTester is the best application for this. It has a free trial too! Download it at somefakesite.com!
To prevent this, there's a few options:
- A restrictive time limit between posts
- Disallow multiple, identical (or very similar) posts
- Rely on community to flag user for spam. Perhaps put a user straight into the penalty box if an API post is flagged for spam?
Those cases are just a couple obvious ones. What other abuses can occur, and what can be done to prevent them?