That's going to be tricky too because I could imagine someone offering a service to actors and other public people to help manage their twitter accounts (maybe discourage them from posting stupid shit at 1 am. I'm looking at you, Elon), in which case you wouldn't even have a 1:1 ratio.

The usual solution, historically, it to provide different levels of service based on your account type. The couple of times I've worked somewhere that the admins had a disjointed set of servers from the users was really a huge stress relief. You want admins to 'see' what the user sees, but to be able to work even if the site is being DOS'ed. And ideally you want users to be able to use the site even if the admins manage to DOS themselves (admin functions tend to have a higher fanout than end user functions, so the danger of catastrophic fanout is always higher).

One option would be to ban custom Twitter clients. As a bonus, enforcing official apps opens more possibilities for monetization. Twitter could even release a special app for advertising agencies who manage multiple accounts on behalf of their customers and charge appropriate subscription.

As a bonus? Maybe for Twitter, but as a user, I would not care for this at all.

My take is banning custom clients should be deemed an ADA violation.

You should be allowed to create your own client for any service you want, that is customized to your input needs.

How are you going to tell?

They can distribute keys associated to an identity and have humans review the apps or bot purpose and content, but charge for the review.

is there anything stopping me from writing a browser extension to make posts on the site automatically? i did work for a guy on that sort of setup spamming used car dealership ads, and it may have been a hastle keeping it running but we got plenty of ads out.

nothing other than the fact that if they find you doing this, they'll likely ban your account.

If the private keys are distributed inside an approved client app then any competent hacker can decompile the binary and extract the keys. At that point the keys can be used by bots or other unauthorized apps, and there's no reliable way for the server to distinguish them.

> Like someone using a custom twitter client as a single user shouldn't get that label, no?

Why not? If it's a niche client not many people use such false positive would be rare. Also such people probably don't have huge audirnce and they and their audiences won't care.

And it might be deterrent against people trying to build popular alternative client that might compete with main twitter app.

I don't think aiming for 100% accurate label is on the table.

> And it might be deterrent against people trying to build popular alternative client that might compete with main twitter app.

That's horrible for users.

Twitter's iOS app is a third-party app they bought because it was so much better than their own at the time. https://en.wikipedia.org/wiki/Tweetie

That was its origin, yes; but that was 12 years ago. The current official client is unrecognizable from Tweetie.

Yeah, but that was then and this is now. Thinghs kinda settled down since then.

The real danger of opening the API and marking all tweets made through API as BOT is that this label looses impact if some alternative client that uses API raises to prominence.

I'd say that current setup where users have no indication that something might have been posted by bot is way more horrible.

Humans are really creative. One potential outcome is a few well known ppl start using a 3rd party client, tell their followers that’s why it says bot, and the badge loses its meaning.