Comment 4 for bug 598464

I talked about this with Francis last week. While I don't see a new spammer weakness with what Michael suggested, my opinion on the proposed (implemented?) solution is mixed for another reason.

AIUI, this is temporary, because we don't want to have to create LP users for software center purchasers in the future.

This is also a private API: only one celebrity should use it. We don't really even want to advertise it.

Because of this, I'm inclined to prefer using our private XMLRPC server, protected by IP address.

Francis' counterargument is "why have more than one way to expose APIs?"

That's a good question. However, I regard the REST webservice as a public resource. Because this is temporary *and* private, my gut wants this to not be around in the webservice.

That said, if we do already have an implementation of the webservice approach, I'll just quietly go along with it.