Seriously, what options do I have now to secure my RPC install from the simplest eavesdropping? HTTP authentication? Well if digest authentication worked, maybe (but it doesn’t). And the blog clients need to maintain two separate password screens, and I can’t imagine what it is to explain the difference between “Blog password” and “HTTP password” to the user, and why you need both. And what options are left over? Except SSL, for which a blog user needs to go out shopping for IP addresses or use a preinstalled system which already is SSL-enabled? (none of the “big players” like Typepad and LJ, AFAIK, are SSL at this point).

So in a way, I think the client authors are also responsible for both this and the “API key” in MovableType, even though Daniel does not mention it. The bliog API is stagnating pretty much the way Blogger and Dave Winer defined it, except for a few MT and WP-specific additions. If you build business around a specific technology, you might as well go and expand it as own initiative.