Loading today’s stories
Build1 distinct publisher2 min readUpdated
A one-week paid-tool build hit HttpOnly cookies and the Same-Origin Policy on day one. Everything after that was a pricing decision, not an engineering one.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
HttpOnly cookies and the Same-Origin Policy are not a gap in the platform that a sharper developer routes around. They are the reason a tab open on a news site cannot read the session you have open on your bank. The author of the write-up calls it the boundary the whole web security model is built on [5], and once that is accepted the remaining question is not technical. Three paths are left [6], and each is the same bill with a different name on it.
The arithmetic is where the week's real finding sits. His unit cost came out to roughly (followers + following) / page_size + 2 requests [18], the two extra calls reading the profile before and after the scan so a snapshot can be discarded if the counts moved mid-collection [19]. That integrity check is cheap in bulk and expensive at the small end: a profile whose lists fit in a single page costs three requests instead of one, which is 200 percent overhead on the only call that returned data [22]. Set against the billing model, though, it is noise. Per-result and per-request providers differ by about two orders of magnitude on a profile with a few thousand entries, a couple of cents against several dollars [17]. Read that as two cents against two to four dollars and the multiple is 100 to 200 [21]. Careful pagination does not recover a mistake that size.
The 100 free requests the provider offers are better understood as a measuring instrument than a trial [11]. That is what he used to confirm the shape of the data before paying [11], and shape is what bites: the provider exposes several endpoint families that all return follower lists and are not interchangeable [20], and a sort-order parameter documented in instagrapi's source is not surfaced by the wrapper at all [15]. instagrapi is free and it works, and by his account it is the clearest documentation of Instagram's private API that exists [12]. What it cannot do is stop carrying your session on every request, because it is a client and not a proxy pool [13].
Worth keeping in view that this is one builder's report of one week [1]. The product logic travels further than the anecdote, though. What he is selling is completeness rather than access, since both lists are already visible to anyone willing to scroll [2]. Completeness is the one property whose cost rises with the size of the thing being completed.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
Some providers bill per result, charging for every row pulled, while others bill per request, where one request returns a page of many rows.
For a profile with a few thousand entries, the same data costs a couple of cents under one billing model and several dollars under the other; the author calls the two models two orders of magnitude apart and the single biggest number in the project.
The author spent a week building a small paid tool that takes a public Instagram handle and returns the profile's following and follower lists, complete, ordered and exportable.
The two lists are already shown by the profile to anyone, so the product is completeness rather than access: a few hundred names do not fit in a human head and the app offers no search or export.
The author's first instinct was to let the page read the data from the visitor's browser, since the visitor is already logged into Instagram in that same browser.
That approach cannot work: session cookies on that domain are HttpOnly so no JavaScript can read them, and the Same-Origin Policy stops the author's domain from sending authenticated requests to Instagram's.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Sound platform facts, single-source economics
The load-bearing technical claims — HttpOnly session cookies, the Same-Origin Policy, extension host permissions — are standard, checkable web-platform behaviour and are described accurately. Everything commercially decisive is a single first-person account: no provider rate cards, no named per-result vendor, no logs behind the one-day account flag, and no conversion data behind the funnel assertion. The article is internally consistent and shows working code and a cost formula, which lifts it above bare assertion, but nothing in the cluster corroborates it independently.
One builder, one integration
Observed adoption is a single developer's week-long build: one paid provider integrated, one library evaluated and rejected, one self-hosted account attempt abandoned. The only signal beyond the author's own project is his assertion that the popular tools in the niche are extensions, which carries no names or counts. There are no user numbers, revenue, request volumes or third-party deployments.
Mostly sober, with unaudited headline numbers
The framing is deliberately deflationary: the product is described as boring, instagrapi is praised rather than disparaged, and the piece volunteers that follow dates do not exist in any API and that products displaying them invented the data. Slight overstatement comes from generalising one project's accounting into a two-orders-of-magnitude claim about the whole provider market and from the confident funnel assertion, both presented as settled lessons rather than single data points.
Vendor-adjacent build log for a paid product
The author sells the tool described and names the one provider he buys from while leaving the unfavourably-priced alternatives anonymous, so the piece functions partly as a recommendation for hikerapi.com, including its free-tier hook. Offsetting factors: the article credits the free competing library on technical merit, discloses a parameter the chosen provider fails to expose, and states no affiliate relationship — none of which the cluster can verify either way.
Credible practitioner account, thin verification
Confidence is moderate: the architectural reasoning is verifiable and the operational details (integrity check, balance pre-flight, endpoint comparison) are specific enough to be usable, but a single self-interested source supplies every number, and the pricing and funnel claims would need provider rate cards or analytics to firm up.
product
Cinemas, classrooms and ICE: smart glasses now need a venue-policy contingency1 distinct publisher
invest
Meta's Pay Structure, Not Its Policy Page, Is What the States Put on the Stand1 distinct publisher
product
OpenAI's teen tier ships the same week 29 states put Meta's teen design on trial1 distinct publisher
leadership
A safety engineer says he briefed Zuckerberg 100 times. The escalation trail is now evidence.1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 23, 2026