Such Weather. Wow.

Popular free weather API from Yr.no deprecates URLs and adds HTTPS

Christian Skarby from the Norwegian Meteorological Institute (MET Norway) announced some changes to their free weather API today. The api.yr.no API endpoint is to be shut down in just six months from now on the 2016-09-05, but a new replacement API endpoint will open at api.met.no.

The new https://api.met.no replacement will take its place and introduces encryption and privacy at the same time.[1] I contacted MET Norway a month ago to inquire about whether they could enable encryption to prevent their API from leaking users’ approximate physical location in the clear. Today’s announcement shows they’re listening and taking security and privacy seriously. Securing this data from potential eavesdroppers is important to users who are hunkered down in a bunker somewhere without the opportunity to look at the weather outside. (Okay, I had some trouble coming up with a better example.)

According to the deprecation plan laid out by Mr. Skarby, the popular api.yr.no will shut down entirely in just six months.[1] This doesn’t give application developers much time to act and we can expect to see some applications break in about half a year either for failing to update to the new endpoint or failing to deliver updates in time. MET’s soon-to-be deprecated API endpoint is used by many weather data libraries such as libgweather used by the GNOME desktop. Some Linux distributions wait years before shipping non-security updates to their Long Term Support (LTS) releases.

The new and the old endpoints were served from the same system. The deprecation seems to come from either a desire to reduce the overhead from operating two or an unwillingness to invest in a multi-domain certificate.

MET Norway provides detailed weather data for 10 million places around the world freely available under a permissive Creative Commons Attribution license.