In reply to Ryan McCue.

@Ryan, To get an off-topic discussion even more off-topic, I don't really get this claim about not using passwords for the REST API makes it magically not a security issue.. An oAuth token is just another way to express the user+password combo, and if the random number generation is not good enough then it will be possible to produce a rainbow table for all wordpress sites to use in brute force attacks against the oAuth token.

But even if the token generation is great, it is still an additional attack vector, and with different authentication path (I assume) which means that unlike with XML-RPC current tools that handle brute force attacks (IP range base, login limit, etc) will not protect against attacks on that vector. So the end result might be a (maybe just slightly) less secure site.

I hope that one of the things that will be done when the API itself will be integrated is to give any API which requires authentication (or maybe just the authenticator itself) a path which can be easily disabled in htaccess..
Being able to disable it in WP core is nice, but there is no reason to waste CPU cycles to load core if I want the feature to be fully disabled.

Which surprisingly bring me back to the main subject. oEmbed should also have an easy way to block it in the webserver level from the same reason of saving CPU time if I fully disable the feature.