Some people on Twitter can post 35k-char tweets(twitter.com)
twitter.com
Some people on Twitter can post 35k-char tweets
https://twitter.com/Timrasett/status/926903967027785728
28 comments
I wonder why Twitter has banned the two accounts that found the bug. I'd have given them a bug bounty instead...
Probably a quickfix attempt to get the site working while waiting for engineering to deploy a proper fix. These tweets seem to trigger some crazy 100% cpu javascript edge case for dozens of seconds on every page load at least on desktop web.
Yep, screwed up my whole Twitter feed - especially as a couple of my followers also picked up this thing.
Probably covered by:
> Spam & Security
> Access, tamper with, or use non-public areas of Twitter, Twitter’s computer systems, or the technical delivery systems of Twitter’s providers (except as expressly permitted by the Twitter Bug Bounty program).
> Interfere with or disrupt the access of any user, host or network, including, without limitation, sending a virus, overloading, flooding, spamming, mail-bombing Twitter’s services, or by scripting the creation of content in such a manner as to interfere with or create an undue burden on Twitter.
https://support.twitter.com/articles/18311
I agree this was not a spam issue (many found it informative), but, depending on how this tweet was done, it could be a security issue.
> Spam & Security
> Access, tamper with, or use non-public areas of Twitter, Twitter’s computer systems, or the technical delivery systems of Twitter’s providers (except as expressly permitted by the Twitter Bug Bounty program).
> Interfere with or disrupt the access of any user, host or network, including, without limitation, sending a virus, overloading, flooding, spamming, mail-bombing Twitter’s services, or by scripting the creation of content in such a manner as to interfere with or create an undue burden on Twitter.
https://support.twitter.com/articles/18311
I agree this was not a spam issue (many found it informative), but, depending on how this tweet was done, it could be a security issue.
Banhammered, found an archived version here: https://web.archive.org/web/20171104205949/https:/twitter.co...
Here is a screenshot of another one https://i.imgur.com/vXrXf0E.png
D'oh. I remember the blog post announcement of how they weren't counting URL length in tweets anymore. I'm sure it was quite a few months ago.
I'm actually quite surprised nobody actually thought to verify that until now.
I'm actually quite surprised nobody actually thought to verify that until now.
Apparently the long "word" there is some sort of URL set up as [long-domainname][.cc][/long-path]
Twitter indeed detects it as an URL, if you paste it into the tweet composer, but tweet renderer doesn't.
However the tricky question is, how he tweeted that? Twitter's telling me the tweet is too long if I try to tweet the same text.
However the tricky question is, how he tweeted that? Twitter's telling me the tweet is too long if I try to tweet the same text.
I would assume that sending that message via the API bypasses some of the same checks the app does. Not sure though.
And this is why your validation logic should be done on server side...
And this is why your validation logic should also be done on server side...
The app doesn't care though, it just thinks it's an URL and counts the entire string as 23 characters.
They seem to have already a mitigation fix in place. Does not work anymore. Gives error 500 on m.twitter.com now.
[deleted]
Someone I follow retweeted it on to my timeline and now the website keeps hanging. Does anyone know how it happened?
EDIT: Just seen someone explain it: https://twitter.com/hexwaxwing/status/926919811820609536
EDIT: Just seen someone explain it: https://twitter.com/hexwaxwing/status/926919811820609536
Interesting looking at the API response. If you do a signed API call to https://api.twitter.com/1.1/statuses/show/926903967027785728... - you can see that there's no URI returned in the JSON.
Here's a paste of the full response https://pastebin.com/MNRjjx45
Here's a paste of the full response https://pastebin.com/MNRjjx45
Note that VSCode doesn't completely display lines of this length ( https://github.com/Microsoft/vscode/issues/27380 ), and Kate struggles as well
Yet another reason why Sublime Text is a great editor compared to Atom/VSCode.
Here's another one that hasn't been banned (yet) - https://twitter.com/xsimemuero/status/926914609776279552
Here's another one that hasn't been banned (yet) -
https://twitter.com/Teddylcewater/status/926914325260001282
Both Deleted
Retweeting this end in crashing browser.
Rest in peace
Twitter caught on quick
Twitter caught on quick
Marshal Kim Jong-Un has already had this capacity:
https://twitter.com/DPRK_News/status/913269443614117888
https://twitter.com/DPRK_News/status/913269443614117888
{S c:\con\con }