4 ms·

As a fresh Yahoo! Developer Network employee I was the person who blabbed about the top-secret _callback parameter the weekend Pipes launched, which caused the

As a fresh Yahoo! Developer Network employee I was the person who blabbed about the top-secret _callback parameter the weekend Pipes launched, which caused the service to be taken offline for capacity upgrade. I had an interesting series of voicemails, ranging from "dude, WTF?" to "okay, we need to talk to you right away" to "we're pretty sure you're fired" but ending with "hey, Tim O'Reilly picked it up and ALL IS FORGIVEN THANK YOU!!!" https://web.archive.org/web/20070302201929/http://developer.yahoo.net/blog/archives/2007/02/yahoo_pipes_sud.html https://web.archive.org/web/20070302201929/http://developer....

p0sixlang 7y ago
What were the implications of knowing the _callback parameter?
- gopalv 7y ago
  You could invoke pipes from any webpage without worrying about cross-domain access. If you look at some janky JS code[1] I had on my website at the time, you can see what you can do with it. That would basically source ://pipes.yahoo.com/pipes/pipe.run?_id=7CTRtbtL3BGX_AHbjknRlg&_render=json&_callback=load_daily_show as a static asset in my page, which would load the JS and call load_daily_show(<json>) as a result. Now, EVERYONE who hits my page is invoking the pipe as a backend API call, with no caching and unfortunately with the entire Y/T cookies intact. [1] - https://web.archive.org/web/20081007043923/http://t3.dotgnu.info/code/j002ube/ https://web.archive.org/web/20081007043923/http://t3.dotgnu....
  - Guillaume86 7y ago
    Yeah I remember using it as a CORS proxy, it allowed me to put together a full client side music app (tracks source was not very legal) but tags, similar tracks/artists etc were pulled from lastfm and allowed to quickly build a decent playlist.
- kentbrew 7y ago
  At that point in history APIs that returned a JSON object wrapped in a callback were few and far between (and Yahoo! had almost all of them). Pipes would give you anything you wanted in a callback, allowing for nothing-but-front-end mashups of anything that would hold still while being scraped. Craigslist banned Pipes and un-banned it after YDN employee Jeremy Zawodny went to work there: https://techcrunch.com/2009/12/01/craigslist-yahoo-pipes-flippity/ https://techcrunch.com/2009/12/01/craigslist-yahoo-pipes-fli... https://techcrunch.com/2009/12/16/craigslist-yahoo-pipes/ https://techcrunch.com/2009/12/16/craigslist-yahoo-pipes/
hagmonk 7y ago
And now, Pipes can be mobilized and viewed on any mobile phone using SMS and WAP! Simply get the RSS feed of the Pipe and mobilize it using the 411Sync Mobile API. Within seconds, view it on your cell phone Oh wow. There is so much in this paragraph that was best left forgotten.

p0sixlang 7y ago

What were the implications of knowing the _callback parameter?

gopalv 7y ago
You could invoke pipes from any webpage without worrying about cross-domain access. If you look at some janky JS code[1] I had on my website at the time, you can see what you can do with it. That would basically source ://pipes.yahoo.com/pipes/pipe.run?_id=7CTRtbtL3BGX_AHbjknRlg&_render=json&_callback=load_daily_show as a static asset in my page, which would load the JS and call load_daily_show(<json>) as a result. Now, EVERYONE who hits my page is invoking the pipe as a backend API call, with no caching and unfortunately with the entire Y/T cookies intact. [1] - https://web.archive.org/web/20081007043923/http://t3.dotgnu.info/code/j002ube/ https://web.archive.org/web/20081007043923/http://t3.dotgnu....
- Guillaume86 7y ago
  Yeah I remember using it as a CORS proxy, it allowed me to put together a full client side music app (tracks source was not very legal) but tags, similar tracks/artists etc were pulled from lastfm and allowed to quickly build a decent playlist.
kentbrew 7y ago
At that point in history APIs that returned a JSON object wrapped in a callback were few and far between (and Yahoo! had almost all of them). Pipes would give you anything you wanted in a callback, allowing for nothing-but-front-end mashups of anything that would hold still while being scraped. Craigslist banned Pipes and un-banned it after YDN employee Jeremy Zawodny went to work there: https://techcrunch.com/2009/12/01/craigslist-yahoo-pipes-flippity/ https://techcrunch.com/2009/12/01/craigslist-yahoo-pipes-fli... https://techcrunch.com/2009/12/16/craigslist-yahoo-pipes/ https://techcrunch.com/2009/12/16/craigslist-yahoo-pipes/

hagmonk 7y ago

And now, Pipes can be mobilized and viewed on any mobile phone using SMS and WAP! Simply get the RSS feed of the Pipe and mobilize it using the 411Sync Mobile API. Within seconds, view it on your cell phone Oh wow. There is so much in this paragraph that was best left forgotten.