5 ms·

> On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead. But over the past 48 hours, dozens of new domain

by kibwen 3y ago

> On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links — such as fedetwitter[.]com, which is currently rendered as fedex.com in tweets. I'm in awe. Does Twitter have any software developers left, or is it just Elon's nephew working his way through W3Schools?

genter 3y ago
I had to clean the coffee off my keyboard after reading that.
adamors 3y ago
There a lot of people on visas who can’t quit, so …
- wannacboatmovie 3y ago
  Do you have any evidence of this? It is a borderline racist trope that keeps being repeated (mostly by ex-Twitter developers with a chip on their shoulder) without any hard proof. It is equally likely they are upset over a lack of solidarity in quitting and are perpetuating a lie based on someone's citizenship status.
hankchinaski 3y ago
Move fast and break things I guess
jader201 3y ago
I’m confused how this can be used for phishing? Does the text only get replaced, and the underlying link stays intact? Surely not? Otherwise, the link would still go to fedex.com.
- deleted 3y ago
  [deleted]
- bluedel 3y ago
  No, you got that right. Only the displayed text is affected.
- dom96 3y ago
  > Does the text only get replaced, and the underlying link stays intact? Surely not? That is exactly what happens.
  - jader201 3y ago
    That’s almost literally unbelievable. I’m not even sure his nephew is reading W3Schools. In case you’re reading this, you may have missed this article: https://www.w3schools.com/html/html_links.asp https://www.w3schools.com/html/html_links.asp
- aavshr 3y ago
  Yes, only the text gets replaced but not the underlying link. Once you navigate to the link it will be the actual link in the URL bar however. But this is an easy miss for people after they have already navigated to the link from twitter thinking it's a legitimate link.
- campbel 3y ago
  Yeah, looks like _only_ the link label gets replaced, otherwise as you suggest it wouldn't be as bad.
  - myself248 3y ago
    Why do browsers allow this by default? Seems like a feature made to enable phishing and other bad behaviors.
    - aavshr 3y ago
      The link I just clicked on to reply to your comment was `https://news.ycombinator.com/reply?id=39991931&goto=item%3Fid%3D39991173%2339991931 https://news.ycombinator.com/reply?id=39991931&goto=item%3Fi...` but thankfully it just said 'reply' in the UI.
redundantly 3y ago
It's Elon himself working his way through W3Schools.
vlan0 3y ago
>Does Twitter have any software developers left Not many people in the field actually understand protocols at the RFC level. That's the real crux.
- lokar 3y ago
  No, that is not the issue. This is far more basic.
  - vlan0 3y ago
    More words?
    - lokar 3y ago
      I’m not sure what to tell you, you don’t need to have ever read a single RFC to see that this was not going to work. It’s just basic careful thinking.
    - SketchySeaBeast 3y ago
      It's a simple string substitution at the display level - fedetwitter.com becomes fedex.com, but at the link level fedetwitter.com remains. It's just replacing the content of the a tag, but not underlying href location.
- deleted 3y ago
  [deleted]
chuckadams 3y ago
Musk fancies himself a coder, so he probably wrote it himself and pushed it to master without review; or he did have it reviewed and fired anyone who pointed out the mistake.
rsynnott 3y ago
Everything that is old is new again: http://news.bbc.co.uk/1/hi/sci/tech/2138014.stm http://news.bbc.co.uk/1/hi/sci/tech/2138014.stm Possibly, as with the extremely 90s-feeling 'X' name, Musk is simply introducing retro bugs, to attract internet hipsters :)
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
NelsonMinar 3y ago
Apparently they have just one developer left who knows just enough to break things. Maybe they use Grok. Anyway some engineer wrote this change and deployed it. The product process failed though, as did the testing process. Rollback was a mess too, given this change was visible for hours (days?)
wannacboatmovie 3y ago
Salty ex-Twitter developers too busy huffing their own farts to remember when the pre-Elon CISO (mudge) was fired after he uncovered how messed up things were behind the scenes, then filed a whistleblower complaint and testified before Congress. Twitter was not a marvel of engineering pre-Elon, despite the fantasy arrogant former developers keep perpetuating. Their infrastructure was barely held together with duct tape.
- some-guy 3y ago
  1) Twitter wasn't a marvel of engineering pre-Elon 2) It's worse post-Elon (bot issues, paid blue checks at the top, increase in hateful posts, etc)
gofreddygo 3y ago
FFS. Maybe a tweet with a rickroll to spacetwitter.com will catch his eye. Whoever owns that domain, here's your 15 mins.

by kibwen 3y ago

genter 3y ago

I had to clean the coffee off my keyboard after reading that.

adamors 3y ago

There a lot of people on visas who can’t quit, so …

wannacboatmovie 3y ago
Do you have any evidence of this? It is a borderline racist trope that keeps being repeated (mostly by ex-Twitter developers with a chip on their shoulder) without any hard proof. It is equally likely they are upset over a lack of solidarity in quitting and are perpetuating a lie based on someone's citizenship status.

hankchinaski 3y ago

Move fast and break things I guess

jader201 3y ago

I’m confused how this can be used for phishing? Does the text only get replaced, and the underlying link stays intact? Surely not? Otherwise, the link would still go to fedex.com.

deleted 3y ago
[deleted]
bluedel 3y ago
No, you got that right. Only the displayed text is affected.
dom96 3y ago
> Does the text only get replaced, and the underlying link stays intact? Surely not? That is exactly what happens.
- jader201 3y ago
  That’s almost literally unbelievable. I’m not even sure his nephew is reading W3Schools. In case you’re reading this, you may have missed this article: https://www.w3schools.com/html/html_links.asp https://www.w3schools.com/html/html_links.asp
aavshr 3y ago
Yes, only the text gets replaced but not the underlying link. Once you navigate to the link it will be the actual link in the URL bar however. But this is an easy miss for people after they have already navigated to the link from twitter thinking it's a legitimate link.
campbel 3y ago
Yeah, looks like _only_ the link label gets replaced, otherwise as you suggest it wouldn't be as bad.
- myself248 3y ago
  Why do browsers allow this by default? Seems like a feature made to enable phishing and other bad behaviors.
  - aavshr 3y ago
    The link I just clicked on to reply to your comment was `https://news.ycombinator.com/reply?id=39991931&goto=item%3Fid%3D39991173%2339991931 https://news.ycombinator.com/reply?id=39991931&goto=item%3Fi...` but thankfully it just said 'reply' in the UI.

redundantly 3y ago

It's Elon himself working his way through W3Schools.

vlan0 3y ago

>Does Twitter have any software developers left Not many people in the field actually understand protocols at the RFC level. That's the real crux.

lokar 3y ago
No, that is not the issue. This is far more basic.
- vlan0 3y ago
  More words?
  - lokar 3y ago
    I’m not sure what to tell you, you don’t need to have ever read a single RFC to see that this was not going to work. It’s just basic careful thinking.
  - SketchySeaBeast 3y ago
    It's a simple string substitution at the display level - fedetwitter.com becomes fedex.com, but at the link level fedetwitter.com remains. It's just replacing the content of the a tag, but not underlying href location.
deleted 3y ago
[deleted]

chuckadams 3y ago

Musk fancies himself a coder, so he probably wrote it himself and pushed it to master without review; or he did have it reviewed and fired anyone who pointed out the mistake.

rsynnott 3y ago

Everything that is old is new again: http://news.bbc.co.uk/1/hi/sci/tech/2138014.stm http://news.bbc.co.uk/1/hi/sci/tech/2138014.stm Possibly, as with the extremely 90s-feeling 'X' name, Musk is simply introducing retro bugs, to attract internet hipsters :)

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

NelsonMinar 3y ago

Apparently they have just one developer left who knows just enough to break things. Maybe they use Grok. Anyway some engineer wrote this change and deployed it. The product process failed though, as did the testing process. Rollback was a mess too, given this change was visible for hours (days?)

wannacboatmovie 3y ago

Salty ex-Twitter developers too busy huffing their own farts to remember when the pre-Elon CISO (mudge) was fired after he uncovered how messed up things were behind the scenes, then filed a whistleblower complaint and testified before Congress. Twitter was not a marvel of engineering pre-Elon, despite the fantasy arrogant former developers keep perpetuating. Their infrastructure was barely held together with duct tape.

some-guy 3y ago
1) Twitter wasn't a marvel of engineering pre-Elon 2) It's worse post-Elon (bot issues, paid blue checks at the top, increase in hateful posts, etc)

gofreddygo 3y ago

FFS. Maybe a tweet with a rickroll to spacetwitter.com will catch his eye. Whoever owns that domain, here's your 15 mins.