News for hackers. Stuff that matters.
Re:Ask HN: Massive vulnerability on Twitter? by trickjarrett on Monday May 10, 2010 @12:21PM (#1334890)
I believe the 'Accept' is used when you are in private mode and you get notice that someone wants to follow you. So they don't check if the user is in the request queue. Bad bad programmer.
Re:Ask HN: Massive vulnerability on Twitter? by hcho on Monday May 10, 2010 @12:35PM (#1334959)
Good lord, how would twitter recover from that? Possibly by undoing follow's between the moment this bug has surfaced and the moment they suspend following. Meanwhile they'll loose a huge number of legitimate follow request. Terrible stuff.
Re:Ask HN: Massive vulnerability on Twitter? by bena on Monday May 10, 2010 @02:03PM (#1335381)
Or find all statuses that have the pattern of "accept <valid_username>" and then removing <poster> from the <valid_username>'s followers.

That's not the hard part.

The hard part is that it seems that twitter wasn't checking accept messages to see if they were actually requests behind them or if the accepting user is actually a restricted account. So now they have to implement a mechanism that associates follow requests with follow acceptance.

Currently, the exchange is probably something like this behind the scenes: me: @restrictedUserIWantToFollow lemme follow you them: accept guyWhoWantsToFollowMe Everything simply implemented as twitter messages to facilitate cell phone usage. However, the accept message just assumes that there is a valid request being made and adds them to your followers.

Assumption: the mother of all foul-ups.

Re:Ask HN: Massive vulnerability on Twitter? by jaxn on Monday May 10, 2010 @08:37PM (#1336394)
2nd Assumption: Twitter stores commands that don't get posted as statuses.
Re:Ask HN: Massive vulnerability on Twitter? by nkm on Monday May 10, 2010 @01:05PM (#1335144)
I suppose they have a record of all the commands executed.
Re:Ask HN: Massive vulnerability on Twitter? by hcho on Monday May 10, 2010 @02:01PM (#1335372)
Follower and followee counts seem to be back. Anyone seeing lost legitimate follows?
Re:Ask HN: Massive vulnerability on Twitter? by nnash on Monday May 10, 2010 @03:30PM (#1335659)
Mine were reset to zero but the numbers are the same now.
Re:Ask HN: Massive vulnerability on Twitter? by igorgue on Monday May 10, 2010 @12:39PM (#1334980)
LOL... sorry but when you say it that way it's actually pretty funny.
Re:Ask HN: Massive vulnerability on Twitter? by codesink on Monday May 10, 2010 @12:18PM (#1334881)
If that works there must be other "cool" commands the coder added after implementing this one...
Re:Ask HN: Massive vulnerability on Twitter? by mortenjorck on Monday May 10, 2010 @12:28PM (#1334927)
It's not just a false display, either; it's a real follow: I tried it against my main account using a secondary account, posted a tweet, and then checked Twitterrific on my main account. The new tweet was right there at the top.
Re:Ask HN: Massive vulnerability on Twitter? by kevinp on Monday May 10, 2010 @02:28PM (#1335476)
Ah, the joys of in-band signaling. Now, where'd I put my blue box?
Re:Ask HN: Massive vulnerability on Twitter? by wherespaul on Monday May 10, 2010 @11:54AM (#1334783)
http://twitter.com/conanobrien yep it is working. Conan is following 23 people now. He only follows one person.
Re:Ask HN: Massive vulnerability on Twitter? by icey on Monday May 10, 2010 @12:38PM (#1334974)
It looks like this guy is the one who discovered it:

http://twitter.com/borakrc

Re:Ask HN: Massive vulnerability on Twitter? by nayanga on Monday May 10, 2010 @02:14PM (#1335429)
Re:Ask HN: Massive vulnerability on Twitter? by mortenjorck on Monday May 10, 2010 @12:42PM (#1334993)
Sorry, the profile you are trying to view has been suspended.
Re:Ask HN: Massive vulnerability on Twitter? by icey on Monday May 10, 2010 @12:50PM (#1335035)
Wow, that was quick (or the timing was just right) - it was available 10 minutes ago.
Re:Ask HN: Massive vulnerability on Twitter? by hcho on Monday May 10, 2010 @12:41PM (#1334990)
and his account has been suspended.
Re:Ask HN: Massive vulnerability on Twitter? by icey on Monday May 10, 2010 @12:55PM (#1335079)
All twitter accounts are reporting 0 followers / 0 following. This is going to be a fascinating study on how Twitter manages crises.
Re:Ask HN: Massive vulnerability on Twitter? by th0ma5 on Monday May 10, 2010 @12:51PM (#1335037)
looks like they are getting on top of it, it is on mashable, and i now have 0 followers and am following 0. nice fun, best pr would be to clean it up, and publish who did what and when (hahah)
Re:Ask HN: Massive vulnerability on Twitter? by icey on Monday May 10, 2010 @12:53PM (#1335059)
Kudos to Twitter for taking action quickly at least.
Re:Ask HN: Massive vulnerability on Twitter? by balu on Monday May 10, 2010 @12:51PM (#1335036)
That's quite funny. I just wanted to try this out and received an internal server error. Now all my followers are gone nor am I still following anyone. Twitter strikes back!
Re:Ask HN: Massive vulnerability on Twitter? by benatkin on Monday May 10, 2010 @12:57PM (#1335095)
It's 0 for me, and I didn't send an "accept" tweet.
Re:Ask HN: Massive vulnerability on Twitter? by balu on Monday May 10, 2010 @01:02PM (#1335124)
Funny though ;-) Those guys are quick!
Re:Ask HN: Massive vulnerability on Twitter? by alexro on Monday May 10, 2010 @12:12PM (#1334846)
The number of conanobrien's "friends" is going up ...
Re:Ask HN: Massive vulnerability on Twitter? by jasonrojas on Monday May 10, 2010 @12:18PM (#1334878)
I am one of them! Definitely strange how twitter would allow these "commands"...
Re:Ask HN: Massive vulnerability on Twitter? by bittersweet on Monday May 10, 2010 @12:51PM (#1335038)
It seems they are doing something about it already, the few 'high profile' users I checked now have 0 following and followers.
Re:Ask HN: Massive vulnerability on Twitter? by jashmenn on Monday May 10, 2010 @12:54PM (#1335073)
Looks like they are fixing the problem, everyone has 0 followers and 0 following right now.
Re:Ask HN: Massive vulnerability on Twitter? by fname on Monday May 10, 2010 @12:51PM (#1335045)
Looks like they're working on it... following/followers counts are blank for everyone
Re:Ask HN: Massive vulnerability on Twitter? by endlessvoid94 on Monday May 10, 2010 @12:51PM (#1335042)
Seems to be fixed. I get an internal server error now. Damn, that was interesting.
Re:Ask HN: Massive vulnerability on Twitter? by sgtpepper on Monday May 10, 2010 @12:34PM (#1334953)
What about "reject"? Can you get people to UNFOLLOW you as well?
Re:Ask HN: Massive vulnerability on Twitter? by bena on Monday May 10, 2010 @02:57PM (#1335572)
Yeah, block them, then they won't be able to follow you. Although if your timeline is not private they can still read your feed at twitter.com/yourname
Re:Ask HN: Massive vulnerability on Twitter? by fname on Monday May 10, 2010 @12:45PM (#1335010)
you might, but not using reject.
Re:Ask HN: Massive vulnerability on Twitter? by faramarz on Monday May 10, 2010 @12:51PM (#1335046)
DO NOT DO IT! I just attempted an Accept BillGates and both my "followers" and "following" are reset to zero. this better be a bug. http://twitter.com/faramarzhashemi
Re:Ask HN: Massive vulnerability on Twitter? by uptown on Monday May 10, 2010 @12:54PM (#1335074)
Actually, I didn't do it .... and everything is set to 0's on my profile as well. Either it's part of their clean-up, or their attempts to fix this accidentally wiped everybody back to zero.
Re:Ask HN: Massive vulnerability on Twitter? by faramarz on Monday May 10, 2010 @12:57PM (#1335099)
Yea.. Sorry folks. Pre-mature panic. Looks like a site-wide event
Re:Ask HN: Massive vulnerability on Twitter? by tszming on Monday May 10, 2010 @12:19PM (#1334884)
Confirmed and it works, nice catch.

How do you find it?

Re:Ask HN: Massive vulnerability on Twitter? by nkm on Monday May 10, 2010 @12:30PM (#1334938)
It works through the mobile web too
Re:Ask HN: Massive vulnerability on Twitter? by robinduckett on Monday May 10, 2010 @12:52PM (#1335048)
Stephen Fry is following me XD
Re:Ask HN: Massive vulnerability on Twitter? by JakaJancar on Monday May 10, 2010 @12:45PM (#1335008)
Good thing they have OAuth.
Re:Ask HN: Massive vulnerability on Twitter? by rondobley on Monday May 10, 2010 @12:55PM (#1335082)
yep me too, 0 and 0 after testing it . . .
Re:Ask HN: Massive vulnerability on Twitter? by angilly on Monday May 10, 2010 @12:22PM (#1334900)
conan is following me too.

wow.

Re:Ask HN: Massive vulnerability on Twitter? by tszming on Monday May 10, 2010 @12:24PM (#1334911)
obama is following me :)
Re:Ask HN: Massive vulnerability on Twitter? by angilly on Monday May 10, 2010 @12:26PM (#1334917)
... ditto. :)
Re:Ask HN: Massive vulnerability on Twitter? by dualboot on Monday May 10, 2010 @12:43PM (#1335000)
Fail. Whale.
Re:Ask HN: Massive vulnerability on Twitter? by TotlolRon on Monday May 10, 2010 @12:34PM (#1334957)
Massive oil spill on the social graph. Cleaning would be just as fun.
Re:Ask HN: Massive vulnerability on Twitter? by cyanbane on Monday May 10, 2010 @12:56PM (#1335089)
Perfect analogy. Looks like Twitter is resetting followers/followees as we speak for people trying it. Is this their 4 story containment unit?
Re:Ask HN: Massive vulnerability on Twitter? by shareme on Monday May 10, 2010 @12:31PM (#1334939)
confirmed it works
Re:Ask HN: Massive vulnerability on Twitter? by jffortier on Monday May 10, 2010 @12:52PM (#1335053)
Just lost all my followers and the people i was following!!!! OMG!!!! Twitter took action.