Show HN: Get alerts for tweets containing IP addresses in your network | Hacker News Reader

Show HN: Get alerts for tweets containing IP addresses in your network

ipwatch.timberslide.com

This sounds interesting, but it also sounds like something that requires the full firehose of all tweets unless Twitter's API lets you filter based on regexes. Does Twitter let you get that without some kind of paid plan? Particularly now as they try desperately to find a way to remain viable.

Edit: Looking at the options, you could put together a list of a few strings that would match (almost?) any IP address without too many false positives - just getting all 100 combinations of digit.digit would do the trick, and you could do better filtering once you had that smaller stream. The API limit is 400 strings.

How about all 256 (valid in an IPv4 address) combinations of \.\d\d\d\.?

I thought about that, but the docs don't mention anything about regexes and you may end up with some edge cases with leading 0s in each section. That would leave you with 256+100+20 (256 non-padded, 100 2-digit numbers with leading 0, 10 digits with leading 0, 10 digits with 2 leading 0) which would fit. My immediate thought was that you'd catch a lot of invalid numbers as well, but simply having the "." prefix and suffix would mean you'd catch all possible middle octets which would do the trick while missing most of the phone number collision space (some people separate phone #s wtih ., but most of those probably don't start with 0-2).

Clever! One class of tweets this misses are the paranoid styles of security researchers wrapping .'s in IPs like (.) and [.]

IPv6 is also tricky

I predict a soon to follow Show HN from the same author, "Why you should never build your product on twitter's API."

I've been frustrated on how poor the twitter API is. Just wait until those app keys start suddenly 'expiring'...

And then somebody makes Twitter API as a service which basically dumps everything into a steaming database that can be properly queried

Build a product around twitter (too) and agree it sucks. I dont even manage to understand all the issues it seems to have with me

What do you mean by "ip addresses in your network"? Is it the IP address I use to sign up for the service? I can't seem to specify a range after login, only an email to send the notification to. (an aside: it appears that the notification email can be different than the email I signed up with -- could cause a spam issue)

Also, I'd love to specify just a domain to look for, not an ip range.

Good feedback on both points. It doesn't accept a range of IPs, just CIDR prefixes. I'll make that more explicit.

Suggestion: Please give me a longer text box I can paste a list of CIDRs into. I was copy/paste/click-add/rinse/repeat-ing for a while.

Good suggestion, that sounds tedious. Other related feedback I got included using IRR data from DBs like RADB or RIPE to automate populating the prefixes.

IRR would be cool, you can just ask for ASN.

I've always wondered how promises like this are possible since twitters public API allows only partial access to the stream of tweets?

Twitter offers real-time streams that filter by limited numbers of keywords, userids, and locations.

https://dev.twitter.com/streaming/reference/post/statuses/fi...

Yes, this is what I'm using. There are a handful of keywords and users that cover a meaningful range of interesting events.

I have been using this "StreamAPI" for some time now, and I have been suffering of false positives all the time.

How so? I'll probably be testing it soon for a new project.

Sometimes it gives you data that is not relevant to your query.

Example: I want tweets from user: @XYZ You think that you wont need to check, but you'd be wrong.

So you can monitor CIDR ranges? That's cool!

Can you tell us how it works on the back-end? What other kinds of streams could this be applied to?

The core of the service is Kafka wrapped in a friendly gRPC API (that's Timberslide). It's a collection of microservices, e.g. Twitter service streaming into Timberslide, IP/Prefix matching service reading from Timberslide, email/webhook notification service, a websocket server for the live view in the app.

Adding other streams is possible, Twitter's API was just convenient while experimenting. RSS, Pubsubhubbub, Reddit, ...? It could be interesting to allow others to publish their own event streams into this app.

Neat. One feedback - when using uorigin adblock adding anything throws a 500

For some reason it wouldn't let me add my IP?!?!

192.168.0.0/24

I mis-read and thought this was a service showing you all the tweets coming from your IP range. This is cool too though!

As a network operator, this might be kinda nifty.

I'll never know, though, because I'm not registering / signing up just to see what it looks like (and -- in case you're thinking of somehow monetizing it -- I'd certainly never pay for it).

For a "Show HN", there's really not much to see. I knew as much about it after reading the title as I did after clicking the link. Uh... good luck, I guess.

There are more constructive ways of providing this feedback. Either just by framing it differently or giving specific examples of improvements they could make (screenshots, use cases, etc).

I disagree; this is good feedback that the developers aren't communicating their value prop to a potentially obvious audience (ops teams).

Yes, useful feedback but the user had been downvoted to near-invisibility. Had their tone been different, that wouldn't have happened.

It's poorly worded, but I think the GP commenter is complaining about having to register to see any sort of demo of the funcionality.

Why wouldn't you sign up? It took me 30 seconds to sign up and another few minutes to copy/paste a list of my networks....

People often dislike signing up to something they might not continue using.

I'm sorry for being a total noob (this is my first post actually), but I'm not 100% sure what this does. I enter my IP range and it will alert me if it show up in a twitter post somewhere?

Sorry, I couldn't find any documentation that clarified it.

Reply on news.ycombinator.com