Hacker News Reader

Comment by isp | Hacker News Reader

At least two usernameless Twitter profiles exist:

https://twitter.com/intent/user?user_id=34313404

https://twitter.com/intent/user?user_id=71996998

(credit: https://twitter.com/FakeUnicode/status/989868697660477440 )

It is possible to retweet-with-quote the tweets, but not to retweet directly or (as far as I can tell) to link to individual tweets directly.

EDIT: It is possible to link to individual tweets. Added links.

The user says (tweet_id 989794618467409920 - https://twitter.com/i/web/status/989794618467409920 ) that there are "many bugs" using the account in various clients.

tweet_id 829989674353573889 ( https://twitter.com/i/web/status/829989674353573889 ) may be my all-time favourite tweet. (A tweet by @, with name @, contents @)

View on HN

How could such an account have been created?

Hard to say without knowing the code, but one common problem is to do something like length checking a username to ensure it is a certain length, and then later stripping out illegal characters.

Possibly a difference in implementation of unicode between validation and persistence/use. Validates successfully due to one or more "valid" unicode characters -> translated to zero characters due to stripping of invalid unicode character at some point after validation.

Maybe related to MySQL's 3-byte "utf8" charset which doesn't actually support unicode properly? (you are supposed to use "utf8mb4" nowadays though a lot of material still refers to "utf8")

Found this out when someone pushed a git commit message with a 4byte emoji and it broke our CI server -_-

Regex gone bad?

I asked somebody who used to work there, and the answer I got was that there are a bunch of accounts from back before validation was as tight as it is now.

Which seems reasonable to me. At-replies were not something that Twitter started with, but instead were community-driven with software support added later:

https://blog.twitter.com/official/en_us/a/2008/how-replies-w...

It's a good reminder that it's always easier to relax restrictions than to tighten them.

But then again, if Twitter early on were run by the sort of people who were inclined to lock down everything, it might not have evolved enough to be really useful to people. I hazily remember the Friendster guy getting really mad that people were creating accounts for non-human things that they loved, like cities and bars and companies. I think he went on a banning spree. Instead of saying, "Look how much people love my platform! Let me support them in their efforts."

If I recall correctly, when Google Plus was new and people were excited about it, a whole bunch of companies flocked to the site to set up accounts for their businesses. But Google hadn't launched the "business account" functionality yet, so they banned them all.

I guess Google Plus and Friendster are good examples of how that mindset works out.

Because nobody could conceivably impersonate a business and cause all sorts of legal and PR issues.

Just like nobody could impersonate a person?

That's already a given. We are all, in a way, impersonating other (mostly insufferable) persons.

That is in the category of "nice problem to have".

Friendster definitely doesn't have that problem, because despite being a pioneering social network, one that existed before MySpace or Facebook, it is now defunct.

Facebook did the same thing.

I remember having to merge multiple "person" Facebook accounts into a single "business" Facebook account for a client once business accounts became available.

It was extra hard not only because FB made the process cumbersome, but because everyone in the company seemed to have taken it upon themselves at some time in the past to create a person account for the business. Sales people, the owner, various marketing people no longer with the company, etc...

Exactly. Shouting, "YOU USERS ARE DOING IT WRONG" rarely accomplishes anything, and misunderstands how business works. The goal isn't to make users do what you imagined they would. It's to find something valuable you can do for users.

It does seem surprising that they haven’t contacted the affected users and invited them to change their usernames.

How many programmers have been surprised (pleasantly or not) by unintended/unexpected uses of their code?

MVP mania perhaps? You know, the old chestnut about "You have to get the shoddiest, most ethereal, stuck together with sticky tape and chewing gum version of your app out there to get market validation before you do some serious development work on it" ideology that is always being touted in the startup world... It tends to lead to this sort of technical debt.

To be honest at least in this case it’s probably worth it. It great to have something delivered so we don’t waste enormous energy on building features no one ends up wanting.

MVP doesn't necessarily mean a product is buggy. It means a product excludes nice-to-have features that doesn't add immediate value.

Basic validation is something I've always pushed for even for MVPs as that often goes hand in hand with platform security (another thing I still push for in MVPs)

Reply on news.ycombinator.com