Hacker News Reader

Comment by kentbrew | Hacker News Reader

As a fresh Yahoo! Developer Network employee I was the person who blabbed about the top-secret _callback parameter the weekend Pipes launched, which caused the service to be taken offline for capacity upgrade.

I had an interesting series of voicemails, ranging from "dude, WTF?" to "okay, we need to talk to you right away" to "we're pretty sure you're fired" but ending with "hey, Tim O'Reilly picked it up and ALL IS FORGIVEN THANK YOU!!!"

https://web.archive.org/web/20070302201929/http://developer....

View on HN

And now, Pipes can be mobilized and viewed on any mobile phone using SMS and WAP! Simply get the RSS feed of the Pipe and mobilize it using the 411Sync Mobile API. Within seconds, view it on your cell phone

Oh wow. There is so much in this paragraph that was best left forgotten.

What were the implications of knowing the _callback parameter?

You could invoke pipes from any webpage without worrying about cross-domain access.

If you look at some janky JS code[1] I had on my website at the time, you can see what you can do with it.

That would basically source

://pipes.yahoo.com/pipes/pipe.run?_id=7CTRtbtL3BGX_AHbjknRlg&_render=json&_callback=load_daily_show

as a static asset in my page, which would load the JS and call load_daily_show(<json>) as a result.

Now, EVERYONE who hits my page is invoking the pipe as a backend API call, with no caching and unfortunately with the entire Y/T cookies intact.

[1] - https://web.archive.org/web/20081007043923/http://t3.dotgnu....

Yeah I remember using it as a CORS proxy, it allowed me to put together a full client side music app (tracks source was not very legal) but tags, similar tracks/artists etc were pulled from lastfm and allowed to quickly build a decent playlist.

At that point in history APIs that returned a JSON object wrapped in a callback were few and far between (and Yahoo! had almost all of them). Pipes would give you anything you wanted in a callback, allowing for nothing-but-front-end mashups of anything that would hold still while being scraped.

Craigslist banned Pipes and un-banned it after YDN employee Jeremy Zawodny went to work there:

https://techcrunch.com/2009/12/01/craigslist-yahoo-pipes-fli... https://techcrunch.com/2009/12/16/craigslist-yahoo-pipes/

Reply on news.ycombinator.com