Hacker News Reader

Comment by koolba | Hacker News Reader

FYI for anyone working at Twitter, the legacy JS disabled mobile site still displays the hacked bitcoin tweets.

For example try this with JS disabled vs enabled (404): https://mobile.twitter.com/JoeBiden/status/12835123178466590...

Absolutely amazing. A friend and I just tested this and it's true. It makes me think this is a little more than the "rogue employee" story they're peddling.

I’m not sure. It could be as simple as quick hack to hide the deletions that was not deployed to the legacy site.

Seems like a huge liability. They are still disseminating these messages under the identities of major public figures, 8 hours after they became aware of it.

Repro'd with:

    curl -fSsL https://mobile.twitter.com/JoeBiden/status/1283512317846659073 | grep -i bitcoin

I’ve been checking periodically and they finally removed the data from this vector. It was up for at least 12 hours longer than the rest of the site.

Wow. This does the job for me:

curl 'https://mobile.twitter.com/JoeBiden/status/12835123178466590... -H 'cookie: m5=off;'

4 hours later... Still live. (Wow, that site's quite the blast from the past.)

FFS Twitter, get your act together.

So, did you make Twitter aware of this?

at the end of the day, Twitter is a website, and web developers are clowns

Reply on news.ycombinator.com