31–40 of 102 posts
Hey there, just wanted to thank you because you also fixed my Twitter Spaces downloader app[0]! After the API changes the default bearer token I was using (same as yours) stopped working, but after changing the same way you all's back to normal :D 0: https://github.com/Chiplis/moonbird
I didn't feel like playing around with Twitter's annoying certificate pinning so I just uploaded the Twitter APK to Corellium, turned on what they call the "network monitor", opened the Twitter app since it lets you use Twitter without signing in. I clicked around, searched and viewed tweets. Then I looked at the requests in the log and saw it has a similar guest token process to the website but with a few differences. Anyways, if you recreate these requests, with one IP address you can generate a few OAuth tokens with no expiry per day. These tokens are for unauthenticated users so obviously they have no write privileges but that's not what was needed here. So if you have a proxy provider with a large pool of IPs where you can buy like 1GB of bandwidth you can use a very small percent of your bandwidth allowance and get thousands of tokens/secrets easily, all with their own separate rate limits. It doesn't even matter what IP you end up using the tokens on. Then I followed https://docs.google.com/document/d/1xVrPoNutyqTdQ04DXBEZW4ZW... and the fact that /statuses/lookup.json still allows you to return 100 (!) tweets at once to reconstruct something close to what the 50% Twitter firehose would look like. And Twitter doesn't even block datacenter IP addresses! Was going to display the data at https://firehose.lol but the fact that it required a few hundred requests a second made me feel bad so I didn't end up running the program for more than a few minutes at a time and shut it down.
Looking at (a fraction of) the Firehose for a few minutes was interesting, originally I accidentally forgot to not display tweets labelled possibly_sensitive so I saw some pretty salacious material for a few seconds. Lots of Chinese gambling ads even though Twitter is blocked there, dubious investment promoters, accounts with usernames like FirstnameLastname3781264872 who would tweet three random words at each other every couple of seconds, and a handful of funny tweets.
Is this really permanent? I'd love to know more about this bearer token. Because in the other github issue thread it seemed like every time they found a way around Twitter's safeguards, it was shutdown. It seems like they've literally hard coded a token into the source code. Meaning thousands of nitter-instances, thousands of users, around the world, will use the same token. And potentially so will the AI companies.…
This seems like Elon distributed free API tokens to specific 3rd party vendors?
What reason could he possibly have to give them to Nitter, which has at its primary purpose undermining their conversion and engagement attempts? The old token was the twitter web token. I suspect the new one is one of the mobile clients. Maybe new tweetdeck. Though probably the iOS client token makes the most sense, being the hardest to rotate on a whim with app store review.
Earlier quoted context omitted.
What reason could he possibly have to give them to Nitter, which has at its primary purpose undermining their conversion and engagement attempts? The old token was the twitter web token. I suspect the new one is one of the mobile clients. Maybe new tweetdeck. Though probably the iOS client token makes the most sense, being the hardest to rotate on a whim with app store review.
They don't have indivual tokens? Well, let's not give them ideas.
This is absolutely amazing, as you still can’t view profiles or replies on Twitter without logging in. I’ve been a nitter user for 4 years now and will be as long as it works.
Twitter should provide a noscript/basic (x)html interop www portal.
Is this really permanent? I'd love to know more about this bearer token. Because in the other github issue thread it seemed like every time they found a way around Twitter's safeguards, it was shutdown. It seems like they've literally hard coded a token into the source code. Meaning thousands of nitter-instances, thousands of users, around the world, will use the same token. And potentially so will the AI companies.…
My guess is that this token is used in the official Twitter web/mobile app - making it hard for Twitter to just straight up disable/ban.