Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter is using its embedded JavaScript to hide tweets that have been deleted

kevinmarks.com

Post reply on HN
Print view View original

131–140 of 254 posts

Re: Twitter is using its embedded JavaScript to hide tweets that have been deleted

#131

Post by lol768 »

fswd wrote: post #85
jdrc wrote: post #26

Earlier quoted context omitted.

There should be an HTML tag or something that downloads and embeds HTML from a remote site without scripting

https://developer.mozilla.org/en-US/docs/Web/HTML/Element#em... or already exist. maybe they would work?

is an experiment/pet project pushed (and only implemented!) by one browser vendor, which as far as I know remains feature flagged.

It was shipped behind a flag with an initial implementation vulnerable to a same origin policy bypass as well as local file disclosure. As far as I can tell the only reason it wasn't assigned a Moz standards position of "harmful" is because Google argued "it's actually still a work in progress!" (three years ago).

Refs:

- https://research.securitum.com/security-analysis-of-portal-e...

- https://github.com/mozilla/standards-positions/issues/157

Re: Twitter is using its embedded JavaScript to hide tweets that have been deleted

#132

Post by jdrc »

manigandham wrote: post #87
jdrc wrote: post #26

Earlier quoted context omitted.

There should be an HTML tag or something that downloads and embeds HTML from a remote site without scripting

That's exactly what an is.

iframe is loading a whole page with script permissions (and sandboxed). it seems there isnt any tag for adding a remote snippet of html, like you can do with ajax

Re: Twitter is using its embedded JavaScript to hide tweets that have been deleted

#133

Post by jdrc »

saagarjha wrote: post #80
jdrc wrote: post #26

Earlier quoted context omitted.

There should be an HTML tag or something that downloads and embeds HTML from a remote site without scripting

Ok, but then Twitter is just going to make that return a 404. How does this solve the problem?

why would they?

Re: Twitter is using its embedded JavaScript to hide tweets that have been deleted

#134

Post by scim-knox-twox »

saagarjha wrote: post #89
scim-knox-twox wrote: post #79

Earlier quoted context omitted.

> Just taking a screenshot, and linking to the tweet, seems like a more robust solution, that won't randomly stop working, and doesn't have the same privacy issues. And have none accessibility.

You can include a copy of the text along with a screenshot, or put it in alt text…

No, it is not for that.

Re: Twitter is using its embedded JavaScript to hide tweets that have been deleted

#135

Post by simonw »

tofuahdude wrote: post #16

You don't need to use Twitter's JS to show Tweets. If you choose to use their system, you're subject to their rules. If you don't like their rules, don't use their stuff. Calling it "altering the public record" is a little hyperbolic imo. If you want to act as a repository for the public record, you better use your own system. Twitter is under no obligation to retain this kind of stuff on your behalf. I'm not trying…

"If you want to act as a repository for the public record, you better use your own system."

I deliberately chose Twitter's JavaScript because I inspected the design of how it worked and saw that they had deliberately built it in a way that would respect my preferences for how deletion should be handled.

They've changed that on me - without even announcing the change. This is a rug-pull.

Now I have to replace their code with my own implementation, and they've hurt my trust.

Re: Twitter is using its embedded JavaScript to hide tweets that have been deleted

#136

Post by simonw »

bennyp101 wrote: post #126
hda2 wrote: post #45

Earlier quoted context omitted.

> Twitter is under no obligation to retain this kind of stuff on your behalf. They declared something worked one way then silently changed how that thing works without properly announcing the change first and giving people enough time to adapt. Would you still be willing to make these excuses if your emails provider decided to do the same thing? Even if it's their system, there's a limit where people would rightfully…

An email provider (which you most likely pay for - and don't publish on a website) is very different to a social media site (that you don't pay for and want it out in the public) It's a free service that they provide - why can they not change how their system works when they want? People can object whenever they want - but it doesn't change the fact that they don't have any 'rights' to show someone elses content via…

If I embed your JavaScript on my page I am giving you a HUGE amount of my trust. You should treat that as sacred.

Re: Twitter is using its embedded JavaScript to hide tweets that have been deleted

#137

Post by epeus »

tofuahdude wrote: post #16

You don't need to use Twitter's JS to show Tweets. If you choose to use their system, you're subject to their rules. If you don't like their rules, don't use their stuff. Calling it "altering the public record" is a little hyperbolic imo. If you want to act as a repository for the public record, you better use your own system. Twitter is under no obligation to retain this kind of stuff on your behalf. I'm not trying…

If they want to change this, they can have a new version of the widgets script that makes it clear that it will edit your site, and switch to that in future embed links from the site. Changing the existing one is leaving holes all over the web. Buzzfeed is decimated.

Re: Twitter is using its embedded JavaScript to hide tweets that have been deleted

#138

Post by thirdvect0r »

simonjgreen wrote: post #32
pwdisswordfish9 wrote: post #8

Earlier quoted context omitted.

Aren't they? Of course they are doing it for their own sneaky benefit, if only in terms of PR.

HN 2023 article: "Companies optimising for profit through good PR considered hostile"

Correct

Re: Twitter is using its embedded JavaScript to hide tweets that have been deleted

#139

Post by chaps »

simonw wrote: post #135
tofuahdude wrote: post #16

You don't need to use Twitter's JS to show Tweets. If you choose to use their system, you're subject to their rules. If you don't like their rules, don't use their stuff. Calling it "altering the public record" is a little hyperbolic imo. If you want to act as a repository for the public record, you better use your own system. Twitter is under no obligation to retain this kind of stuff on your behalf. I'm not trying…

"If you want to act as a repository for the public record, you better use your own system." I deliberately chose Twitter's JavaScript because I inspected the design of how it worked and saw that they had deliberately built it in a way that would respect my preferences for how deletion should be handled. They've changed that on me - without even announcing the change. This is a rug-pull. Now I have to replace their co…

Why did you trust them from the beginning? Serious question.

Re: Twitter is using its embedded JavaScript to hide tweets that have been deleted

#140

Post by tom_ »

simonw wrote: post #135
tofuahdude wrote: post #16

You don't need to use Twitter's JS to show Tweets. If you choose to use their system, you're subject to their rules. If you don't like their rules, don't use their stuff. Calling it "altering the public record" is a little hyperbolic imo. If you want to act as a repository for the public record, you better use your own system. Twitter is under no obligation to retain this kind of stuff on your behalf. I'm not trying…

"If you want to act as a repository for the public record, you better use your own system." I deliberately chose Twitter's JavaScript because I inspected the design of how it worked and saw that they had deliberately built it in a way that would respect my preferences for how deletion should be handled. They've changed that on me - without even announcing the change. This is a rug-pull. Now I have to replace their co…

Ask for your money back.
Post reply on HN