Twitter's pivot to x.com is a gift to phishers

https://krebsonsecurity.com/2024/04/twitters-clumsy-pivot-to-x-com-is-a-gift-to-phishers/

by todsacerdoti • 2 years ago

370 359 2 years ago

krebsonsecurity.com

isoprophlex• 2 years ago

So, basically, someone's broken regex can be a viable business model. Pretty crazy.

giancarlostoro• 2 years ago

“Now you have two problems”

ben_w12• 2 years ago

"OK, what about using AI to solve this?"

https://benwheatley.github.io/blog/2022/12/13-20.26.24.html

pksebben2• 2 years ago

you mean, someone's broken regetwitter

jjice• 2 years ago

Someone seriously did a s/twitter/x/g seemingly (or the raw string replace equivalent). Maybe there are more requirements here, but it seems like just parsing a URL and checking for `twitter.com` and some other literal domains instead of sub strings would have been completely fine.

AlphaCerium• 2 years ago

Relevant XKCD: https://xkcd.com/1031/

thrdbndndn3• 2 years ago

I just posted carfatwitter.com on twitter. It did not become carfax.com.

What am I missing?

Also, the article says:

The domain “ametwitter.com” already redirects to the real americanexpress.com.

But it does not here.

lolinder• 2 years ago

Probably that they rolled back the change when it became obvious it was bad.

thrdbndndn3• 2 years ago

The article is pretty fresh ("This entry was posted on Wednesday 10th of April 2024 10:28 AM", and the author is from the US. Even if he's on East Coast, it would only be half an hour ago) though.

Unless Twitter just fixed it within 1 hour, I think the author should mention it has been fixed (edit: or that it was limited to certain platform [iOS?], since it's not reproducible on web at least.)

quaunaut• 2 years ago

Are you visiting from the iOS(possibly Android too, but didn't see anyone mention) app? That's where it's generally happening.

thrdbndndn3• 2 years ago

I use the website.

ceejayoz3• 2 years ago

https://mashable.com/article/twitter-dot-com-posts-change-to...

X eventually realized the issue and rolled out a patch later that same day for some of the domains affected by this change. "Netflitwitter.com" no longer shows up as "Netflix.com" for example.
However, Mashable can confirm that the X for iOS app is currently still changing many other references of "Twitter.com" to "X.com." We noticed that in one instance we found, the change was happening when "Twitter.com" was being used in a subdomain for another URL.

HyprMusic• 2 years ago

I believe it only happens on the iOS app. Strange the article doesn't mention that.

mikeyouse• 2 years ago

It started off happening globally - they fixed it in most places, but not yet on the iOS app.

latexr2• 2 years ago

From the article:

Update: It appears Twitter/X has corrected its mistake, and no longer truncates any domain ending in “twitter.com” to “x.com.”

cdelsolar• 2 years ago

It is insane that this would get past QA or any sort of testing.

Etheryte• 2 years ago

I doubt there's much in the way of QA or testing after they made developers print their code out on paper for Elon to review.

i80and• 2 years ago

Elon fired all the people who would do QA.

Something new on twitter breaks every week. It's wild.

patwolf• 2 years ago

I haven't decided if twitter is actually more buggy or if bugs are more publicized because of the extra scrutiny since Musk took over.

There used to be a bug that wreaked havoc for a short time where you could force anybody to follow you. At the time I don't recall people blaming Twitter's leadership or culture--it was just a bug because software sometimes has bugs.

maxlin4• 2 years ago

No, more like something new on X breaks every year. The site is simple enough that that the engineering is mostly focused on optimizations and there's little more I or any other active user would even expect from the platform, outside of growing to new areas like YouTube-comparable video.

I find it quite bizarre how some people still try to push some narrative about the site being broken. It's not more broken it was before the takeover outside the odd Spaces dropout (which is a new feature so doesn't really count), but is now better serving its actual mission as an actually unbiased speech platform, radical as that is in the current day. Now X just needs to stay unchanged for ten years to overcome any competition.

ttepasse• 2 years ago

I recently tried to reinstall the Twitter for Mac app. It was never a good app. Although a flagship for Apple’s Catalyst, since its catalysation it never got the UI love other 3rd party clients for the Mac had. But it was at least somewhat usable. But somehow it got never updated for the X'ning, neither name nor icon, never got support for longer tweets and other stuff.

And now I click Install in the App Store and "something goes wrong". Simply can’t install it.

There must be UIKit people remaining at X, after all they’re updating the iOS app which must share the same code as the Mac app. But for some reason they don’t update, but leave a broken, uninstallable app on the App Store.

nojs2• 2 years ago

As devils advocate, maybe this is evidence such QA doesn’t matter as much as everyone thinks? It looks like no actual damage was done and the problem was fixed quickly once users noticed it.

zzzeek2• 2 years ago

pretty sure they just pushed it live without any messy "testing"

laborcontract• 2 years ago

I mean, forget QA. How does this get pushed at all?

comboy• 2 years ago

That's a beginner mistake, it's really hard to make if you dealt even a bit with some regular expressions.

tracker13• 2 years ago

Probably not even a regex, just a straight replace. Hopefully at the render layer and not the backend data.

s/\btwitter\.com\b/x.com/ig

remram2• 2 years ago

You made the same mistake with the same amount of confidence.

1. your version replaces at-twitter.com with at-x.com

2. your version replaces twitter.com.au with x.com.au

pavlov2• 2 years ago

Incredible to think that some people seriously want to get a brain implant created by this guy’s other company.

tombert9• 2 years ago

Or want to trust him to run a self-driving car. Or save the world from climate change or something.

I think Elon has kind of demonstrated that if you just keep stating that you did something with confidence long enough, some people will actually believe it.

throwaway2902• 2 years ago

Some stuff he does works (SpaceX), but lots doesn't...

pavlov2• 2 years ago

Five years ago he scammed me out of 7500 euros with the self-driving feature that remains dangerously dysfunctional. (It's sort of the computer vision equivalent of this Twitter regex.)

So I'm not falling for his bullshit again. But I suppose that's why he wants to own the world's biggest megaphone — to ensure he doesn't run out of us suckers.

CityOfThrowaway• 2 years ago

His companies did literally re-boot the electric car industry, American rockets industry, American battery production, satellite internet business.

These aren't the confident boasts of a charlatan, we have very concrete proof this happened.

psunavy03• 2 years ago

He has done stuff that actually worked in the past. Yes he's an asshole, and yes, Twitter faceplanted. I'm not sure why these two things require the entire internet to vehemently deny that he can ever succeed at anything and invent increasingly convoluted reasons why Tesla and SpaceX aren't going concerns.

tick_tock_tick• 2 years ago

Dude shit on all sorts of stuff but Noland Arbaugh's life is objectively better now and he himself certainly thinks so.

dang• 2 years ago

Please let's avoid repeating the most obvious flamewar for the thousandth time (if not the 10,000th by now).

We detached this subthread from https://news.ycombinator.com/item?id=39991316.

Edit: I suppose I need to add that this is not a muskpoint, it's just the principle of HN to try not to repeat things this much. Especially when the repetition is indignation-fueled.

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

rob74• 2 years ago

And this, dear Elon, is what happens when you fire your experienced developers because they cost too much...

datpuz• 2 years ago

Usually when you rebrand, it's because you've run your brand name into the ground. Elon did it just because the letter X is very cool or something?

burnte• 2 years ago

Revenge for being forced to honor his word at buying Twitter, he made them regret it by killing it.

lapcat3• 2 years ago

Revenge for being forced to honor his word at buying Twitter, he made them regret it by killing it.

This makes no sense. The court forced him to pay the shareholders the agreed upon price. Consequently, the shareholders were paid, and now they're no longer shareholders. Why would they regret that?

xyzzy_plugh• 2 years ago

He's been obsessed with this since the beginning with x.com in '99

sumtechguy• 2 years ago

All he needs is a ufo defense org and he is good.

duxup2• 2 years ago

I once worked at a company where the head of our department announced we were doing a re-org. He later explained that another department did so and at a board meeting the news was well received by the board ... so he was doing it too.

Sometimes leadership just feels the need to put their stamp on things so everyone knows they're there.

hackerlight3• 2 years ago

Elon's personality means he can't be in anyone's shadow. He needed to refound the company to remove the mental association with Dorsey and create the association that he's the founder.

vondur• 2 years ago

The "X" makes it sound cool. At least that's what Bender from Futurama taught me.

beretguy• 2 years ago

Elon rebranded to run Twitter into the ground.

teddyX• 2 years ago

Imagine acquiring the Bugatti brand then changing the name to “Karr”

Musks multiple unforced fumbles might be the biggest boneheaded blunders in corporate history

mondobe• 2 years ago

Whatever you say, teddyTwitter

Isamu• 2 years ago

He owned the X.com name, this is a way to get paid for use of it. That reduces the sting of the bad overall investment.

throwaway2902• 2 years ago

Curious if he sold his x.com to Twitter for profit, like Neumann sold to WeWork the brand and real estate

rtkwe2• 2 years ago

He bought x.com early and has probably paid stupid amounts of feed to hold on to it all these years so he's forcing it on his new pet project he totally wanted and had a plan for when signing legally binding documents. (/s)

I do believe he's just been obsessed with having x.com since he got it in the 90s and had a chance to use it and jumped at it just to put his own imprinter on the site.

htrp• 2 years ago

I mean once you buy a domain (for whatever price you paid), isn't it basically 20 bucks a year to keep it?

hbn• 2 years ago

From what I understand, Elon has owned the x.com domain for a long time and in the past wanted to rebrand PayPal to X the same way he did Twitter. Seemingly at that point in his career there were still people around to tell him no.

He also wants to make X into an "everything" app where you'll do shopping, calls, chat with friends, send payments, etc. And if that was pulled off successfully it doesn't seem like the craziest thing to distance from the Twitter brand which has long been associated as an app primarily for news and shitposting? But he has a long way to go to get people to think of it as anything other than what it was before. Everyone on the platform is still calling it Twitter and refers to posts as tweets.

stetrain3• 2 years ago

He also wants to make X into an "everything" app where you'll do shopping, calls, chat with friends, send payments, etc. And if that was pulled off successfully it doesn't seem like the craziest thing to distance from the Twitter brand which has long been associated as an app primarily for news and shitposting? But he has a long way to go to get people to think of it as anything other than what it was before. Everyone on the platform is still calling it Twitter and refers to posts as tweets.

I feel like the way to go there would have been closer to the Meta/Facebook brand hierarchy.

X is the platform / super app and Twitter is the first app within X. Twitter accounts become X accounts but you still use them to Tweet on Twitter.

The destruction of the Twitter branding seems more out of spite than business development goals. Really the whole follow through of the Twitter purchase reeks of spite and destruction rather than building something new of value.

But I'm not a successful billionaire so I'm probably wrong.

Thrymr• 2 years ago

He started X.com which merged with PayPal, but lost control of the domain over 20 years ago and didn't buy it back until 2017 [0].

[0] https://www.theverge.com/2017/7/10/15949862/elon-musk-x-com-...

zzzeek2• 2 years ago

he is an extreme narcissist and is very mentally unhealthy / unstable. X is his favorite letter. it's not "cool", he just fancies himself to be King Joffrey who can do anything he wants on a whim.

rsynnott7• 2 years ago

it's because you've run your brand name into the ground

And even then it usually doesn't work. It's _very_ unusual for full-scale rebrands of consumer-facing companies, where the original brand is utterly expunged, to stick.

maxlin4• 2 years ago

He's spoken about this in length. When it actually happened it did feel like a bit out of nowhere though, but makes sense in the engineering mindset to get it out of the way clear before fanning out to other areas, regardless of the hard-to-estimate ETA's for those features (talking payments, "mega-app"-like features, different ways of integrating Grok, possible new UI flows for YouTube/Twitch-like fronts etc)

coldpie• 2 years ago

I closed my Twitter account when this guy took over, for all the obvious reasons. Somewhat to my surprise, it actually turned out to be a massive boost to my mental health. For a week after I closed the account, I'd find myself thinking, "I'm bored, I should check Twitter... oh wait, I can't" and then I'd just go on with my day. It was fantastic and I don't miss it at all. So in a weird way, my life got better when he took over.

Definitely recommend closing your account if you're on the fence. Don't move to bluesky or whatever, just take this opportunity to cut all this crap out of your life. You don't need it.

pksebben2• 2 years ago

did the same for facebook circa 2020, and even in lockdown it was a godsend. Obliterated my reading list and actually managed to make headway on the massive list of mothballed projects.

ghusto• 2 years ago

It's okay to be bored. Boredom serves a purpose. When boredom is taken away from you, you end up not making an effort for anything worthwhile.

People worry about what (web caused) divisive propaganda, erosion of social skills, and attention grabbing is doing to us — and I agree those are all real and serious threats — but the lack of boredom is worries me the most.

yifanl2• 2 years ago

The now rare clbuttic self-inflicted wound.

cyxxon• 2 years ago

So, Twitter did a clbuttic mistake in 2024 and went live without testing this, presumably?

nfriedly• 2 years ago

For those unaware: https://thedailywtf.com/articles/The-Clbuttic-Mistake-

duffyjp• 2 years ago

That was a fun read. I fired up a Valheim server for my kids (and me, let's be honest) and it censored part of the word "Basement" in my server name. :)

timoxley• 2 years ago

Clbuttic is even the (Collins) dictionary-defined nomenclature for this effect: https://www.collinsdictionary.com/us/dictionary/english/clbu...

k1rd• 2 years ago

reminds me of teh cloud-to-butt chrome extension https://chromewebstore.google.com/detail/cloud-to-butt-plus/...

65• 2 years ago

Clbuttic -> Cl-ass-ic -> Cl-butt-ic

nojs2• 2 years ago

I mean I recently saw an Airbnb ad with something like pREMOVED instead of pagoda, so I guess it happens to everyone

extraduder_ire2• 2 years ago

I was wondering what kind of rude word an 'agoda' is. Turns out it's a competing website to airbnb. How incredibly petty.

EdwardDiego• 2 years ago

Is this like the Scunthorpe Problem?

ryandrake2• 2 years ago

Everything about this rebranding has been baffling to me. First, the original brand was great and pretty much untarnished, and there was no split/merger of business happening that would encourage it. There doesn't seem to be a business purpose to rename it. Second, these hamfisted attempts to try to get the new (terrible) name to stick. It's just not going to work. The huge number of existing users will always think of it as Twitter. It will at best become The Service Formerly Known As Twitter. It just feels like in software when you get a new Product Manager on the project who just wants to superficially "leave his mark" on the product in some way and then move on. Except this PM paid billions to do it.

rco8786• 2 years ago

Apparently Elon has been trying to push the "X" brand on things throughout his career, but always had someone stop him until he had complete control of things.

https://en.wikipedia.org/wiki/X.com_(bank)

https://www.washingtonpost.com/history/2023/07/25/elon-musk-...

Hamuko2• 2 years ago

Is there a company he owns where "X" is not a thing? There's X the social network, Tesla Model X, SpaceX.

elcritch• 2 years ago

Seems Musk always had a desire to use "X" from his pre-Paypal days. He made a boastful post about buying Twitter, didn't actually want to follow through but was forced to do it by the courts.

My take is that Musk then sorta went "f-it, I had to buy Twitter. I might as well try and make it into X."

mocha_nate• 2 years ago

His first payment company before he merged with PayPal was X.com

MattGaiser2• 2 years ago

The purchase was never about business in the first place, so the running of it could be just as bad.

fundad• 2 years ago

Exactly! Ownership is not in it for revenue. They'll say they don't care about revenue to everyone who asks. To be baffled, one has to ignore all of that.

There is strong nostalgia for aw-shucks persona of an inventor-turned-business-owner.

https://www.cnbc.com/2023/05/16/cnbc-exclusive-cnbc-transcri...

https://www.rev.com/blog/transcripts/dealbook-summit-2023-el...

jsheard3• 2 years ago

Nearly a year into the rebrand x.com still redirects to twitter.com, rather than vice versa, which you'd think would be the first thing they'd want to fix.

duxup2• 2 years ago

That's one of those situations that feels like: "Executive just hasn't noticed / lost attention span, and engineer is leaving a workaround for a bad call in place."

Hamuko2• 2 years ago

I imagine that changing it would break a lot of things, otherwise they would've done it already. Copying a link to a tweet already makes it an x.com link too.

shadowgovt2• 2 years ago

Because domain names are tied to security model, they're often the last thing you can fix.

So let's say, hypothetically, they build in a redirect from twitter to x-dot-com. Off the top of my head...

- All logins are now busted. Some percentage of users is lost forever because they can't remember their login credentials and instead of going through the recovery flow, they go use Bluesky.

- A huge amount of third-party integrations are busted because they aren't using client libraries that understand redirects

- A full code audit is necessary. Someone has hard-coded twitter.com into a critical system somewhere. Other people have referenced a variable, but it's the wrong variable. Still others are looking up the value in a database somewhere that doesn't have a search frontend anyone knows about. And some other database has a huge cache of absolute URLs it vends and everyone who built it got fired by Musk. This is probably the most predictable-cost step, but it's still a cost to be paid.

- A significant number of users are confused. The median of web user is profoundly ignorant of how the web works, and no matter how much you warn them and how much you prepare them, day-of-switch they will panic. Staff up your support team. Customers-lost-forever-two-point-oh.

- Every business integration needs to be updated. Google App Store, Apple App Store, Amazon Appstore... They all have bindings to twitter.com, and some part of their flow will panic and flag a security issue if they see it's turned into a redirect to elsewhere. That probably triggers a security audit of every version of the Twitter client (and those companies aren't particularly inspired to foot the bill on Musk's behalf, billionaire that he is...). Hell, Google indexes twitter.com via a dedicated side-pipe. Will that side-pipe handle a redirect?

(source: I've been in the side-seat for a merger-become-rebrand, and the number of things people expect to "just work" and don't is impressive).

nearlyepic• 2 years ago

Presumptuously:

It's stupid and irrational because this wasn't a decision that was made based on reason - it was an emotional one. Elon is a bag-holder. He bought x.com in the dotcom boom and doesn't want to admit that the domain he paid a good chunk of money for is worthless - hence the (failed) attempt to make a brand out of it.

dom962• 2 years ago

Any ideas how much he paid for the domain back then?

zettabomb2• 2 years ago

So far I really haven't seen anyone seriously call it just X. Most news orgs seem to resort to "X (formerly Twitter)" or similar. Some still call it Twitter, not even an acknowledgement that it's been renamed. At least Meta had the sense to just change their app splashscreens and such (e.g. Facebook by Meta). And it seems that Alphabet doesn't make any effort to make their presence known.

rsynnott7• 2 years ago

Most news orgs seem to resort to "X (formerly Twitter)" or similar.

I mean, if nothing else, "X did [something stupid]" just looks like someone forgot to fill in a template; no-one is going to publish an article with 'X', unqualified, in it.

baobabKoodaa2• 2 years ago

The thing that really bothers with me with this is why couldn't it just be "Twitter by X"? You want to make an "everything app", that's great Elon, let's call that X. Now what do we call all the mini apps inside the everything app? Oh, they're called "X", too? So you're using "X of X" to call a cab, and "X of X" to send a message, and these are different apps inside the mega app? How does this naming make sense?

jsheard3• 2 years ago

Even X itself resorted to putting "Formerly Twitter" in its App Store and Play Store taglines after their daily installs fell off a cliff. Previously the tagline was just "Blaze your glory!" but nobody knows what that means.

foobarchu• 2 years ago

Shoot, even the Wikipedia page is still titled "Twitter"

ben_w12• 2 years ago

The Service Formerly Known As Twitter

Was thinking almost exactly this while reading a recent BBC article — their style guide appears to be that the company's name is "X, formerly Twitter,"

nprateem• 2 years ago

You have to write that (or similar) in UIs too since X just looks like a mistake/null value.

andsoitis2• 2 years ago

Everything about this rebranding has been baffling to me. First, the original brand was great and pretty much untarnished, and there was no split/merger of business happening that would encourage it. There doesn't seem to be a business purpose to rename it.

Stated goal is to gradually transform it into an “everything app” — https://theconversation.com/elon-musk-aims-to-turn-twitter-i...

baobabKoodaa2• 2 years ago

First, fire 80% of developers. Then, make the remaining developers create an "everything app" (in addition to the workload they already have with the Service Formerly Known As Twitter app). Something, something. Profit ???

hgs3• 2 years ago

I think the "everything app" already exists. It's called a web browser.

pjc504• 2 years ago

Ketamine is a hell of a drug. https://www.wsj.com/business/elon-musk-illegal-drugs-e826a9e...

lol768• 2 years ago

Everything about this rebranding has been baffling to me.

Everything about the purchase and the way the company has been run since Elon took the reigns has been baffling. The bizarre forced-push of the X brand is just the tip of the iceberg.

JeremyNT2• 2 years ago

Everything about the purchase and the way the company has been run since Elon took the reigns has been baffling. The bizarre forced-push of the X brand is just the tip of the iceberg.

I dunno, is it that baffling? It seems like he really loved using the product but didn't like the leadership, and he just wanted to own it so he could mess around and have fun following his own whims.

Once you get the idea that he doesn't actually care about financial success it all seems pretty reasonable. Like any hobby, for X/Twitter to be a "success" it just has to amuse him, and based on his usage of the platform it seems to be doing that.

The amounts of money he's losing are staggering to us but also meaningless to him. Our society has allowed him to accumulate so much wealth that nothing he could do "wrong" in a business sense would meaningfully impact his lifestyle.

ziddoap• 2 years ago

Everything about this rebranding has been baffling to me. First, the original brand was great and pretty much untarnished

I always thought the rebrand was a complete shame, if only for the reason that "tweet", meaning "to make a posting on the Twitter online message service : to post a tweet" is in the dictionary!

What a waste to throw that away.

mparnisari• 2 years ago

It just feels like in software when you get a new Product Manager on the project who just wants to superficially "leave his mark" on the product in some way and then move on. Except this PM paid billions to do it.

This is how it goes in all big companies :(

throw2022110401• 2 years ago

True but there is no way it would be implemented in such a half-assed way at any other big company (including pre-Musk Twitter).

Stuff like this makes it obvious that the people who are still there no longer give a fuck, they just do what they are told with the minimum effort required to collect the paycheck.

visarga• 2 years ago

What can you do if he likes "X". It used to sound cool at some point decades ago.

Philadelphia2• 2 years ago

The X Games, X-treme X-men, Xander Cage in XXX era

babypuncher4• 2 years ago

Everyone I know has partially adopted the new brand and started calling it Xitter.

xboxnolifes• 2 years ago

Until just now, every time I saw someone in HN mention Xitter I assumed it was a third-party client like Nitter.

WorldMaker• 2 years ago

Which is especially fun to pronounce with the Pinyin 'x': https://en.wikipedia.org/wiki/Pinyin

aidenn02• 2 years ago

He really likes X. He even named one of his kids that (well X Æ A-12, with the spaces). The A-12 is indeed a reference to the plane that came out of the oxcart project. Æ Musk pronounces "Ash" which is apparently an accepted name for the character, which was (among other things) used as a latinization of the futhorc rune[1] that means "ash tree"

1: HN won't let me paste the rune, not sure if it's limited to BMP on purpose but you can see it on https://en.wikipedia.org/wiki/Ansuz_(rune)

segasaturn2• 2 years ago

They government let him name his kids that? I remember a story a long time ago about a couple that tried to name their kid "Brfxxccxxmnpcccclllmmnprxvclmnckssqlbb11116" which is about as meaningful as "X AE A-12", but was blocked by naming laws

yowzadave• 2 years ago

Two kids! (A girl, named Exa, in addition to X).

Symbiote• 2 years ago

Ironically, Æ is the most useful part of this child's name. Ash short for Ashley or Ashleigh is common for girls and boys in Britain. Wikipedia suggests the name is mostly for girls in the USA.

drivingmenuts• 2 years ago

The best new name I've seen is Xitter. Very fitting, IMO.

rurp2• 2 years ago

Maybe they need a new slogan to help folks with the transition. Something like: "Don't tweet, Xcrete!"

tinyhouse• 2 years ago

Since most of my tweets where related to work, I moved from Twitter / X to LinkedIn. Twitter under Elon is a huge mess. The irony is that he kept complaining about spam and bots before. Since he took over, my new followers and many of the likes I received were from new only fans like users. Maybe it's by design and he wants to make it an only fans clone. But I'm out. I don't even bother reading my feed yet alone posting.

LinkedIn has its problems too. I would say it's the least bad among the two.

tracker13• 2 years ago

My biggest issue with LinkedIn is their horrible mobile web interface. I didn't trust their app. I know it's been years, but they burned anything resembling trust.

kibwen3• 2 years ago

On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links — such as fedetwitter[.]com, which is currently rendered as fedex.com in tweets.

I'm in awe. Does Twitter have any software developers left, or is it just Elon's nephew working his way through W3Schools?

genter• 2 years ago

I had to clean the coffee off my keyboard after reading that.

adamors• 2 years ago

There a lot of people on visas who can’t quit, so …

wannacboatmovie2• 2 years ago

Do you have any evidence of this?

It is a borderline racist trope that keeps being repeated (mostly by ex-Twitter developers with a chip on their shoulder) without any hard proof. It is equally likely they are upset over a lack of solidarity in quitting and are perpetuating a lie based on someone's citizenship status.

hankchinaski• 2 years ago

Move fast and break things I guess

jader2012• 2 years ago

I’m confused how this can be used for phishing?

Does the text only get replaced, and the underlying link stays intact? Surely not?

Otherwise, the link would still go to fedex.com.

bluedel• 2 years ago

No, you got that right. Only the displayed text is affected.

dom962• 2 years ago

Does the text only get replaced, and the underlying link stays intact? Surely not?

That is exactly what happens.

aavshr2• 2 years ago

Yes, only the text gets replaced but not the underlying link.

Once you navigate to the link it will be the actual link in the URL bar however.

But this is an easy miss for people after they have already navigated to the link from twitter thinking it's a legitimate link.

campbel• 2 years ago

Yeah, looks like _only_ the link label gets replaced, otherwise as you suggest it wouldn't be as bad.

sylens• 2 years ago

Exactly it.

Please use your Microsoft gaming account to login to my phishing site, xbotwitter.com

redundantly• 2 years ago

It's Elon himself working his way through W3Schools.

vlan02• 2 years ago

Does Twitter have any software developers left

Not many people in the field actually understand protocols at the RFC level. That's the real crux.

lokar3• 2 years ago

No, that is not the issue. This is far more basic.

chuckadams• 2 years ago

Musk fancies himself a coder, so he probably wrote it himself and pushed it to master without review; or he did have it reviewed and fired anyone who pointed out the mistake.

rsynnott7• 2 years ago

Everything that is old is new again: http://news.bbc.co.uk/1/hi/sci/tech/2138014.stm

Possibly, as with the extremely 90s-feeling 'X' name, Musk is simply introducing retro bugs, to attract internet hipsters :)

NelsonMinar• 2 years ago

Apparently they have just one developer left who knows just enough to break things. Maybe they use Grok.

Anyway some engineer wrote this change and deployed it. The product process failed though, as did the testing process. Rollback was a mess too, given this change was visible for hours (days?)

wannacboatmovie2• 2 years ago

Salty ex-Twitter developers too busy huffing their own farts to remember when the pre-Elon CISO (mudge) was fired after he uncovered how messed up things were behind the scenes, then filed a whistleblower complaint and testified before Congress.

Twitter was not a marvel of engineering pre-Elon, despite the fantasy arrogant former developers keep perpetuating. Their infrastructure was barely held together with duct tape.

some-guy• 2 years ago

1) Twitter wasn't a marvel of engineering pre-Elon 2) It's worse post-Elon (bot issues, paid blue checks at the top, increase in hateful posts, etc)

gofreddygo2• 2 years ago

FFS. Maybe a tweet with a rickroll to spacetwitter.com will catch his eye. Whoever owns that domain, here's your 15 mins.

perihelions2• 2 years ago

I don't understand the social structure inside a software company where this kind of thing can go from some intern's 3am idea to production, without passing many layers of gatekeepers, any one of which should have swiftly flagged this down. It's not that the string replacement was implemented wrongly (that too)—it's that they're touching, in any manner at all, one of the most obviously-sensitive UX things in their product. Without a commensurate amount of security review.

Like, in my imagination, within five minutes of anyone seeing this, a person with responsibility would have stepped in and said "No, you can't do this. And if you insist on doing this, here's five layers of audits and sign-offs that this needs to go through first, because the thing you're proposing is potentially really dangerous". Am I thinking it about it wrongly?

I cannot understand at all.

MattGaiser2• 2 years ago

without passing many layers of gatekeepers

Given all the Twitter bugs and issues, it seems they have all been laid off.

scblock• 2 years ago

some intern's 3am idea

I think you mean "Elon Musks random demand".

greenthrow• 2 years ago

Anyone who would tell Elon "this isn't a good idea" left or was fired.

zettabomb2• 2 years ago

I don't understand the social structure

There is none. Stop trying to understand - it's a fool's errand.

a person with responsibility would have stepped in

There are none left. They were either laid off, or they left before that could happen.

"No, you can't do this"

... is the last thing anyone says to Elon Musk before getting fired.

rtkwe2• 2 years ago

Well it starts with the bad idea probably coming from the top, Musk saying I'm tired of seeing twitter.com links change them all to look like x.com links, that plus his gutting of the company when he took over means there's less people around to be the person to say no you can't do this this way go back and start over (or not at all).

quandrum• 2 years ago

It's probably worse with Musk. His executive style seems to be, from his biography, ignore a thing for a while until he gets in a maniac phase and then over the shoulder manage a thing until it's done, regardless of time or context.

I can just take the scene of Musk being on a roof yelling at the crew to change how they install solar tiles late in the night and translate it to him berating a programmer in the office to make it look like x.com and not caring about the details.

pjc504• 2 years ago

Like, in my imagination, within five minutes of anyone seeing this, a person with responsibility would have stepped in and said "No, you can't do this. And if you insist on doing this, here's five layers of audits and sign-offs that this needs to go through first, because the thing you're proposing is potentially really dangerous". Am I thinking it about it wrongly?

Which part of "anyone who is not a Musk yes-man has already been fired or quit" are you having trouble with?

lenerdenator2• 2 years ago

It's worth remembering, there are two kinds of yes-men:

1) the sycophant who loves authoritarian institutions; the "true believers"

and

2) the young, brilliant visa holder who was the talk of his parents' social circle in Hyderabad three years ago when he graduated and was able to get on board at a household-name NorCal tech company, but who is now being abused by the employer who sponsors the thing that lets him stay in the US.

You'll always have type one; some humans simply love following a dolt. The second type is a result of our laws, and laws can be changed to keep people like Elon from taking advantage of workers.

segasaturn2• 2 years ago

Well, that is the specific outcome Elon wanted when he laid off three-quarters of the company. He very clearly stated that he didn't see the value of the "trust and safety" teams that would have been the ones to flag something like this down.

ceejayoz3• 2 years ago

This wouldn't have fallen within "trust and safety" purview. This should've been caught in even the most cursory of code reviews.

lokar3• 2 years ago

Go re-read all the comments here during the take over and layoff where people claimed it could not possibly take more then a handful of people to run such a simple site.

misiti37802• 2 years ago

he fired a huge number of the staff and the site is still running, so how was that assumption not proven correct ?

rsynnott7• 2 years ago

I mean, I assume anyone who could get another job has already left, so they're probably running low on competent gatekeepers.

swid2• 2 years ago

Don't take this as a defense of what is a harebrained idea; but this kind of replacement should be easy to do correctly. You know; in such a way where only real twitter.com links are changed to x.com.

Honestly it is only somewhat surprising to me that no one noticed the error ahead of time. On the one hand, this is the type of mistake I do see in reviews from time to time... usually in the form of a regex that is not anchored to the start of the string, or perhaps it uses a non escaped period which of course means "any character" in regex. On the other hand, it is revealing about the kinds of controls in place that it got through.

notatoad2• 2 years ago

even things that are easy (or maybe, especially things that are easy) can benefit from having a review to make sure you didn't miss something obvious.

nothing more dangerous than "oh, that's easy, let's push it straight to prod"

perihelions2• 2 years ago

That's a good hypothesis with the non-escaped period! That someone wrote /twitter.com/ for the string substitution, which almost works, and then added a second one like /\w+.twitter.com/ for subdomains, which also seems to work, and would pass simple tests to check if it works or not. Matches everything it's supposed to; rejects most of the things it shouldn't.

renewiltord• 2 years ago

Well, that’s because any org that has five layers of audits for this just has five layers of audits for everything and so rarely gets anything done. This is a clbuttic bug. It’s silly and damaging but easy to fix and move on with.

Not particularly different from Bluesky allowing one guy to own all of S3.

sangnoir3• 2 years ago

I don't understand the social structure inside a software company where this kind of thing can go from some intern's 3am idea to production

This is what happens when you "cut the fat" and are left with an adversely-selected[1], skeleton crew of "hard core engineers." The site was never going to fail all at once, instead, it's a death by a thousand cuts and suboptimal engineering.

1. No disrespect to current Twitter engineers who can't leave easily, or believe in the mew mission. However those who survived layoffs but could leave have left.

SmartJerry• 2 years ago

This article was 5 hours old at the time I'm viewing it and the bug is supposedly already fixed per the article itself. So yea, seems like this was probably fixed within 5 minutes of anyone noticing.

neilv• 2 years ago

What code LLM tools are Twitter employees allowed to use? Would be funny to find when this exact code was generated.

iainmerrick3• 2 years ago

To call this "amateur hour" would be unkind to amateurs. But maybe they can at least get the "hour" part right if they roll it back quickly enough.

williamsmj• 2 years ago

If the CTO builds an engineering team that lacks the expertise to write a regex that matches the company's own name, and builds a culture of security and quality process that failed to catch this before shipping to production, then the CTO should be fired for cause.

Unfortunately the CTO also owns the company.

mise_en_place• 2 years ago

I wouldn’t go that far but there is a teachable moment here. It goes to show how little engineers actually read PRs/MRs these days…it’s just become a rubber stamp at this point. This is not a problem specific to X, I’d wager a lot on that. It’s a widespread cultural problem in our industry. Remember XZ?

iainmerrick3• 2 years ago

How is that connected at all to the Twitter fiasco? One is a very sophisticated backdoor attempt in an open source library, the other is an utterly boneheaded and simplistic mis-feature in a closed source platform. They could hardly be more different.

renlo• 2 years ago

if `twitter.com` is mapped to `x.com`, then a link `carfatwitter.com` will go to the non-malicious `carfax.com`, so registering `carfatwitter.com` seems to be just a stunt. When would `carfax.com` redirect to `carfatwitter.com`? Urls with `twitter.com` in the name are affected, not urls with `x.com` in the name.

edit: from the responses looks like I was wrong; the urls still point to `carfatwitter.com`. Leaving my comment up in case others were confused like me.

filleokus• 2 years ago

It's not redirecting but rather rewriting of the URL.

e.g "https://twitter.com/{acc}/status/{id}" -> "https://x.com/{acc}/status/{id}".

So if you post "https://carfatwitter.com/scam" it will be rewritten to "https://carfax.com/scam". Essentially search and replace of twitter.com -> x.com, 's/x.com/twitter.com/g'.

jerf• 2 years ago

I infer that the display was getting rewritten, but the underlying target of the link would not. So if you posted "carfatwitter.com", the UI would display "carfax.com" but the underlying link would still go to "carfatwitter.com".

Note I have no direct experience with this, it's just the only way this makes sense as a phishing vector. The alternative is that it is being presented as a phishing vector, but was never actually useful as such, and people are just jumping up to yell about a security issue without it actually being one. That happens too.

mcphage• 2 years ago

The links themselves are unchanged, just how they display. So if you type carfatwitter.com in a tweet, then it will display as carfax.com, but if you click on the link, it will still redirect you to carfatwitter.com.

code_duck• 2 years ago

It appears the substitution only affected the text of the link, not the destination.

__MatrixMan__• 2 years ago

PSA we don't have to let billionaires own letters if we don't want to. We can just keep calling it twitter if we want.

bimblesticks• 2 years ago

Looks like their devs learned RegEx on regetwitter.com

Dwedit• 2 years ago

NO REGETS

shadowgovt2• 2 years ago

It's been a bizarre ride watching Twitter slowly unravel under the new leadership.

It'll have a long way to fall... the total userbase is still around the same order of magnitude as the population of the United States. But when I read stories of decisions like this, I can't help but think that it indicates the adults are no longer in the room, and a 300-million-plus userbase becomes a massive target surface if it's being run by a team that doesn't really grok the Internet...

rsynnott7• 2 years ago

Beyond the incredibly botched implementation, the actual _idea_ is very funny; the 1984 approach to rebranding. Twitter, the Unwebsite. Like, how the hell could he think this would actually work.

dindobre• 2 years ago

Glad the site is rotting tbh, it wasn't great before and now it's so full of bots and propaganda it feels surreal. Posting and/or reading from Ukraine is even more surreal.

ofslidingfeet• 2 years ago

All this heady analysis because a company changed its name without permission from gestapo.

ergonaught• 2 years ago

It's Twitter.

It's not "X".

Not sure specifically why Mr. Musk lost the thread but very little involving Twitter has demonstrated whatever qualities were involved in the "positive" reputation he'd earned via Tesla and SpaceX.

The one thing for which I am thankful is that his various decisions have completely removed Twitter from my life, but that doesn't seem like the sort of outcome one wants for the platform.

slowhadoken• 2 years ago

I have Elon hit piece exhaustion.

andybak• 2 years ago

Are you talking about the original article? How is this a hit piece in any form? It doesn't even mention Musk by name.

JTbane• 2 years ago

I'm just sad they killed the blue bird, and the "tweet" verb as well.

maxlin4• 2 years ago

It's certainly less weird in official contexts now though. The brand was OK but not really "scalable" without sounding like something right off Idiocracy in some contexts.

remram2• 2 years ago

I'm not using xcreting so I'm sticking with tweeting until the platform dies.

PartiallyTyped• 2 years ago

Well, I think that's a fair characterization for a non trivial portion of the users.

maxlin4• 2 years ago

Well that title didn't take long to go entirely invalid as this isn't a thing anymore.

Reasonable to doubt if this ever was thing as this seemed to only exist on iOS and due to the direction this went it didn't really do anything. Probably different if it had gone x -> twitter

victorbjorklund• 2 years ago

Jesus. How badly is elon running things?

carl_dr2• 2 years ago

Programmers love cooking, they like chopping the caret.

carl_dr2• 2 years ago

Come on guys, this is a good joke.

   new_host = host.replace( /twitter\.com/, “x.com” )

(I wonder if they have escaped the period?)

Twitter's pivot to x.com is a gift to phishers

Related Stories