This Package Saved My SaaS

[@jugalgadhavi]

That one jira ticket will speed run itself from backlog to in-progress

[@jasondads9509]

Dont let musk see it Xd

[@WebDevCody]

The Twitter backend engineers while implementing that token param: “nobody’s gonna know. How would they know?”

[@OMODINGDANIEL-v9s]

So crazy🤣🤣🤣🤣

[@yassine-sa]

Also Twitter engineers: there is only one way for that to happen, someone with us made the library 😏

[@ogs102]

😂😂😂😂

[@jellyfish1772]

😂😂😂😂😂😂😂😂

[@shamunkhatri6754]

that guy is ex twitter employee 😅

[@requestfx5585]

"it can break at any time" I think that that time was set when you uploaded this video for thousands of people to see

[@LennyMiller739]

Pfffffft. As if tech giants can afford internet

[@bitw1se]

yeah ngl, that was really stupid.

[@FlorinPop]

I just read it as: "This packages saved my ass"

[@davlatberdinazarov179]

😂😂😂

[@sora-senpai]

Same

[@yassine-sa]

That's actually also correct 😂😂😂

[@dytra_io]

should be the actual title

[@goodsamaritan208]

You read it right.

[@Parajulibkrm]

yes Josh, you don't look like that guy, that guy looks like you instead.

[@Khari99]

Only Sid would post about a security vulnerability that is needed to make his application work lol

[@justanaveragebalkan]

it's a CDN, if you want to put something behind it you can't actually protect it otherwise it wont function, so technically if they want to keep the same functionality for the same cost, the best they can do is to obscure it a bit more, but eventually people would break it. So technically this is not a security vulnerability, but a really cheap way to cut costs, so they might as well just make the posts free to fetch as people would abuse this regardless. Facebook, Instagram and many others have this as well, or least something similar that can be exploited to get the content off their platforms.

[@flybackrs]

This is by no means a security vulnerability, this is the intended function of the API and this API has to be public because of how it's used. To prevent ""abuse"" like this you'd need to monitor who's hitting it and how often.

[@nickolaki]

Speedrun before twitter patch the underlying solution 😂

[@megamind452]

Thanks for reporting this bug, it will be fixed in this current sprint - X engineer after watching this

[@siya.abc123]

How would they fix it without breaking millions of embeddings?

[@cryptomaniac1866]

They just need to change the function that creates the token and make it server side only ​@@siya.abc123

[@michaelmontero2902]

😂😂😂😂

[@petergg9096]

Lmao the current sprint

[@Oussama-uo1gf]

@@siya.abc123 they can just make it so that the function that is used to generate the token based on the tweet id no longer works.

[@yogeshdevaggarwal]

Why is there 45 open job positions at X after this video 💀

[@davisphem]

The creator of react-tweet must be an undercover spy at X 😅

[@karthikeyajidagam8068]

Vercel made it broh 😂

[@Iliannnn]

@@karthikeyajidagam8068 no, vercel is just what they used to host the documentation. they didn't pay for a domains so they got a free vercel one

[@talhaibnemahmud]

I was more amazed that the package is from Vercel 😮

[@algobuddy]

Dude, this is like a game-changer for small developers and startups!

[@rym8349]

it will get patch i will not count on it

[@katto1937]

@@rym8349 Yup especially after a youtube video that so graciously points it out

[@dabbopabblo]

I theorize that how they generate the token probably changes regularly to combat this, but nothing stops you from scraping the code that generates it and extracting the new method on a whim.

[@0xPanda1]

Its interesting but the down side is Twitter may change something in thier thus the code would stop working

[@CorentinNoirot]

Not with the 3 remaining engineers :d

[@romankoncek150]

If the code stops working, all embeds will stop working. They can only fix it for new embeds, so this crappy code is destined to stay in their codebase forever, lol :)

[@0xDEAD_Inside]

​@@romankoncek150 Elon is unhinged enough to do just that!

[@fusseldieb]

@@romankoncek150 Not necessarily. It just doesn't contain any rate limiting ... yet.

[@enclocreations4427]

Bro remove this

[@reold]

For real. We don’t want them to patch the token system

[@katto1937]

Nah he prefers his 100k views which might get him $100 over a package that people might actually need in the future. He's not entitled to care about other people but there was really no need for this video, this package is well known if you need to fetch tweets. Whatever ig

[@sippingthe]

@@katto1937he’s spreading knowledge to other people, gatekeeping is for clowns🤡🤡

[@oniondesu9633]

twitter devs likely already knew about the package, it wasnt super obscure or unknown. they probably will break it, but it wont be because of this video

[@kushpenguin]

@@oniondesu9633 most room temp iq comment of all time. if you think this video won't break the repo then you might have underlying mental disabilities

[@Nin_Cada]

This video was so informative that we got to see his twin brotha.

[@hipdev_]

The creator of react-tweet is my brother, I'm so proud of him 🤗!

[@UmairSadaqat]

❤

[@yassine-sa]

So your brother works at Twitter?

[@hipdev_]

@@yassine-sa Take a closer look 2:40

[@0xDEAD_Inside]

​@@yassine-sa No, at vercel!

[@guibrandalisee]

How did he came up with the formula to generate the token param? Because I was tinkering around and found out that that param does nothing, you just have to put any value into it, as far as it not being blank it will work just fine

[@Lars16]

Thanks for sharing, quick and to the point as always Josh. Awesome package and everything, but who in their right mind would consider shilling out $5000 per month for the Pro tier subscription when you haven't even found product market fit and are at 0 users. I get the point that you need to find a feasible solution to what you are building before starting out, but you could launch your SaaS with the free or basic version and upgrade as you start to monetize your SaaS.

[@maks-yaremenko]

that is so coool) I think spending resources to verify auth for these semi-public routes isn't comparable to possible losses that can produce indy developers, another assumption - developers left back door)) for their 0 users per month saas))

[@cidhighwind8590]

It's great to see you finally getting the recognition you deserved from your amazing performance in Toy Story.

[@zorzysty]

You TOTALLY look like Sid :D

[@weeb3277]

reported for hate speech

[@user-lj4lo7cx7m]

​@@weeb3277 womp womp n...

[@4twi352]

I'm interested how they reverse-engineered the token part, holy

[@RealTkco]

As the video mentions this is for embeding a tweet into a site, copying the code it gives you for multiple tweets and comparing, volia.

[@impyrobot]

probably an ex twitter employee if I had to guess

[@_gekyumeman4127]

I had this same problem earlier last year. So i spent some time reverse engineering the twitter embed API myself and worked like a charm.

[@softmerit25]

Honestly, it's really cool. The simplicity of the react tweet is amazing. A happy ending indeed.

[@edenassos]

It's cheaper to do text tracking on the page with a cloud sandbox and have it screenshot tweets for you.

[@Raul-pg1pf]

Sure bro totally

[@LongBoy.0]

I'm still not clear on what's actually happening. why is a syndicate URL? did they just scrape and reverse engineer the database? or did they just figure out how to reverse engineer real twitter api keys that actually work?

[@BambeH]

Back in my school days, we used to use the Twitter API as an exercise in web fetching. Guess teachers will need to find a new site to do this exercise with.

[@AdityaKumar-op5zc]

You can always use KZbin api it's free

[@BooksWeCanRead]

Yaaayyy ✨ and you are nothing like that sid guy you rock! 💜✨👏👏

[@this_is_samridh]

bro , you should delete this video

[@JakobRossner-qj1wo]

Awesome way of showing it with making the HTTP request yourself

[@scalor]

This video was recommended. 1st time seeing anything from your channel. Let's see how fast this hole gets patched.

[@appelnonsurtaxe]

it can't, that'd break every single tweet embed on every website

[@CAG2]

That function for calculating the token... it seems completely arbitrary, as if they just threw together of the most stuff together in hopes nobody would reverse-engineer it. Kudos to the guy for somehow figuring it out, even if this will probably will be patched very soon.

[@imkir4n]

Don't let Elon see this.

[@FeinsterSchmaus]

Layoffs coming oh boy…

[@weeb3277]

too late i already reported the video stitches for leeches

[@GoonCity777]

@@FeinsterSchmauslaid off if the software enginners don’t do something as directed by manager

[@quamzgraphix9826]

Very cool library, thanks for sharing

[@ShubhamVsCode]

how did they manage to reverse engineer the getToken 🤯🤯

[@esyx6476]

my guess is that there is some (ex)employee from twitter who knows how it works

[@RealTkco]

As the video mentions this is for embeding a tweet into a site, copying the code it gives you for multiple tweets and comparing, volia.

[@semyaza555]

0:44 Sorry Josh but I can't unsee this now...

[@rickdg]

It's a good starting point before actually paying for the API. Perhaps it's still available because you still need the ID of every tweet you want to "embed"?

[@kaustubhxdd]

Elon fanboy rushing to tweet and beg him to patch this : 🏃💨 That one dev at Twitter who'll bring this up next meeting: 🤓📝 Josh: 🙍🏻‍♂

[@elormtsx]

this is gold 😁 thanks for sharing this 😅

[@EnglishRain]

Great video, thanks for sharing!

[@FlorinPop]

"You do not look like that guy" **wink, wink** 😉

[@VincentFulco]

Great vid, thanks!

[@jakehartigandesign]

I’d now like to know how to gather all of my past tweet id’s, then pull the rest of the data as shown. Seems like it’s still limited in that regard.

[@vickonsscope6477]

OH NO Josh!!!😂... You have exposed these innocent dudes..Now Twitter backend engineers would have to find a way to block that access😂😂

[@PartneredAdmin]

Love you bro!

[@poldekwastaken]

0:54 nah bro is sid 100%

[@Nurof3n_]

this video is such Sid energy

[@harshil1735]

There is one more problem with X. The android app does not have sign in with apple and therefore if you are shifting from apple to android then there is no way the user can login. I think X should start hiring more engineers.

[@enijar]

Na that Sid comparison caught me off guard 😂

[@JEM_GG]

I did this exact work around last year for get-ratioed a ratio viewer app xD

[@cnikolov]

whats more interesting is how they parse it back to the original id.

[@eVashioNN]

Unexpected shut down or a change in API can be quite surprising :D

[@RiteshNEVERUNIFORM]

Must been an Laid of employee traking revenge on Elon

[@KellenProctor]

Josh is the alternate universe version of Sid that grew up in a structured household and is going on to have a monster successful career.

[@maxi-g]

the mix of english with the austrian accent is so funny 🇦🇹❤️

[@Sandwich4321]

good to know thst this exists, i usually just use the twitter scraper i wrote in python for this sort of thing

[@thebocksters2756]

guys, this API is not "ilegal" or something that X needs to patch it. Its Vercel package, so it's verified

[@damilolaadeyemi8383]

Elon Musk must not find out, else they stop everything in the sprint and change that token generation method

[@sciencetoday3629]

Elon Musk , let's break it . I want 5 grand

[@sapienwins]

I'll be very surprised if it's not patched within days of this video. Appreciated nonetheless

[@IftekharHossen-rv7ht]

This is the reason why math in important in CS.

[@daphenomenalz4100]

?? Yeah it is, but this is a horrible example, cuz literally reverse engineer the math twitter used 🤣and exploit it

[@bar6732]

Nice! I wanna steal that UI too, care to share the repo?

[@xv179]

next day at Twitter headquarters: "Aight boys, time to change the API key generator"

[@sammed8337]

now they will encrypt the token with the secret key, and you can put your Saas idea in the trash can

[@8colly8]

who else thought the video title was THIS PACKAGE SAVED MY ASS

[@mathesonstep]

This is insanely useful

[@jjamesmartiin]

background giving @thiojoe vibes

[@belkocik]

Who came up with this idea to generate a token like this? Is it production ready?

[@amsraux]

now they will fix it...

[@ChezSwiiz]

This Package Saved My AsS

[@_mosesb]

0:27 Him: There's a library that does this for free to save the day. Me: What there's a library that throws a useless SaaS in the trash FOR FREE, this should be interesting. Also Me there might be no useless SaaS trashing library but this is really really COOL.

[@sabujghosh8474]

Was looking for something like this for so long

[@ellamurii]

thats so funny hhahahaha. i also just tried and it accepts any string as token, no need to use generate function of vercel. i wonder whats really the purpose of token as it really does not seem for validation purpose lmao. so no reverse engineering really occurred lol

[@phoneywheeze]

can you get long form tweets/articles from this?

[@SXsoft99]

"don't ask me what this does" .... modern day developers, copy paste code without understanding what it does

[@yassine-sa]

It's doomed because they'll see this and they'll change the way they generate the token or even better change the whole api

[@pshycocoder]

I read "This package save my sASS"

[@necro3311]

I hope no one base their system on this, as a anecdote its cool, but sooner than later they will patch this the second this come widespread.

[@joshuasingh854]

Man the getToken function is breaking my brain. Does anyone know what's going on there?

[@phoneywheeze]

probably one of the ex twitter employees he fired

[@solomonakinbiyi]

😂 "I do not look anything like that guy"

[@NOELOLBAID]

jajaja dude am understand your happy face when you find the repo :D its the same when I found the Whatsapp Api repo

[@mt000mp]

whatsapp has an API repo?

[@IndigoVFX]

Details please? 🙏🏼

[@II__II]

what's the name of the graphics editor he draws in?

[@sierragutenberg]

look to the left: exaclidraw

[@aps08]

Is there any way to get users latest tweet using username from the syndication APIs ?

[@unicodefox]

i assume the $5000/mo will be cheap to the cost of a lawsuit in the case of you growing big enough for Elon to notice

[@impyrobot]

If you make more than 10k a month you can consider the API until then whatever

[@Channel-cy4lh]

Great video Josh. This is really good to know about. My only concern, as you mentioned, would be the question of how long it will be before this method is broken or blocked by them. I suppose it's just a matter of ensuring this code is isolated enough that you can swap it out within your functionality in the future. And, you know what, you kinda do look like Sid....

[@eineatombombe]

im pretty sure a get request to the tweet url is all that is required. it's like you post the tweet on discord and it embeds data, but you get the data for your service.

[@oaklyfoundation]

Where did u get that UI its sick.

[@TimeAiTales]

DELETE IT BEFORE I COUNT TO THREE.

[@sahebbeshra7659]

Now twitter knows it.

[@sanchaythalnerkar9577]

lmao crazy good ! is there a similar package for first getting the tweets of the user?

[@theSuitCat]

It want last long before Twitter Devs change that token param

[@angelsancheese]

You look exactly like that Toy Story character. You should embrace it

[@samislam2746]

When I first saw the video title I thought it says "This Package Saved My ass" 😂😂😂😂

[@wagyumedia]

api gets protected in 3 2 1…

[@ricko13]

ok but how do you retrieve like new tweets from users? without manually copying-pasting tweet URL ?

[@theawesomegamer123]

Genuinely curious as a newbie, how is this allowed? Wouldn't this be a huge concern for X as a profit loss?

[@Mohith7548]

The issue here is: how do you get the tweet ids?

[@TeodorArg]

Perfecto ! 💥

[@Oussama-uo1gf]

5000$/month for the twitter api is actually crazy

[@AdityaKumar-op5zc]

Simple reason elon doesn't want you to use it

[@whizzie3367]

I was hoping they could have something API that checks If an account follows me... I need it to complete my saas... Do you have any idea on how I can achieve this??

[@Aboods1337]

Hi, I see you have an option to import from discord too, how does that work? Thanks in advance!