This Package Saved My SaaS

[@jugalgadhavi]

That one jira ticket will speed run itself from backlog to in-progress

[@jasondads9509]

Dont let musk see it Xd

[@WebDevCody]

The Twitter backend engineers while implementing that token param: “nobody’s gonna know. How would they know?”

[@OMODINGDANIEL-v9s]

So crazy🤣🤣🤣🤣

[@yassine-sa]

Also Twitter engineers: there is only one way for that to happen, someone with us made the library 😏

[@ogs102]

😂😂😂😂

[@jellyfish1772]

😂😂😂😂😂😂😂😂

[@shamunkhatri6754]

that guy is ex twitter employee 😅

[@requestfx5585]

"it can break at any time" I think that that time was set when you uploaded this video for thousands of people to see

[@LennyMiller739]

Pfffffft. As if tech giants can afford internet

[@bitw1se]

yeah ngl, that was really stupid.

[@FlorinPop]

I just read it as: "This packages saved my ass"

[@davlatberdinazarov179]

😂😂😂

[@sora-senpai]

Same

[@yassine-sa]

That's actually also correct 😂😂😂

[@dytra_io]

should be the actual title

[@goodsamaritan208]

You read it right.

[@Parajulibkrm]

yes Josh, you don't look like that guy, that guy looks like you instead.

[@Khari99]

Only Sid would post about a security vulnerability that is needed to make his application work lol

[@justanaveragebalkan]

it's a CDN, if you want to put something behind it you can't actually protect it otherwise it wont function, so technically if they want to keep the same functionality for the same cost, the best they can do is to obscure it a bit more, but eventually people would break it. So technically this is not a security vulnerability, but a really cheap way to cut costs, so they might as well just make the posts free to fetch as people would abuse this regardless. Facebook, Instagram and many others have this as well, or least something similar that can be exploited to get the content off their platforms.

[@flybackrs]

This is by no means a security vulnerability, this is the intended function of the API and this API has to be public because of how it's used. To prevent ""abuse"" like this you'd need to monitor who's hitting it and how often.

[@megamind452]

Thanks for reporting this bug, it will be fixed in this current sprint - X engineer after watching this

[@siya.abc123]

How would they fix it without breaking millions of embeddings?

[@cryptomaniac1866]

They just need to change the function that creates the token and make it server side only ​@@siya.abc123

[@michaelmontero2902]

😂😂😂😂

[@petergg9096]

Lmao the current sprint

[@Oussama-uo1gf]

@@siya.abc123 they can just make it so that the function that is used to generate the token based on the tweet id no longer works.

[@nickolaki]

Speedrun before twitter patch the underlying solution 😂

[@davisphem]

The creator of react-tweet must be an undercover spy at X 😅

[@karthikeyajidagam8068]

Vercel made it broh 😂

[@Iliannnn]

@@karthikeyajidagam8068 no, vercel is just what they used to host the documentation. they didn't pay for a domains so they got a free vercel one

[@algobuddy]

Dude, this is like a game-changer for small developers and startups!

[@rym8349]

it will get patch i will not count on it

[@katto1937]

@@rym8349 Yup especially after a youtube video that so graciously points it out

[@yogeshdevaggarwal]

Why is there 45 open job positions at X after this video 💀

[@talhaibnemahmud]

I was more amazed that the package is from Vercel 😮

[@dabbopabblo]

I theorize that how they generate the token probably changes regularly to combat this, but nothing stops you from scraping the code that generates it and extracting the new method on a whim.

[@0xPanda1]

Its interesting but the down side is Twitter may change something in thier thus the code would stop working

[@CorentinNoirot]

Not with the 3 remaining engineers :d

[@romankoncek150]

If the code stops working, all embeds will stop working. They can only fix it for new embeds, so this crappy code is destined to stay in their codebase forever, lol :)

[@0xDEAD_Inside]

​@@romankoncek150 Elon is unhinged enough to do just that!

[@fusseldieb]

@@romankoncek150 Not necessarily. It just doesn't contain any rate limiting ... yet.

[@Nin_Cada]

This video was so informative that we got to see his twin brotha.

[@maks-yaremenko]

that is so coool) I think spending resources to verify auth for these semi-public routes isn't comparable to possible losses that can produce indy developers, another assumption - developers left back door)) for their 0 users per month saas))

[@enclocreations4427]

Bro remove this

[@reold]

For real. We don’t want them to patch the token system

[@katto1937]

Nah he prefers his 100k views which might get him $100 over a package that people might actually need in the future. He's not entitled to care about other people but there was really no need for this video, this package is well known if you need to fetch tweets. Whatever ig

[@sippingthe]

@@katto1937he’s spreading knowledge to other people, gatekeeping is for clowns🤡🤡

[@oniondesu9633]

twitter devs likely already knew about the package, it wasnt super obscure or unknown. they probably will break it, but it wont be because of this video

[@kushpenguin]

@@oniondesu9633 most room temp iq comment of all time. if you think this video won't break the repo then you might have underlying mental disabilities

[@BambeH]

Back in my school days, we used to use the Twitter API as an exercise in web fetching. Guess teachers will need to find a new site to do this exercise with.

[@AdityaKumar-op5zc]

You can always use KZbin api it's free

[@hipdev_]

The creator of react-tweet is my brother, I'm so proud of him 🤗!

[@UmairSadaqat]

❤

[@yassine-sa]

So your brother works at Twitter?

[@hipdev_]

@@yassine-sa Take a closer look 2:40

[@0xDEAD_Inside]

​@@yassine-sa No, at vercel!

[@guibrandalisee]

How did he came up with the formula to generate the token param? Because I was tinkering around and found out that that param does nothing, you just have to put any value into it, as far as it not being blank it will work just fine

[@softmerit25]

Honestly, it's really cool. The simplicity of the react tweet is amazing. A happy ending indeed.

[@Lars16]

Thanks for sharing, quick and to the point as always Josh. Awesome package and everything, but who in their right mind would consider shilling out $5000 per month for the Pro tier subscription when you haven't even found product market fit and are at 0 users. I get the point that you need to find a feasible solution to what you are building before starting out, but you could launch your SaaS with the free or basic version and upgrade as you start to monetize your SaaS.

[@wontonjigsaw]

I had this same problem earlier last year. So i spent some time reverse engineering the twitter embed API myself and worked like a charm.

[@cidhighwind8590]

It's great to see you finally getting the recognition you deserved from your amazing performance in Toy Story.

[@LongBoy.0]

I'm still not clear on what's actually happening. why is a syndicate URL? did they just scrape and reverse engineer the database? or did they just figure out how to reverse engineer real twitter api keys that actually work?

[@edenassos]

It's cheaper to do text tracking on the page with a cloud sandbox and have it screenshot tweets for you.

[@Raul-pg1pf]

Sure bro totally

[@this_is_samridh]

bro , you should delete this video

[@zorzysty]

You TOTALLY look like Sid :D

[@weeb3277]

reported for hate speech

[@user-lj4lo7cx7m]

​@@weeb3277 womp womp n...

[@jake-hartigan]

I’d now like to know how to gather all of my past tweet id’s, then pull the rest of the data as shown. Seems like it’s still limited in that regard.

[@JakobRossner-qj1wo]

Awesome way of showing it with making the HTTP request yourself

[@4twi352]

I'm interested how they reverse-engineered the token part, holy

[@RealTkco]

As the video mentions this is for embeding a tweet into a site, copying the code it gives you for multiple tweets and comparing, volia.

[@impyrobot]

probably an ex twitter employee if I had to guess

[@CAG2]

That function for calculating the token... it seems completely arbitrary, as if they just threw together of the most stuff together in hopes nobody would reverse-engineer it. Kudos to the guy for somehow figuring it out, even if this will probably will be patched very soon.

[@xv179]

next day at Twitter headquarters: "Aight boys, time to change the API key generator"

[@semyaza555]

0:44 Sorry Josh but I can't unsee this now...

[@scalor]

This video was recommended. 1st time seeing anything from your channel. Let's see how fast this hole gets patched.

[@appelnonsurtaxe]

it can't, that'd break every single tweet embed on every website

[@KellenProctor]

Josh is the alternate universe version of Sid that grew up in a structured household and is going on to have a monster successful career.

[@quamzgraphix9826]

Very cool library, thanks for sharing

[@rickdg]

It's a good starting point before actually paying for the API. Perhaps it's still available because you still need the ID of every tweet you want to "embed"?

[@sammed8337]

now they will encrypt the token with the secret key, and you can put your Saas idea in the trash can

[@eVashioNN]

Unexpected shut down or a change in API can be quite surprising :D

[@FlorinPop]

"You do not look like that guy" **wink, wink** 😉

[@harshil1735]

There is one more problem with X. The android app does not have sign in with apple and therefore if you are shifting from apple to android then there is no way the user can login. I think X should start hiring more engineers.

[@cnikolov]

whats more interesting is how they parse it back to the original id.

[@JEM_GG]

I did this exact work around last year for get-ratioed a ratio viewer app xD

[@BooksWeCanRead]

Yaaayyy ✨ and you are nothing like that sid guy you rock! 💜✨👏👏

[@poldekwastaken]

0:54 nah bro is sid 100%

[@Sandwich4321]

good to know thst this exists, i usually just use the twitter scraper i wrote in python for this sort of thing

[@belkocik]

Who came up with this idea to generate a token like this? Is it production ready?

[@IftekharHossen-rv7ht]

This is the reason why math in important in CS.

[@daphenomenalz4100]

?? Yeah it is, but this is a horrible example, cuz literally reverse engineer the math twitter used 🤣and exploit it

[@nerfRitesh]

Must been an Laid of employee traking revenge on Elon

[@8colly8]

who else thought the video title was THIS PACKAGE SAVED MY ASS

[@elormtsx]

this is gold 😁 thanks for sharing this 😅

[@thebocksters2756]

guys, this API is not "ilegal" or something that X needs to patch it. Its Vercel package, so it's verified

[@jjamesmartiin]

background giving @thiojoe vibes

[@PartneredBrandsUnlimited]

Love you bro!

[@EnglishRain]

Great video, thanks for sharing!

[@samislam2746]

When I first saw the video title I thought it says "This Package Saved My ass" 😂😂😂😂

[@damilolaadeyemi8383]

Elon Musk must not find out, else they stop everything in the sprint and change that token generation method

[@pshycocoder]

I read "This package save my sASS"

[@VincentFulco]

Great vid, thanks!

[@enijar]

Na that Sid comparison caught me off guard 😂

[@kaustubhxdd]

Elon fanboy rushing to tweet and beg him to patch this : 🏃💨 That one dev at Twitter who'll bring this up next meeting: 🤓📝 Josh: 🙍🏻‍♂

[@_mosesb]

0:27 Him: There's a library that does this for free to save the day. Me: What there's a library that throws a useless SaaS in the trash FOR FREE, this should be interesting. Also Me there might be no useless SaaS trashing library but this is really really COOL.

[@Nurof3n_]

this video is such Sid energy

[@ellamurii]

thats so funny hhahahaha. i also just tried and it accepts any string as token, no need to use generate function of vercel. i wonder whats really the purpose of token as it really does not seem for validation purpose lmao. so no reverse engineering really occurred lol

[@phoneywheeze]

can you get long form tweets/articles from this?

[@imkir4n]

Don't let Elon see this.

[@FeinsterSchmaus]

Layoffs coming oh boy…

[@weeb3277]

too late i already reported the video stitches for leeches

[@GoonCity777]

@@FeinsterSchmauslaid off if the software enginners don’t do something as directed by manager

[@solomonakinbiyi]

😂 "I do not look anything like that guy"

[@joshuasingh854]

Man the getToken function is breaking my brain. Does anyone know what's going on there?

[@phoneywheeze]

probably one of the ex twitter employees he fired

[@bar6732]

Nice! I wanna steal that UI too, care to share the repo?

[@eineatombombe]

im pretty sure a get request to the tweet url is all that is required. it's like you post the tweet on discord and it embeds data, but you get the data for your service.

[@ShubhamVsCode]

how did they manage to reverse engineer the getToken 🤯🤯

[@esyx6476]

my guess is that there is some (ex)employee from twitter who knows how it works

[@RealTkco]

As the video mentions this is for embeding a tweet into a site, copying the code it gives you for multiple tweets and comparing, volia.

[@sahebbeshra7659]

Now twitter knows it.

[@sciencetoday3629]

Elon Musk , let's break it . I want 5 grand

[@sapienwins]

I'll be very surprised if it's not patched within days of this video. Appreciated nonetheless

[@ChezSwiiz]

This Package Saved My AsS

[@necro3311]

I hope no one base their system on this, as a anecdote its cool, but sooner than later they will patch this the second this come widespread.

[@theawesomegamer123]

Genuinely curious as a newbie, how is this allowed? Wouldn't this be a huge concern for X as a profit loss?

[@SXsoft99]

"don't ask me what this does" .... modern day developers, copy paste code without understanding what it does

[@RJRobinsonX]

How long now before this package no longer works because of this.

[@maxi-g]

the mix of english with the austrian accent is so funny 🇦🇹❤️

[@aps08]

Is there any way to get users latest tweet using username from the syndication APIs ?

[@Oryssounet]

Who would use a SaaS to avoid taking a few seconds to copy/paste a testimonial from Twitter?

[@yassine-sa]

It's doomed because they'll see this and they'll change the way they generate the token or even better change the whole api

[@vickonsscope6477]

OH NO Josh!!!😂... You have exposed these innocent dudes..Now Twitter backend engineers would have to find a way to block that access😂😂

[@u1f98a]

i assume the $5000/mo will be cheap to the cost of a lawsuit in the case of you growing big enough for Elon to notice

[@impyrobot]

If you make more than 10k a month you can consider the API until then whatever

[@deepshaswat]

I am also building something which requires to do the user lookup, please let me know if you find anything similar

[@Mohith7548]

The issue here is: how do you get the tweet ids?

[@enra8557]

Yep I already use it around 3 weeks rn. Guess what? This package comes from vercel. And one of the contributors is lee rob himself

[@amsraux]

now they will fix it...

[@theSuitCat]

It want last long before Twitter Devs change that token param

[@sabujghosh8474]

Was looking for something like this for so long

[@angelsancheese]

You look exactly like that Toy Story character. You should embrace it

[@II__II]

what's the name of the graphics editor he draws in?

[@sierragutenberg]

look to the left: exaclidraw

[@mathesonstep]

This is insanely useful

[@uneebbhatti123]

Bro why do I need to store a tweet in database, what is the main purpose of your SAAS?

[@iresharma]

I might be wrong but you shouldn't have share this, very soon someone from twitter see's this and patches it

[@highpofly]

inb4 this package stops working

[@BarakaAndrew]

They can turn this off in one day, enjoy it while still available. They'd probably make way more money if the $100 API was decent

[@Channel-cy4lh]

Great video Josh. This is really good to know about. My only concern, as you mentioned, would be the question of how long it will be before this method is broken or blocked by them. I suppose it's just a matter of ensuring this code is isolated enough that you can swap it out within your functionality in the future. And, you know what, you kinda do look like Sid....

[@NOELOLBAID]

jajaja dude am understand your happy face when you find the repo :D its the same when I found the Whatsapp Api repo

[@mt000mp]

whatsapp has an API repo?

[@IndigoVFX]

Details please? 🙏🏼

[@JemEklery]

Meh, I tried it. It works when you pass any token, even `foobar`. So this math is just for show