49

Twitter Oneboxing in chatrooms appears to be broken at the time of posting. Pasting a Twitter link in chat does not change the chat message to a onebox of the tweet in question.

Improve this question
8
  • 1
    @VoteDukakis If it was a feature, they'd have removed the swirl you get when posting a tweet as it attempts to onebox the tweet as well.
    – Nzall
    Commented May 16, 2019 at 13:16
  • 2
    Oops! I jinxed it. :/
    – Shadow Wizard
    Commented May 16, 2019 at 14:21
  • Related: meta.stackexchange.com/questions/308166/… (Judging by the dev response there, I'm afraid this one won't be fixed any time soon either.)
    – Shadow Wizard
    Commented May 16, 2019 at 14:22
  • 1
    @ShadowWizard Well, the last comment on that was a year ago by now. Teams seems to have left beta (or at least seems mature enough that they're charging for it) by now.
    – Nzall
    Commented May 16, 2019 at 21:01
  • 1
    @ShadowWizard well consider this, what use does SE have to onebox Amazon links? not much. what use does SE have to onebox Twitter links? well considering in some rooms there is a feed where we get updates of planned shutdowns from their twitter feed, they have a bit more use for it than amazon
    – Memor-X
    Commented May 21, 2019 at 2:27
  • @Memor-X nah, not reason enough to bring the bug to the front. Still hundreds of bugs before it, and as always more important things to spend the dev team time on. (Namely Teams, SO for Business etc, the things that bring them the money.) As always, I'm hoping I'm wrong and the bug will be somehow fixed anyway, but judge for yourself... see the tons of bugs reported here, and how many of them are fixed.
    – Shadow Wizard
    Commented May 21, 2019 at 6:03
  • 3
    @ShadowWizard Checking the Meta posts marked as bugs, it seems like they tend to get put higher priority through upvotes. This post is 5 days old and already has at least 22 upvotes, and that can rise as more people find the bug and upvote it.
    – Nzall
    Commented May 21, 2019 at 14:33
  • 4
    About a year in this is still broken, and was working perfectly.
    – CptEric
    Commented Nov 15, 2019 at 11:10

1 Answer 1

Reset to default
10

A Stack Exchange employee confirmed in chat that Twitter oneboxing was disabled due to creating a potential security risk:

We had to close some gaps when the hack thing happened last year... and ... if I understand correctly, the Twitter API made use of one of the gaps we closed... so... I think it may be permanent.

It's no coincidence that you saw this break almost right after Stack Exchange servers were compromised in May 2019. The blog post states that a number of other attack vectors were closed as a result:

Our team has taken, and continues to take, a number of steps as part of our response to this incident, including:

[...]

  • Remediating the original issues that allowed the unauthorized access and escalation, as well as any other potential vectors that we have found during the investigation

As per Catija's message above, the part of chat that used the Twitter API to fetch tweets as they were oneboxed was identified as a potential additional security risk, and so it was disabled.

As tweets were loaded from the API when the message was posted and were cached indefinitely afterwards, prior oneboxes continue to display correctly, but newer ones will no longer work.

Additionally, it appears that the following oneboxes were also disabled as a result of the security issues:

  • Blog Overflow
  • GitHub Gist
  • Identi.ca
  • Twitpic

Originally a comment, but upgraded to an answer as it seems final is final.

Update: A developer has given more insight as to the security reasons why this was disabled. Basically, the source code for chat was leaked, and it contained the API key to access Twitter in plain text. While the key was deactivated and recycled, there was no way to re-integrate the new key into the code in a secure, non-decipherable manner in case of a future leak, so it was left out.

Improve this answer
1
  • Was the source code leaked, or just stolen? Leaked would imply that it is now public.
    – forest distrusts StackExchange
    Commented Apr 7, 2022 at 21:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .