50

Twitter Oneboxing in chatrooms appears to be broken at the time of posting. Pasting a Twitter link in chat does not change the chat message to a onebox of the tweet in question.

  • 1
    @VoteDukakis If it was a feature, they'd have removed the swirl you get when posting a tweet as it attempts to onebox the tweet as well. – Nzall May 16 '19 at 13:16
  • 2
    Oops! I jinxed it. :/ – Shadow Wizard Wearing Mask May 16 '19 at 14:21
  • Related: meta.stackexchange.com/questions/308166/… (Judging by the dev response there, I'm afraid this one won't be fixed any time soon either.) – Shadow Wizard Wearing Mask May 16 '19 at 14:22
  • 1
    @ShadowWizard Well, the last comment on that was a year ago by now. Teams seems to have left beta (or at least seems mature enough that they're charging for it) by now. – Nzall May 16 '19 at 21:01
  • 1
    @ShadowWizard well consider this, what use does SE have to onebox Amazon links? not much. what use does SE have to onebox Twitter links? well considering in some rooms there is a feed where we get updates of planned shutdowns from their twitter feed, they have a bit more use for it than amazon – Memor-X May 21 '19 at 2:27
  • @Memor-X nah, not reason enough to bring the bug to the front. Still hundreds of bugs before it, and as always more important things to spend the dev team time on. (Namely Teams, SO for Business etc, the things that bring them the money.) As always, I'm hoping I'm wrong and the bug will be somehow fixed anyway, but judge for yourself... see the tons of bugs reported here, and how many of them are fixed. – Shadow Wizard Wearing Mask May 21 '19 at 6:03
  • 3
    @ShadowWizard Checking the Meta posts marked as bugs, it seems like they tend to get put higher priority through upvotes. This post is 5 days old and already has at least 22 upvotes, and that can rise as more people find the bug and upvote it. – Nzall May 21 '19 at 14:33
  • 4
    About a year in this is still broken, and was working perfectly. – CptEric Nov 15 '19 at 11:10
6

A Stack Exchange employee confirmed in chat that Twitter oneboxing was disabled due to creating a potential security risk:

We had to close some gaps when the hack thing happened last year... and ... if I understand correctly, the Twitter API made use of one of the gaps we closed... so... I think it may be permanent.

It's no coincidence that you saw this break almost right after Stack Exchange servers were compromised in May 2019. The blog post states that a number of other attack vectors were closed as a result:

Our team has taken, and continues to take, a number of steps as part of our response to this incident, including:

[...]

  • Remediating the original issues that allowed the unauthorized access and escalation, as well as any other potential vectors that we have found during the investigation

As per Catija's message above, the part of chat that used the Twitter API to fetch tweets as they were oneboxed was identified as a potential additional security risk, and so it was disabled.

As tweets were loaded from the API when the message was posted and were cached indefinitely afterwards, prior oneboxes continue to display correctly, but newer ones will no longer work.

Additionally, it appears that the following oneboxes were also disabled as a result of the security issues:

  • Blog Overflow
  • GitHub Gist
  • Identi.ca
  • Twitpic

Originally a comment, but upgraded to an answer as it seems final.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .