Twitter Bug Lets Users Force Others To Follow Them

Several readers have sent word of a Twitter bug which has been allowing users to make any other user follow them by simply tweeting "accept [username]." People have been abusing it to make the accounts of various celebrities and publications follow them. Twitter acknowledged the bug and disabled the follow/unfollow system until they can get it fixed.

Comments

That sounds more like a

[abbynormal brain]

test command embedded into the code that allows "dummy" testing within the development environment. Either way - oops.

Re:That sounds more like a

[squiggleslash]

I'm going to stick my neck out and suggest it's more a case of someone deciding not to check for errors in a bit of code.

In Twitter, you can have either protected tweets or unprotected tweets. If the former, then if someone wants to follow you, they have to request it, and you can either "accept" them following or deny it.

It looks to me that the commands are sent in-band, and that the command "accept " is related to the above code. What isn't happening is any check that the person identified ever actually sent a request in the first place.

So, this isn't an evil conspiracy to send people advertising (was BAG being serious?), and I doubt it's test code either. The above just "fits" with everything we know about twitter.

Re:Probably not a bug

[Yvan256]

So what should you do? Stop using Twitter?

Yes.

and i thought people just hated me

[alen]

looked up my twitter and i have 0 followers now

In-Band Signalling

[captaindomon]

This is one of the difficulties of In-Band Signaling. Their communication channel is so limited that handling secure signaling is difficult.

Re:In-Band Signalling

[Amouth]

not exactly.. their failure was not implementing some type of request/accept queue system.. and if they did they bypassed it and gave the accept message the ability to add people even if they where not in the queue, which is just stupid.

while i agree that In-Band Signaling is not easy to do right, and that they do have a limited communication channel.. they do not have a limited processing or back-end infrastructure..

there is no excuse for this type of screwup..

Re:Probably not a bug

[fotbr]

A strange game. The only winning move is not to play.

Conan saw it coming

[Anonymous Coward]

http://twitter.com/ConanOBrien/status/13631062967

Re:Probably not a bug

[Dalambertian]

The suggestion that we should stop using twitter because of spam is quite strange. Has spam stopped you from using email?

Re:Blue Box

[cgenman]

The main difference being that back in the blue boxing days, security was an afterthought and now it's a multi-billion dollar industry.

It's a multi-billion dollar industry... that gets called in after-the-fact once a tool gets really popular.

Re:Probably not a bug

[Jer]

Whether or not this would be useful for spam, it would be more profitable for Twitter to be able to control it, rather than letting individuals force other people to follow them. This is clearly a bug - there's no financial benefit to Twitter with this and if it went on for too long they'd lose users (which is probably why they shut off the follower mechanism as soon as the bug was publicized).

Not to say Twitter couldn't introduce their own advertising scheme. Just that if they did they'd want it to be one they controlled - and took payments for - not one that random spammers could exploit for free.

Re:Probably not a bug

[Anonymous Coward]

That would imply starting to use Twitter.

Re:Probably not a bug

[Anonymous Coward]

yes