Twitter Tweet Button URL randomly resolves to a .torrent file

[blahpro]

My guess: many CDNs allow you to exclude the querystring from the cache key, so it's possible that one person requested the URL with ?torrent in the querystring (which causes S3 to serve a .torrent response) and that the request hit a cold cache. The response with type application/x-bittorrent was then cached under the querystring-less cache key, causing it to be served to anyone else hitting that edge node with the path /widgets/tweet_button.html.

Again: this is just my guess.

[gazarsgo]

I thought Twitter was all private DC, did platform previously point to S3?

[StavrosK]

This is my exact guess as well. I would be surprised if it turned out to be something else.

[psz]

platform.twitter.com is hosted at Amazon S3 (via an additional CDN).

All S3 files by default can be distributed with torrent, if the URL is appended with ?torrent

S3 servers will act as a tracker and seeds.

[gingerjoos]

Relevent FAQ from Amazon S3 FAQ page : http://aws.amazon.com/s3/faqs/#What_is_the_BitTorrent_TM_pro...

[vdaniuk]

That is a cool feature, actually.

[Amadou]

This is what TorrentFreak had to say about it:

http://torrentfreak.com/twitter-bug-requires-users-to-torren...

TL;DR is Twitter uses bittorrent internally, this is probably just an error in letting an internal configuration leak to the outside world.

[jgv]

Just got this visiting this article page on TechCrunch => http://techcrunch.com/2013/09/23/facetime-audio-is-apples-bi...

Chrome automatically downloaded it => http://cl.ly/image/2u3R2m3j3j1E

[mathattack]

Same. Chrome automatically downloaded it for me too. Twice.

[sdfjkl]

Now you just need browser support for downloading HTTP bodies via BitTorrent. Not actually a bad idea for sufficiently large ones :)

[toretore]

So that's what that was. Happened to me yesterday.

[dud3z]

You can reproduce it by pretending that the IP is "68.232.35.139" by modifying your own /etc/hosts file, not funny indeed.

[gregclermont]

This visualization of the domain name resolution for platform.twitter.com might help to understand the issue. I don't know how to interpret it however. http://dnsviz.net/d/platform.twitter.com/dnssec/

[laveur]

I had this happen when I loaded an article from TechCrunch just a couple of minutes ago. USA here.

[bagosm]

Reproduced a couple minutes ago in Greece. Oh the bug? I didn't check it out yet.

[harvestmoon]

I also have this bug on BusinessInsider and other sites. Does not look good. Surprised there isn't more coverage of this.

[gregparadee]

Just happened to me on Businessinsider.

[samspenc]

Happened to me on a tech news website earlier today (forget which one exactly)

[MichaelAza]

This seems like a major security issue, since some browsers (Chrome, at the very least, and probably others) can be set to automatically open a torrent client when links to .torrent files are clicked.

Is it possible someone hijacked this IP?

Edit:

1. Seems the IP belongs to a CDN (edgecast).

[simias]

In what scenario is opening a torrent client a major security issue?

[Uchikoma]

Happens to me today on Spiegel.de - one of the largest German sites (news site)

[thehodge]

Don't twitter use torrents to deploy across multiple servers?

[glennos]

They do (or at least used to). This came to mind for me too.

The platform they developed is called Murder: https://blog.twitter.com/2010/murder-fast-datacenter-code-de...

[agumonkey]

people are digging for http responses https://gist.github.com/gregclermont/6669056

[th0br0]

Can not reproduce from Germany (manually added the hosts entry)

[luastoned]

It works without the host file hack (from Germany).

Edit: I just browsed TC and I am getting the torrent download there too..

[dud3z]

That's odd, it's the only way for me to reproduce it..

[Uchikoma]

Happens to me on Spiegel.de

[ahamdy]

reproduced in Egypt, this thing is all over the place

[program]

Reproduced from Italy just a couple of minutes ago.

[saze]

reproduced from France a couple times yesterday