Read on Twitter
full disclosure: scraping fleets from public accounts without triggering the read notification
the endpoint is: https://api.twitter.com/fleets/v1/user_fleets?user_id=
the endpoint is: https://api.twitter.com/fleets/v1/user_fleets?user_id=
for auth you just use the same leaked consumer keys from official twitter app that lets you use firehose for free: https://gist.github.com/shobotch/5160017
ddg https://api.twitter.com/auth/1/xauth_password.json for how to get a token
ddg https://api.twitter.com/auth/1/xauth_password.json for how to get a token
doing this or viewing the actual fleet via "media_url_https" does not trigger the read notification.
there is a separate endpoint "/fleets/v1/mark_read" for marking things as read, but it appears to be optional :^)
there is a separate endpoint "/fleets/v1/mark_read" for marking things as read, but it appears to be optional :^)
(instagram does this in a smart way and will only let you prefetch two images without marking one as read before locking you out)
to anyone still confused by what a "fleet" is and what the implications of this are.
they're supposed to self-destruct after 24h. this lets you archive them without the other person even knowing you've viewed it.
they're supposed to self-destruct after 24h. this lets you archive them without the other person even knowing you've viewed it.
actually you don't even need to be logged in
i have also just confirmed that the media URLs don't expire after 24h, so you can view fleets after they're deleted
Source code for my WIP scraper: https://www.hastebin.net/yjyhecoceg.rs
I took down the public instance since you need to be logged in to fetch a list of fleets for a user now. It still doesn't mark them as read.
I took down the public instance since you need to be logged in to fetch a list of fleets for a user now. It still doesn't mark them as read.
I'm not going to continue working on it, I've proven my point already.
Don't market your new feature on a higher expectation of privacy, if you can't deliver it.
Don't market your new feature on a higher expectation of privacy, if you can't deliver it.
All logs/data collected deleted.
