TweetDeck's recent XSS vulnerability highlights one of the downsides to using web technologies to build a desktop app.

Of course, no app is immune to vulnerabilities, and using desktop application platforms certainly doesn't prevent all vulnerabilities. But TweetDeck's vulnerability exists in part because the content it displays is delivered in the same form as its user interface.

A desktop application that failed to properly control web content that it was displaying would still expose the web container in which the content was running, but that wouldn't make it vulnerable to manipulating the application controls. A badly secured web view to display a tweet within in a native application with native controls for displaying tweets would still make it hard to, say, trigger the application to retweet the content automatically.

Twitter for Mac was released alongside the Mac App Store, and quickly replaced its predecessor, Tweetie, as my client of choice. I preferred it in most respects save for a single, nearly-fatal, flaw: Twitter for Mac didn’t work well with OS X Spaces.

If you use Spaces under OSX, and you launch an App, you’ll usually see that that app appears in the space in which you launched it, and isn’t visible in any other space. The spaces preferences pane allows you some control over that, but for the most part the default works just fine. When you launch Twitter for Mac, it also appears in the space in which you launched it. If you open the spaces view, you’ll see that it isn’t visible in the other spaces, but if you switch to the other spaces, Twitter for Mac follows you wherever you go. After trying a few things and reading suggestions from others, I discovered that if I bound Twitter to a particular space in the preferences dialogue, it would stay there until I closed Twitter. If I were to open Twitter again, I’d have to repeat the binding after removing the old one in order to get the same effect. Irritating, but with a workaround, I could live with it.

Giving Up

As days turned to weeks and weeks turned into months, I came to accept that Twitter wasn’t going to fix this, at least not in a timely fashion, and poking around in the Spaces preferences every time I launched Twitter was starting to grate on me. This seemed like something I should be able to automate.

I’d never played with AppleScript, and every time I’ve considered it, I’ve always been a little thrown by the verbose natural-language-like style. I briefly tried a recording in Automator, but the result didn’t quite work. I came to accept that I was going to have to delve into AppleScript if I were going to solve this problem.

AppleScript and rb-appscript

I started to learn a little bit of AppleScript, figured out how to open the Spaces preference pane, and started reading more advanced AppleScript code that manipulated spaces bindings. As I was researching and learning, I thought about how much nicer this would be with Ruby or MacRuby. After doing a quick search, I came across an article about rb-appscript, which allows you to do automation using Apple Events from Ruby.

I started reading the documentation on the rb-appscript site, and Matt Neuberg’s unpublished book Scripting Mac Applications With Ruby: An AppleScript Alternative, and between some experiments in irb and the reading, I was able to find a way to unbind and bind Twitter to a particular space in the Spaces preferences. It wasn’t hard to go from there to a first, second and third draft of some Ruby code to get the job done. As I was refining the solution, I started to share it, first on Forrst, then on GitHub’s Gist.

The final version looks like this:


With this script, you can launch twitter, then quickly run the script to fix Twitter’s spaces binding. Alternately, you could enhance it very slightly to both launch and rebind Twitter, so that you can accomplish both with a single step:



But none of that is necessary, because…

Foiled Again

Shortly after I started sharing it, @JCB_K pointed out that just before I gave up on Twitter ever fixing this bug, they had finally fixed it. That means that everything I’ve done since then was educational but unnecessary.

So, while this is finally done, and you’re welcome to use it, it seems that your best bet is simply to fire up the App Store and take the latest update.

Business Insider's An Interview with Twitter's Forgotten Founder, Noah Glass is a great view into the complexities of starting a company and maintaining relationships. Mostly, that it gets messy and that some people are going to get hurt.