Washboard (2013)
11 years ago, I built & released my first public webapp: Washboard, an alternate Tumblr interface with built-in keyword filtering. This was long before the mobile app gained this feature, but also well after browser extensions like Tumblr Savior and XKit proved that the userbase wanted more control over their feeds. With no good option for mobile, I said, hey, let's just build an app on the Tumblr API! How hard could it be?
And, truthfully... it wasn't hard! Turns out it's pretty easy to build a website that serves social media posts when you're not actually storing the posts, or the users' personal data, or almost anything but an OAuth session and some filter rules. Most of the work went into recreating the Dashboard from scratch, using 1,685 lines of plain old JavaScript and a heaped tablespoon of jQuery. That was just how we rolled back then! And while it was absolutely fragile as hell, it was also not too hard to maintain at this scale.
The Tumblr post announcing Washboard got almost 100,000 notes, and over 50,000 people tried it within the first year. Those numbers were absolutely massive for a teenager's first serious webapp! I spent the first few days frantically fixing bugs, then the next few months chasing down Tumblr posts that broke or stretched out the page. I added a few new features over the next two years, including HTTPS, bookmarked tags, and an inbox view. After that point, my work on Washboard was mostly limited to letting users know about Tumblr API outages.
My one friend who worked at Tumblr mentioned that they were aware of Washboard internally, but I never heard how they felt about it. Washboard admittedly kind of danced around the Tumblr API's terms of use, claiming to be a specialized-enough view that it didn't outright replicate substantial portions of the Tumblr interface (......sure). I never heard anything from the staff, so I suppose it wasn't causing too much strife, but I have to wonder how much of Tumblr's total API activity was coming from Washboard at its peak. My VPS network logs suggested it was on the order of GBs/month!
Washboard doesn't get anywhere near that much traffic anymore; while it does still have active users, they're numbered in the ballpark of 10. Meanwhile, tens of thousands of former users' OAuth sessions are collecting dust, just waiting for some key to be leaked. GitHub has been eager to tell me about the ever-mounting critical security vulnerabilities in Washboard's wildly outdated tech stack. Surely by now one of those vulnerabilities is exploitable over the Internet, just by sheer quantity? Not to mention the accumulated jank from a decade of Tumblr iterating on the post editor with nothing to show from Washboard.
By all measures, Washboard's time has come and gone, so I'm shutting it down on at the end of the month. It's something to keep me busy the day cohost shuts down (I have so much more to say about that in my next post). I'm glad I was able to help people curate their online experience for a couple years. Maybe I'll chase after that goal again sometime, particularly in cohost's absence.