Yahoo Axis

» see axis.yahoo.com as it lived, on the wayback machine

~ the obituary ~

axis was yahoo trying to be a browser product instead of a portal product. on may 23 2012 yahoo shipped axis as an extension for chrome, firefox, internet explorer 9, safari 5, plus standalone apps for iphone and ipad. the central idea was that a search result should be a row of page thumbnails rather than a list of blue links. you hovered, you saw a small preview, you tapped, you opened the page directly without ever leaving the current tab. on paper this was a sensible reaction to mobile-era browsing patterns.

on the first morning of public availability somebody pulled the chrome extension apart and found yahoo's private signing key bundled inside the package. that key was the one yahoo used to sign every chrome extension it published, so any attacker who downloaded axis could now sign a different extension that would appear to chrome as a legitimate yahoo property. the story broke on the same techcrunch and the verge pages that had run the launch announcement six hours earlier.

i did not install axis. by 2012 i was twenty-eight in ankara on a chrome stable build for actual work, with firefox kept around for sites that misbehaved. axis was an american property aimed at the iphone-and-mac segment that yahoo still hoped would come back to a yahoo property if the surface looked friendly enough. the segment did not come back. by june 28 2013 yahoo posted the shutdown notice on the same blog where the launch had been announced. the extensions stopped working on the date. the ios apps were left to drift without updates.

~ the case file ~

~ the key leak ~

the day-one breach was not a backend hack. the breach was a packaging mistake. yahoo had bundled the same source tree it used internally for signing chrome extensions, and somebody forgot to strip the private key file before shipping the public installer. the file sat inside the.crx package that millions of chrome users had pulled down by lunchtime on may 23. yahoo issued a new key, revoked the leaked one, and shipped a quick patch the next morning. but the embarrassment was the story for the next three weeks of trade-press coverage.

the underlying product was not bad. the thumbnail preview strip was a sensible mobile metaphor that several competitors later borrowed without crediting axis. the launch-day breach poisoned the product before any of that got a fair test. anyone who covered axis after may 24 covered the key leak first and the product idea second.

~ how it ended ~

marissa mayer's product cleanup wave through 2013 took out yahoo blueprint, yahoo updates, yahoo upcoming and the standalone yahoo messenger for windows, alongside axis. the wave was meant to refocus yahoo on a handful of core mobile properties. axis was the smallest and least defensible of the cuts, since the browser-extension category had moved entirely toward chrome's own first-party experience by mid 2013.

yahoo announced the june 28 2013 shutdown in a tossed-off blog post titled "keeping our focus on what's next". the extensions stopped working immediately. the ios app was left in the store but never received another release. axis.yahoo.com began redirecting to the main yahoo homepage. the key-leak story remained the only thing anyone could remember about axis fifteen years later, which was the kind of legacy yahoo was used to leaving by the marissa mayer era.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »