Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A URL shortener not shortening the URL but makes it look very dodgy

github.com

Post reply on HN
Print view View original

91–100 of 104 posts

Re: A URL shortener not shortening the URL but makes it look very dodgy

#91

Post by Alupis »

moffkalast wrote: post #50
sshine wrote: post #8

Earlier quoted context omitted.

Forgive my old-fashioned-ness, but... Why is metered cloud hosting a better choice here than a $5/mo. VPS?

> $5/mo. VPS I think you may even get 256 megs of ram for that these days.

For $2.50 you can get 1 vCPU, 512MB RAM, 500GB bandwidth, and 10GB storage from Vultr[1]. The only catch is it's IPv6 only, you have to add an extra dollar monthly to get an IPv4 address ($3.50).

For $5.00, you get 1GB of RAM, 1TB of bandwidth, 25GB of storage, and an IPv4 address. Not bad...

[1] https://www.vultr.com/pricing/

Re: A URL shortener not shortening the URL but makes it look very dodgy

#92

Post by kinduff »

punkspider wrote: post #21

I also recommend the developer's blog. Very detailed and hilarious articles https://mango.pdf.zone/ I laughed myself to tears reading Operation Luigi: How I hacked my friend without her noticing[1] 1: https://mango.pdf.zone/operation-luigi-how-i-hacked-my-friend-without-her-noticing

Such a good blog post, had a blast reading it. Thanks for sharing this!

Re: A URL shortener not shortening the URL but makes it look very dodgy

#93

Post by blagie »

jeroenhd wrote: post #36
blagie wrote: post #17

Earlier quoted context omitted.

Personally, for long-running things, metered cloud has two upsides: - IaaS, static hosting, etc. can maintain security updates on their end. My own VPS will eventually be broken into if I don't maintain security updates. - Many things are accessed only intermittently. For low access patterns, it's cheaper to pay for what you use. What I'd really like is something like Heroku, Amazon Lambda, or similar, but with an op…

I don't use these services because I've seen the prices Amazon asks for a gigabyte of traffic but I think you'll have to have VERY intermittent access to make these scaling providers worth the money. If you expect your website to one day go from 100 requests a month to a million a day and expect that traffic to continue from that point on, these services will be a huge benefit for uptime while you rework your code to…

"Very intermittent access" is the use-case for most things I build. There's a short tail -- I've built a platform you've heard of and, given this is HN, more likely than not, used. Then there's a long tail:

- Home automation

- Municipal / school / community sites

- Personal web page

- Various internal automation within my organization

... and so on.

These are things which:

1. Require very simple technology (E.g. storing data in a small key-value store is more than good enough)

2. Should work for the next decade or three with no maintenance

3. Expect to be accessed maybe a couple of times a day, if I'm lucky, and probably much less

4. Most will never scale to gigabytes of data, ever

Re: A URL shortener not shortening the URL but makes it look very dodgy

#95

Post by 411111111111111 »

patentatt wrote: post #80
411111111111111 wrote: post #56

Earlier quoted context omitted.

That's inherent to features that allow user generated content, which is obviously mandatory in the context of PayPals invoicing feature. The only reason why companies don't care about it in the context of mail is because there is no equivalent to safe browsing for mails, so Domains aren't penalized by Google for sending fraudulent messages at small scale. If this was to change, they'd all pivot to using secondary dom…

How about disallowing urls or even just vetting urls in the messages sent from your own service? One of the ones I received was a link to a fake PayPal login that was something along the of lines of (making this up) http://login.PayPal.com.somethingsketchy.biz/login.php and was a replica of the PayPal login screen. It was pretty blatant. Seems like they should figure out a way to avoid that is all, because I know my…

Vetting is impossible, the scammers can just change the content of the page after the PayPal bot requested the website. Human vetting is even more impossible, invoices will always require unique links for each mail.

Nor does it matter wherever it's a clickable link or text in this context. The only way to "solve" your issue is by removing user generated content, which makes the invoicing feature inherently impossible.

If you're seriously shocked that PayPal isn't decommissioning a highly profitable feature because a random carebear worries about their family... Then you're honestly out of touch with reality.

Most people nowadays know that emails are untrustworthy, and if your family doesn't... Then you should tell them that, as they're bound to get scammed eventually if they click on any links from their inbox.

Re: A URL shortener not shortening the URL but makes it look very dodgy

#96

Post by sshine »

blagie wrote: post #17
sshine wrote: post #8

Earlier quoted context omitted.

Forgive my old-fashioned-ness, but... Why is metered cloud hosting a better choice here than a $5/mo. VPS?

Personally, for long-running things, metered cloud has two upsides: - IaaS, static hosting, etc. can maintain security updates on their end. My own VPS will eventually be broken into if I don't maintain security updates. - Many things are accessed only intermittently. For low access patterns, it's cheaper to pay for what you use. What I'd really like is something like Heroku, Amazon Lambda, or similar, but with an op…

> My own VPS will eventually be broken into if I don't maintain security updates

I believe that with the right choices in life, this risk can be minimized.

E.g. tighten your sshd_config and/or lock it behind a VPN, don't expose app servers directly, don't expose insecurely written software.

> For low access patterns, it's cheaper to pay for what you use.

Low-access patterns don't increase the number of $5/mo. VPS'es I run.

> something like Heroku, Amazon Lambda, or similar, but with an open, competitive ecosystem, and without vendor lock-in.

I sense that the economic incentives lean towards vendor lock-in.

Is the amount of lock-in bad? I would have thought that migrating a function is somewhat easy.

Re: A URL shortener not shortening the URL but makes it look very dodgy

#97

Post by MayeulC »

moffkalast wrote: post #89
MayeulC wrote: post #59

Earlier quoted context omitted.

1 GB, and 20 GB disk, at OVH. With unlimited bandwidth. Here though, that service could be hosted on a static website (free at github/gitlab/cloudfare/etc), with client-side javascript used to decode data encoded in the url fragment.

Hmm interesting, haven't heard of those yet. Though seems like I was a bit off, DigitalOcean has a 512MB instance for $4 and Scaleway a 2 GB one for $6.5. But then again Scaleway will also nickle and dime you separately for the IP, the HDD and anything else that they can possibly think of.

Hmm, I just double-checked OVH's VPS offers and actually, it's 2GB RAM, 20GB disk, 1vcore, unlimited 100Mbps for €3.5/month (€4.20 with VAT). That's their "starter" offer.

Re: A URL shortener not shortening the URL but makes it look very dodgy

#98

Post by zikohh »

itslennysfault wrote: post #70
fredley wrote: post #11

My goto for this purpose used to be https://shadyurl.com but sadly it seems like it's gone, so glad to have a replacement!

This is actually source code for ShadyUrl. It's linked at the bottom of the readme. Also, this repo hasn't been updated in 5+ years.

I don't think it is. It says it's inspired by shadyurl and includes some more spicy features.

Re: A URL shortener not shortening the URL but makes it look very dodgy

#99

Post by awesomelvin »

dizhn wrote: post #88
awesomelvin wrote: post #29

I have a similar website called http://clickhere.lol (yes, the missing ssl is intentional). Has a weak server though..

The url it generates is fantastic. It didn't work when putting into the address bar.

Hmm weird. Did you click confirm?
Post reply on HN