Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I accidentally made my link shortener into a malware honeypot

app.y.gy

Post reply on HN
Print view View original

81–90 of 118 posts

Re: I accidentally made my link shortener into a malware honeypot

#81

Post by SushiHippie »

doakes wrote: post #16
kornhole wrote: post #11

I generally always run any shortened link through a link checker before opening. So they are an inconvenience to me. The time it took you to write all this evidences the problem with hosting the service publicly. Yesterday I ran into problem with sharing a link to a simplex.chat group which was so long my website builder translated it incorrectly. I looked at link shorteners publicly available and now understand from…

Which link checker(s) do you use?

Not OP but I use https://wheregoes.com, as it shows you all redirects that happen.

Re: I accidentally made my link shortener into a malware honeypot

#82

Post by r0s »

pants2 wrote: post #74
r0s wrote: post #58

Earlier quoted context omitted.

I was recently discussing this subject and I have to wonder if some combination of human readable symbols that is also optimized for machine scanning will emerge. Right now any phone should be able to parse a url if it can read the type, and so what is the point of QR besides the ubiquity?

QR codes provide built-in error correction so will stand up to serious wear-and-tear, partially obscured images, etc. - and it won't confuse O with 0 and i with l

All that is true of regular type as well to some degree, I guess my point is a standard of readable url type could have all those qualities.

Also the longer a url is out in physical space the more danger of it being replaced online, longevity may not be desirable.

Re: I accidentally made my link shortener into a malware honeypot

#83

Post by bfog »

hoistbypetard wrote: post #46
JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

I have written my own URL shortener. I do it partly to get URLs that are nice to type in printed materials. I also use it to hedge my risks from using SaaS. For my org, we host some things that we offer to the public on different services. Sometimes a vendor doesn't work out. We use our shortened URLs in public communications, and I can redirect them to our new service if we need to switch. It was a way to address my…

^^ this. I wrote one for the same reasons. Also for links to internal tools in chat, as it makes for shorter more concise messages.

Re: I accidentally made my link shortener into a malware honeypot

#84

Post by tim333 »

LeonenTheDK wrote: post #68
optimalsolver wrote: post #39

Earlier quoted context omitted.

One step away from this: https://twitter.com/nearcyan/status/1532076277947330561

That's actually a very interesting idea I hadn't seen before. Certainly makes it less obvious that one has been shadowbanned, and probably would help keep (non-bots) happy. I wonder if it'd be worth the investment to implement.

By the way the NYT article is fake https://news.ycombinator.com/item?id=31588260

Still an interesting idea though.

Re: I accidentally made my link shortener into a malware honeypot

#85

Post by orf »

optimalsolver wrote: post #39
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

One step away from this: https://twitter.com/nearcyan/status/1532076277947330561

Which is a step backward, because it now costs you ongoing money to ban someone in this way.

Re: I accidentally made my link shortener into a malware honeypot

#86

Post by kornhole »

doakes wrote: post #16
kornhole wrote: post #11

I generally always run any shortened link through a link checker before opening. So they are an inconvenience to me. The time it took you to write all this evidences the problem with hosting the service publicly. Yesterday I ran into problem with sharing a link to a simplex.chat group which was so long my website builder translated it incorrectly. I looked at link shorteners publicly available and now understand from…

Which link checker(s) do you use?

https://f-droid.org/en/packages/com.trianguloy.urlchecker/

Re: I accidentally made my link shortener into a malware honeypot

#87

Post by ksenzee »

anonymousDan wrote: post #66
fddrdplktrew wrote: post #63

Earlier quoted context omitted.

> But link shorteners, even when used by good faith actors, are problematic because they hide the destination of the link In a sense, Google Search is even more evil because they change the destination link on-click. So hovering on a search result link doesn't show you the true destination.

This is why I love 'Copy clean link' in Brave.

“Copy Link Without Site Tracking” is available in Firefox also.

Re: I accidentally made my link shortener into a malware honeypot

#88

Post by fddrdplktrew »

ksenzee wrote: post #87
anonymousDan wrote: post #66

Earlier quoted context omitted.

This is why I love 'Copy clean link' in Brave.

“Copy Link Without Site Tracking” is available in Firefox also.

"Visit link without site tracking" would be nice, to save a step.

Re: I accidentally made my link shortener into a malware honeypot

#89

Post by 63stack »

david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

I don't understand why shadowbanning would be so effective. It's trivial for any competent spammer to check their submissions from different ip addresses, they will very quickly discover if they are shadowbanned.

The risk of misidentifying legit users and shadowbanning them outweighs the potential gain.

Re: I accidentally made my link shortener into a malware honeypot

#90

Post by ghayes »

mik3y wrote: post #23

A big problem that came up at the domain level was what I'd call a _trustworthy domain with untrustworthy subdomains_, specifically where those subdomains represent user-generated content. The Public Suffix List (PSL) [1] to the rescue! It can help with this kind of disambiguation. Paraphrasing, it's a list of domains where subdomains should be treated as separate sites (e.g. for cookie purposes). So `blogger.com` on…

But the cost dynamic would still be different, right? As in, it doesn't cost as much to register a .blogger.com as it does a .com?
Post reply on HN