Live data from Hacker News

Instagram's URL Blackhole

medium.com

11–20 of 52 posts

Re: Instagram's URL Blackhole

#12
post #6

Ironic the Apple App store allows a "phone antivirus" to exist.

But it's rated 4.4 stars! I'm guessing it hoovers your contacts and tries to get you to sign up for the IAP subscription.

The meta these days is bundling dodgy SDKs which turn the device into a residential proxy, which then gets sold on to the highest bidder. Mostly AI companies, whose desire to scrape literally everything has driven demand for that type of malware into the stratosphere.

Re: Instagram's URL Blackhole

#14

I want to thank you dear poster and author, I feel genuinely refreshed reading a short interesting post sans status quo topic. Waiting for the next part!

Right? It's so short and...just ends. Been too fatigued reading essays on just about everything. I loved this one.

Re: Instagram's URL Blackhole

#15
post #6

Ironic the Apple App store allows a "phone antivirus" to exist.

Almost unbelievable that they allow this - except of course they do, because scamware makes a ton of money via in-app purchase, and Apple gets 30%, so of course they do. I'm sure people will come out of the woodwork now to white knight for Apple and spin this somehow. But anything that offends their business model can be removed in minutes, while software that by its title violates the App Store rules is just here indefinitely.

Re: Instagram's URL Blackhole

#16
How does Apple allow this? Here I thought the App Store was supposedly superior to the Android eco-system and that's why Apple justified the insane 30% tax on developers back then

Re: Instagram's URL Blackhole

#17
It's fun and all, is there a way to safely host .html but does not allow rendering it?

CORS? sec-fetch-dest, sec-fetch-mode and sec-fetch-site ?

If storage.googleapis.com weren't operated by Google, the domain would be blocked by Google's "Safe Browsing" long time ago.

Re: Instagram's URL Blackhole

#18
post #17

It's fun and all, is there a way to safely host .html but does not allow rendering it? CORS? sec-fetch-dest, sec-fetch-mode and sec-fetch-site ? If storage.googleapis.com weren't operated by Google, the domain would be blocked by Google's "Safe Browsing" long time ago.

Serve it with content-type set to text/plain and browsers won't try to render it. You can try a random html file on github. If you click raw it'll get rendered as text.

Re: Instagram's URL Blackhole

#20
post #17

It's fun and all, is there a way to safely host .html but does not allow rendering it? CORS? sec-fetch-dest, sec-fetch-mode and sec-fetch-site ? If storage.googleapis.com weren't operated by Google, the domain would be blocked by Google's "Safe Browsing" long time ago.

> If storage.googleapis.com weren't operated by Google, the domain would be blocked by Google's "Safe Browsing" long time ago.

Not true. You just need to make it an eTLD by adding it to the public suffix list. Only subdomains of domains on the PSL can be marked by Google’s Safe Browsing.

Post reply on HN