Twitter is rejecting posts containing JSFiddle URLs • Hacker News Board

Re: Twitter is rejecting posts containing JSFiddle URLs

#101

Post by 292355744930110 » Fri, Jun 07, 2019, 12:51 PM UTC

FreeHugs wrote: post #13

vermontdevil wrote: post #4

It’s due to crypto scammers using it. From the founder’s post: At some point in the past crypto scammers used JSFiddle to host pages with a wallet code and posted links to that on Twitter. Due to the nature of JSFiddle, anyone can post anything, so wallet codes are ok – we did implemented a content filter to shadow-ban these. I asked Twitter if they they could help out and ban twitter accounts that were posting scam…

What is "a wallet code"?

>> By wallet code you mean a crypto mining script yes?

>I think I saw some variant of this. It's one of those "send some ETH and receive 2x more back!" With fake "live" transaction listing and fake testimonials.

> Edit: if memory serves me correct, the transactions being listed are actually not fake, though the live aspect is. Same transaction always reappear as if they're new if you refresh, and those transactions is the 2x amount that got send back. It's all just the scammers trying to make the site look legit.

- From the above linked GitHub Issue

Re: Twitter is rejecting posts containing JSFiddle URLs

#102

Post by solarkraft » Fri, Jun 07, 2019, 12:54 PM UTC

tannhaeuser wrote: post #68

codedokode wrote: post #11

Earlier quoted context omitted.

I don't understand how posting a "wallet code" is dangerous. Is it mining coins while you are browsing the code? Then it just a minor annoyance. Also, browsers should block cryptominers when they are in the background tab.

Blocking cryptominers or other script isn't possible because of JavaScript's nature as Turing-complete language, much less with new shiny WebWorkers/PWAs. It's also not just a minor annoyance when miners, trackers, and all kinds of other nefarious or just plain garbage scripts drain your batteries and consume power/bandwidth for no other reason than browser vendors being busy to develop webapp platforms and world dom…

You can detect crypto miners pretty easily by their behavior.

Re: Twitter is rejecting posts containing JSFiddle URLs

#103

Post by solarkraft » Fri, Jun 07, 2019, 12:55 PM UTC

hu3 wrote: post #79

Phenix88be wrote: post #30

Earlier quoted context omitted.

Why not ? They did it for JSFiddle. They own the platform, so technically they do what they want.

The backlash from banning GitHub links would be magnitudes larger than JSFiddle.

Yeah, but does Twitter care what its users think?

Re: Twitter is rejecting posts containing JSFiddle URLs

#104

Post by jasonlotito » Fri, Jun 07, 2019, 12:56 PM UTC

vfc1 wrote: post #7

Given the nature of the product, there is no way for the maintainers of Js fiddle to prevent it from being used to run arbitrary code, because that is what it's meant to do. It's also impossible for both jsfiddle or twitter to scan the code of each fiddle and determine if it's legitimate or an attack, so this looks like a good measure from Twitter. What is surprising is how this was even allowed so far and still is i…

Then Twitter should ban all links externally, because other websites can run arbitrary code.

Re: Twitter is rejecting posts containing JSFiddle URLs

#105

Post by vfc1 » Fri, Jun 07, 2019, 12:58 PM UTC

jasonlotito wrote: post #104

vfc1 wrote: post #7

Given the nature of the product, there is no way for the maintainers of Js fiddle to prevent it from being used to run arbitrary code, because that is what it's meant to do. It's also impossible for both jsfiddle or twitter to scan the code of each fiddle and determine if it's legitimate or an attack, so this looks like a good measure from Twitter. What is surprising is how this was even allowed so far and still is i…

Then Twitter should ban all links externally, because other websites can run arbitrary code.

The difference is that those sites don't let anonymous users run arbitrary code on their servers, unlike Jsfiddle.

Re: Twitter is rejecting posts containing JSFiddle URLs

#106

Post by dlubarov » Fri, Jun 07, 2019, 12:58 PM UTC

layoutIfNeeded wrote: post #12

vermontdevil wrote: post #4

It’s due to crypto scammers using it. From the founder’s post: At some point in the past crypto scammers used JSFiddle to host pages with a wallet code and posted links to that on Twitter. Due to the nature of JSFiddle, anyone can post anything, so wallet codes are ok – we did implemented a content filter to shadow-ban these. I asked Twitter if they they could help out and ban twitter accounts that were posting scam…

Crypto scammers can simply switch to GitHub Pages. Can Twitter ban github links?

And even then, scammers can always switch to custom domains. It seems futile to block arbitrary code execution unless they only allow whitelisted domains.

Re: Twitter is rejecting posts containing JSFiddle URLs

#107

Post by godzillabrennus » Fri, Jun 07, 2019, 12:59 PM UTC

MasterScrat wrote: post #92

paulgb wrote: post #82

Earlier quoted context omitted.

I don’t think it’s mining code, I think it’s wallet addresses posted by scammers. Here’s an example of the scam I think this is intended to curb: https://s3.amazonaws.com/aws-website-staticfiles-25g9k/elon_...

I don't understand how someone could be tech-savvy enough to know about ETH and actually own some, while at the same time falling for such scams.

The people speaking at events as experts on crypto mostly don’t know what they are doing.

Re: Twitter is rejecting posts containing JSFiddle URLs

#108

Post by ltc5505 » Fri, Jun 07, 2019, 1:01 PM UTC

celeritascelery wrote: post #100

intrasight wrote: post #99

All links should be blocked IMHO. If you have something to say (in 280 characters) say it. If you have more to say, I'll find it on your blog.

How will you show me where your blog is?

I was going to make a joke, but actually a good answer to this is that users could just direct people to checkout their blog linked in their bio. This is assuming the person you are responding to didn't mean block all URLs from the site; just from tweets.

Technically it doesn't solve the scam problem though:

"I'm definitely the real Elon Musk. No question about it. Click the link in my bio to get 40 ETH, but you need to send me 20 ETH first so that I can verify things."

Re: Twitter is rejecting posts containing JSFiddle URLs

#109

Post by egorfine » Fri, Jun 07, 2019, 1:02 PM UTC

slig wrote: post #96

vermontdevil wrote: post #4

It’s due to crypto scammers using it. From the founder’s post: At some point in the past crypto scammers used JSFiddle to host pages with a wallet code and posted links to that on Twitter. Due to the nature of JSFiddle, anyone can post anything, so wallet codes are ok – we did implemented a content filter to shadow-ban these. I asked Twitter if they they could help out and ban twitter accounts that were posting scam…

What's next? Banning QR codes containing wallet address?

Banning all links whatsoever because any web page can contain a miner, a malware or just offensive material.

Re: Twitter is rejecting posts containing JSFiddle URLs

#110

Post by hombre_fatal » Fri, Jun 07, 2019, 1:06 PM UTC

solarkraft wrote: post #103

hu3 wrote: post #79

Earlier quoted context omitted.

The backlash from banning GitHub links would be magnitudes larger than JSFiddle.

Yeah, but does Twitter care what its users think?

The low-effort snark is unnecessary and weakens the conversation. At least make it witty.

JSFiddle is a pretty low tier target that most people won't miss. Github links aren't. Also, I'd imagine Github Pages is more responsive to taking down scamware, it at least requires an account, and has more of an interested in keeping malicious behavior off the platform.