Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook crawls links in PDFs you send in Messenger

twitter.com

Post reply on HN
Print view View original

111–120 of 165 posts

Re: Facebook crawls links in PDFs you send in Messenger

#111

Post by GhostVII »

ahbyb wrote: post #40
GhostVII wrote: post #32

Earlier quoted context omitted.

The cost of uploading a PDF of links is probably not much less than the cost of following those links on your own. So I don't think you gain much by leveraging Facebook in this case.

What if I create a PDF with this content... https://news.ycombinator.com/item?id=1 https://news.ycombinator.com/item?id=2 https://news.ycombinator.com/item?id=3 and so on, until 10,000,000? Perhaps Facebook starts opening every link using 10,000 parallel threads. Can you really replicate that from your connection at home? Perhaps even the sysadmin of your victim site has whitelisted all Facebook IP addresses so their…

I would imagine it queries sequentially so it wouldn't have too many parallel threads. Not much reason to parallelize.

Re: Facebook crawls links in PDFs you send in Messenger

#112

Post by steelframe »

My company's malware detection crap on my work laptop once scanned a PDF of a security research paper I was reading for my project, found a link to a web site with malware on it because that's what the research was about, and then it summarily deleted the PDF to "protect" the company from that link.

Re: Facebook crawls links in PDFs you send in Messenger

#113

Post by hermanradtke »

BubRoss wrote: post #84
yellow_lead wrote: post #68

Earlier quoted context omitted.

I experienced this too, Facebook will block most torrent links, regardless of if they're legal or not. I've taken to encoding these with Base64 first and instructing the recipient to decode them.

Why not just make it a broken link and tell them how to correct it?

Why not just use an e2e messaging service? If you can convince people to decode a link then I am sure you can convince them to use Signal.

Re: Facebook crawls links in PDFs you send in Messenger

#114

Post by roywiggins »

JadeNB wrote: post #99
kerng wrote: post #87

Earlier quoted context omitted.

Same can be done if e2e is enabled. Nothing prevents Facebook from sending links from client to a "validation" service. They do this already in WhatsApp for instance.

Maybe I'm being foolish, but isn't the point of e2e that Facebook wouldn't even know what you were sending (a link or otherwise), it being encrypted in flight?

The WhatsApp client knows, since that's the "end." Nothing technical stops Facebook from bundling some code in the client to pass data about the messages back to a central server.

Re: Facebook crawls links in PDFs you send in Messenger

#116

Post by Spivak »

steelframe wrote: post #112

My company's malware detection crap on my work laptop once scanned a PDF of a security research paper I was reading for my project, found a link to a web site with malware on it because that's what the research was about, and then it summarily deleted the PDF to "protect" the company from that link.

I mean how is the security scanner supposed to know that you’re working on a project which is super specific edge case?

I mean almost all of the time that PDF will be malware designed to trick the reader into clicking that link and it did the right thing.

Re: Facebook crawls links in PDFs you send in Messenger

#117

Post by bagacrap »

mehrdadn wrote: post #81
Nextgrid wrote: post #56

Earlier quoted context omitted.

To be fair, an HTTP GET request should never modify the state of the system - hitting a link should not change anything. If you need to expire links then make the initial link display a form with a submit button (which does a POST) to reveal the content (and expire the link). Legitimate crawlers don’t submit forms so it should be safe.

> To be fair, an HTTP GET request should never modify the state of the system In theory. But that's not how the world I live in seems to work.

I think it's pretty common practice. Otherwise search engine web crawlers would be wreaking havoc.

Re: Facebook crawls links in PDFs you send in Messenger

#119

Post by mehrdadn »

bagacrap wrote: post #117
mehrdadn wrote: post #81

Earlier quoted context omitted.

> To be fair, an HTTP GET request should never modify the state of the system In theory. But that's not how the world I live in seems to work.

I think it's pretty common practice. Otherwise search engine web crawlers would be wreaking havoc.

No, both your logic and premise are incorrect. To give just one example, rate-limiting is clearly widespread stateful practice applied to GET requests, and it doesn't cause web crawlers to wreak havoc on anything.

Re: Facebook crawls links in PDFs you send in Messenger

#120

Post by TwoBit »

steelframe wrote: post #112

My company's malware detection crap on my work laptop once scanned a PDF of a security research paper I was reading for my project, found a link to a web site with malware on it because that's what the research was about, and then it summarily deleted the PDF to "protect" the company from that link.

Well it wasn't entirely wrong. Just because the doc was about malware doesn't mean somebody won't accidentally click it.
Post reply on HN