Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I accidentally made my link shortener into a malware honeypot

app.y.gy

Post reply on HN
Print view View original

61–70 of 118 posts

Re: I accidentally made my link shortener into a malware honeypot

#61

Post by geon »

xyst wrote: post #40
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

> if the ip address that created the link shortener accesses the link, they get the real redirect, and if a different ip address accesses it If there’s anything I have learned about IP based blocking, it’s very unreliable. Especially in a NAT’d world. Great you “shadowbanned” an IP, but you also impacted many other people and devices behind that public IP including the bad actor. IPv6 is supposed to make NAT irreleva…

> Great you “shadowbanned” an IP, but you also impacted many other people and devices behind that public IP

In this scenario it doesn't matter. Some user might be able to access the malware still, but that's better than not blocking it at all.

Re: I accidentally made my link shortener into a malware honeypot

#62

Post by Baeocystin »

JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

I use them for easy memorization of tools and deployment stuff I use in my day-to-day IT work. It's also nice to be able to track if someone did what they were supposed to do.

Re: I accidentally made my link shortener into a malware honeypot

#63

Post by fddrdplktrew »

not2b wrote: post #43

No disrespect to the folks at y_gy who are clearly doing their best. But link shorteners, even when used by good faith actors, are problematic because they hide the destination of the link, and of course that's an invitation for bad faith actors to exploit, so the battle will be endless. Shorteners got popular on Twitter back in the days when all the characters in the URL counted against a very short limit. But there…

> But link shorteners, even when used by good faith actors, are problematic because they hide the destination of the link

In a sense, Google Search is even more evil because they change the destination link on-click. So hovering on a search result link doesn't show you the true destination.

Re: I accidentally made my link shortener into a malware honeypot

#64

Post by anonymousDan »

JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

This question reads a bit like "What have the Romans ever done for us?". ;)

Re: I accidentally made my link shortener into a malware honeypot

#66

Post by anonymousDan »

fddrdplktrew wrote: post #63
not2b wrote: post #43

No disrespect to the folks at y_gy who are clearly doing their best. But link shorteners, even when used by good faith actors, are problematic because they hide the destination of the link, and of course that's an invitation for bad faith actors to exploit, so the battle will be endless. Shorteners got popular on Twitter back in the days when all the characters in the URL counted against a very short limit. But there…

> But link shorteners, even when used by good faith actors, are problematic because they hide the destination of the link In a sense, Google Search is even more evil because they change the destination link on-click. So hovering on a search result link doesn't show you the true destination.

This is why I love 'Copy clean link' in Brave.

Re: I accidentally made my link shortener into a malware honeypot

#67

Post by JoshTriplett »

akira2501 wrote: post #57
xyst wrote: post #44

Earlier quoted context omitted.

More for vanity and possibly increases engagement. Like you said, if I want a group of people to visit a link. Would you type in “q.ly/abc” or “website.com/20240229/my-blog-title-here/1” But as some have mentioned, QR codes have easily replaced URL shorteners for this purpose anyways. Also I guess for the very small number of people without a device that can’t read QR codes, a shortened url would help them engage

Why do blog titles include a unique ID and a worthless slug tacked on?

A unique ID helps avoid broken links if a post's title changes, and avoids conflicts between posts with the same name.

Re: I accidentally made my link shortener into a malware honeypot

#68

Post by LeonenTheDK »

optimalsolver wrote: post #39
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

One step away from this: https://twitter.com/nearcyan/status/1532076277947330561

That's actually a very interesting idea I hadn't seen before. Certainly makes it less obvious that one has been shadowbanned, and probably would help keep (non-bots) happy. I wonder if it'd be worth the investment to implement.

Re: I accidentally made my link shortener into a malware honeypot

#69

Post by zrm »

baq wrote: post #53
xyst wrote: post #40

Earlier quoted context omitted.

> if the ip address that created the link shortener accesses the link, they get the real redirect, and if a different ip address accesses it If there’s anything I have learned about IP based blocking, it’s very unreliable. Especially in a NAT’d world. Great you “shadowbanned” an IP, but you also impacted many other people and devices behind that public IP including the bad actor. IPv6 is supposed to make NAT irreleva…

IPv6 doesn’t solve this really. You’ll still ban at least /64 and you’ll switch to /48 for the particularly nasty ones. There’s zero reason to ban a specific ipv6 address.

> You’ll still ban at least /64 and you’ll switch to /48 for the particularly nasty ones.

The entire /64 will nearly always be a single ISP customer, not thousands of customers behind one address as it can be for IPv4. And you can start by banning the /64 and then widen the mask, say, 4 bits at a time if abusive traffic continues from an adjacent range. It's not that hard to automate this. Then the /48 gets blocked only if you see abusive traffic from multiple ranges within it, implying that the whole range is controlled by the attacker, or that ISP does nothing about abusive customers, which is nearly the same thing.

Re: I accidentally made my link shortener into a malware honeypot

#70

Post by pornel »

JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

QR codes of shorter URLs are easier to scan.
Post reply on HN