Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I accidentally made my link shortener into a malware honeypot

app.y.gy

Post reply on HN
Print view View original

71–80 of 118 posts

Re: I accidentally made my link shortener into a malware honeypot

#71

Post by echoangle »

akira2501 wrote: post #57
xyst wrote: post #44

Earlier quoted context omitted.

More for vanity and possibly increases engagement. Like you said, if I want a group of people to visit a link. Would you type in “q.ly/abc” or “website.com/20240229/my-blog-title-here/1” But as some have mentioned, QR codes have easily replaced URL shorteners for this purpose anyways. Also I guess for the very small number of people without a device that can’t read QR codes, a shortened url would help them engage

Why do blog titles include a unique ID and a worthless slug tacked on?

People think it helps with SEO, but I’m not sure how accurate that is. SEO seems to be a lot of snake oil and superstition

Re: I accidentally made my link shortener into a malware honeypot

#72

Post by echoangle »

JoshTriplett wrote: post #67
akira2501 wrote: post #57

Earlier quoted context omitted.

Why do blog titles include a unique ID and a worthless slug tacked on?

A unique ID helps avoid broken links if a post's title changes, and avoids conflicts between posts with the same name.

I think the question was why there is even a slug when there is already an ID

Re: I accidentally made my link shortener into a malware honeypot

#73

Post by pants2 »

david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

Shadowbanning is extremely hostile to users that have been mis-identified as spammers (which will happen) while spammers will quickly and easily figure out a way to determine if they've been shadowbanned. That approach needs to stop.

Re: I accidentally made my link shortener into a malware honeypot

#74

Post by pants2 »

r0s wrote: post #58
tpurves wrote: post #42

Semi related. When I worked at Visa, I developed some ideas around making QR codes slightly more resilient to malicious hijacking when used in the context of a payments or commerce usecase. The idea was for the scanning app to look not just for a QR but also look for adjacent payment acceptance marks (e.g. branded Visa, MC, PayPal, or a merchant's brandmark etc.) and then dynamically only resolve URLs to registered d…

I was recently discussing this subject and I have to wonder if some combination of human readable symbols that is also optimized for machine scanning will emerge. Right now any phone should be able to parse a url if it can read the type, and so what is the point of QR besides the ubiquity?

QR codes provide built-in error correction so will stand up to serious wear-and-tear, partially obscured images, etc. - and it won't confuse O with 0 and i with l

Re: I accidentally made my link shortener into a malware honeypot

#75

Post by recursive »

JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

I use one to get bookmarks to a service that keeps a significant amount of data in the URL fragment.

e.g. https://mutraction.dev/link/pv

Re: I accidentally made my link shortener into a malware honeypot

#76

Post by codeonline »

david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

If you had the time and inclination you could even seed their account with mock stat's. I.e. when the link shortened is accessed, correctly log all of the metrics to their account so they have solid metrics indicating its working, but fail the actual consumer requests

Re: I accidentally made my link shortener into a malware honeypot

#77

Post by supersparrow »

codeonline wrote: post #76
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

If you had the time and inclination you could even seed their account with mock stat's. I.e. when the link shortened is accessed, correctly log all of the metrics to their account so they have solid metrics indicating its working, but fail the actual consumer requests

Logging their metrics correctly is going to take resource. Instead, just set a flag on their account which, if true, means they just see some randomised junk stats.

Re: I accidentally made my link shortener into a malware honeypot

#78

Post by codeonline »

JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

They are useful for links that need to outlive the infrastructure they are hosted on. Think about them as a layer of abstraction. Ie. Links in paper published to a journal like nature. It might be valid for 10 years but the links embedded in it will rot quickly as organisations change cms's, domains names change. Organisations merge and disappear.

Also places where the cost to change the url is expensive, bus shelter adverts etc.

Re: I accidentally made my link shortener into a malware honeypot

#79

Post by stevenicr »

TimLeland wrote: post #17

I can really relate to this article! I created T.LY URL Shortener in 2018, and I've encountered all these issues and more! I found out the hard way when my hosting company shut down my servers for malicious content about a week into launching the site. Malicious actors will go to all sorts of lengths to achieve their goals. Be careful relying on Stripe to prevent these users. Next they will start using stolen credit…

privacy policy does not address data retention, maybe there is none, I just assume that some data would be collected by an API service

I would not use something like this to send my customer data to the thing to check a link, but if it was something that could be self hosted on my vps and a script to attach wordpress chat system to check with it - maybe..

But with no pricing showing, I am assuming I can't afford it anyhow.

Re: I accidentally made my link shortener into a malware honeypot

#80

Post by [deleted] »

pants2 wrote: post #73
david422 wrote: post #25

I've dealt with some spammers to various degrees. I think one of the most effective ways of dealing with spammers is to - "shadowban" them. Allow them to use your service, but don't indicate to them that you've identified them as malicious. For instance, when dealing with chat spammers - allow them to chat, but do not show their chats to other users. Another level would be to allow them to chat, but only show their c…

Shadowbanning is extremely hostile to users that have been mis-identified as spammers (which will happen) while spammers will quickly and easily figure out a way to determine if they've been shadowbanned. That approach needs to stop.

[deleted]
Post reply on HN