4 ms·
Anyone know why they would choose to use incremented integers and not 256-bit identifiers? This seems like a gaping hole to me that makes me uncomfortable shar
by tuna-piano 10y ago
Anyone know why they would choose to use incremented integers and not 256-bit identifiers? This seems like a gaping hole to me that makes me uncomfortable sharing links in the tool.
I would much, much, much rather not have link previews than be open to this sort of simple exploit.
Seems like someone could just write a script to pull down a few thousand links, and then search for links from specific sites, private Google Docs documents, etc.
- niftich 10y agoIn an earlier thread about this I wrote [1] that the contributing factors FB does aren't egregious by themselves. Specifically, in their view all of their link previews are public, as they were originally intended to catalogue the web. Having predictable, incrementing integers as IDs for public resources isn't a problem. The problem is most people perceive Messenger as a private chat, and don't expect their privately-shared links to be catalogued in a publically accessible, trivially crawlable object store. [1] https://news.ycombinator.com/item?id=11873258 https://news.ycombinator.com/item?id=11873258