13 ms·
Show HN: UrlRoulette – Pass a URL to the next visitor
- egfx 10y agoSays my URL https://www.qkast.com https://www.qkast.com is invalid.
- mmathias 10y agoThat's odd. UrlRoulette does some sanity checking on the content of the URL. Thank you for this bug report!
- Lorenzo45 10y agoI also had it fail for www.autodraw.com
- Clex 10y agoYou test the URL with a HEAD method that often 404. You should try with GET instead.
- hk__2 10y agoA server should respond with the same headers to a HEAD request as to a GET one.
- Daviey 10y agoSHOULD and DOES are not the same thing. Returning 405 'Method Not Allowed' on a HEAD isn't unreasonable, and that is the issue we are seeing. EDIT: did say GET on prior edit.
- tyingq 10y agoThey should, but many good sites just don't, for whatever reason. Even ones you know are run by smart people: $ curl -I -X HEAD https://redis.io/ HTTP/1.1 404 Not Found For this app, being more forgiving is a better idea.
- jaredsohn 10y agohttps://www.stumbleupon.com https://www.stumbleupon.com had a similar issue.
- deleted 10y ago[deleted]
- artursapek 10y agohttps://cryptowat.ch https://cryptowat.ch fails too. seems to fail at very basic URL parsing.
- bigbugbag 10y agoit fails at a lot of other basic things: I was unable to post anything because my firefox 52 is not supported to get a recaptcha challenge. Please upgrade to a supported browser to get a reCAPTCHA challenge. Alternatively if you think you are getting this page in error, please check your internet connection and reload. I could reload to infinity, this would not fix this broken website or change the useless error message.
- Nycto 10y agoFails for Amazon URLs, too (And no, I didn't include a referral link in there.)
- tyingq 10y agoAmazon rejects obvious non real browser user agents. This app tries to verify urls before putting them in the queue. I think they may have more anti scraper measures as well.
- zelah 10y agoI like this idea but there is a lot of porn. Can you block the porn?
- mmathias 10y agoWell, I'm not exactly sure about how to do that. I could implement a list of all the major porn sites, but then people could still post porn URL using URL shorteners...
- primitivesuave 10y agoThis is actually a good point, but I'd imagine people put down a porn website out of pure impulse when trying this service, so having their URL rejected with a friendly warning would certainly reduce the amount of porn spam. You could also block common URL shorteners. This is a really cool app though!
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- tyingq 10y agoDisplay the URL with a countdown and a prominent "no thanks" button. Redirect after the countdown if they don't opt out. A fair amount of sites you don't want to visit have obvious urls. Or maybe you could scrape the title and display that as well.
- schmich 10y agoSteven Black's hosts compilation [1] is a good start for what to disallow. For URL shorteners, you could disallow URLs that trigger an HTTP redirect (e.g. HTTP 301), or you could follow the chain of redirects and apply your rules to the terminal URL. [1] https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
- kuschku 10y agoI used it a few times in a row, posting different ones of my bookmarks (for example, Isaac Asimov's Last Question and Last Answer stories), and at one point got my own link back. Due to the low-quality links I always got before that I had first assumed it was just... garbage, but it seems it's just the users. UPDATE: I've now tried about a dozen times (each time providing a link that isn't porn and contains informational content), and got 9 porn links, 1 racist site, and 2 actually interesting links, one of which seemed to have been added by an HNer: contentful.com
- mmathias 10y agoYes, UrlRoulette tries its best not to redirect you to the links that you submitted - that would be boring. All the low-quality stuff: yes, that's the other users! :)
- ptr_void 10y agoTried it a few times, submitted some general interest links from my bookmarks, only to be redirected to scam sites :( Interesting idea, but it's unrealistic to expect good behavior from internet as a whole. It could be useful to have a delay before redirect to be able to read the url and choose whether or not to go in it.
- jffry 10y agoSubmitting UrlRoulette.net? Not funny! Try again! :) Aww man, foiled!
- mmathias 10y ago:)
- deleted 10y ago[deleted]
- api_or_ipa 10y agoLink shortener to the rescue! http://bit.ly/2oCL927 http://bit.ly/2oCL927
- progval 10y agoor prefix the domain with www.
- JetSpiegel 10y agoCan you use a url shortener?
- pawy 10y agoEmpty links to big services like "Google.fr", "Facebook.com", bootstrap; Proposed a funny video, some simple stuff like Cluster Hat & Gitea github
- chromagnon 10y agoPotential for XSS attacks is fairly large. Be careful out there.
- ptr_void 10y agoHaving uMatrix and NoScript addons on firefox may reduce some risks, also in general web browsing
- bigbugbag 10y agoWith noscript urlroulette is useless because it requires cloudflare, ajax.googleapis, google, gstatic and a few others for no valid reason apart supporting google surveillance and helping google for free with what their algorithm cant do (yet). Once you've enabled cloudflare, anything can happen.
- my_ghola 10y agoDo links get removed after a visitor gets one or they stay in the pool?
- mmathias 10y agoThey get removed.
- gnarfish 10y agoNo, you put them in a database. Don't lie to us.
- mmathias 10y agoYes, but they are no longer distributed to users. I thought that was the original question. I'm keeping them in the database to check for SPAM/multiple submissions mainly.
- shocks 10y agoIt's fine. Op is being unreasonable.
- bigbugbag 10y agoOf course the author is collecting everything submitted and does whatever he wants with it. Haven't you read the terms of service and privacy policy ? Probably because there are none which usually means you can safely assume that everything is collected, stored and exploited (or will be later).
- mmathias 10y agoWow, HN front page! About one visit every two seconds! Crazy! :)
- soneca 10y agoJust sharing what I got because it was funny: http://eelslap.com http://eelslap.com
- evinr 10y agoAdding in a query param to bust the cache make it possible to submit the same site multiple times, i.e. example.com, example.com?1, example.com?a, example.com?123
- Lerc 10y agoOn the other hand the Link I submitted wouldn't have shown the desired result without the query string. You probably want to allow repeats of domains, Like map links to something interesting.
- mmathias 10y agoYes, it does, but I think there is almost no way around that. Many sites still use query parameters to show a specific blog entry for example... :/
- warent 10y agoTheir server could trivially query the url and store the result hash. This would also give a chance to scan for malicious content
- will_hughes 10y ago> Their server could trivially query the url and store the result hash. I'm not sure what you mean here? I've not seen a site tell you "We don't use this query parameter" if you stick an additional param on there.
- AdamJacobMuller 10y agoJust did this, and got redirected to this post. Clever.
- neogodless 10y agoHmm 15 hours ago. Could have been me! But clearly several people had this idea, too :)
- jamt9000 10y agoI made something similar for Youtube videos: http://youtubeswap.com http://youtubeswap.com . Lots of trolls, but it can be fun.
- jrz53 10y agoI got meatspinned!
- RGS1811 10y agoUgh, same here. That killed it for me.
- MattBlissett 10y agoI submitted three URLs from GBIF.org (my employer), and two of the people who got them are still browsing 20 minutes later. Pretty sea slugs: https://demo.gbif.org/occurrence/gallery?taxon_key=2292251 https://demo.gbif.org/occurrence/gallery?taxon_key=2292251 Bugs: https://demo.gbif.org/occurrence/gallery?taxon_key=797 https://demo.gbif.org/occurrence/gallery?taxon_key=797 Hummingbirds: https://demo.gbif.org/occurrence/gallery?taxon_key=5289 https://demo.gbif.org/occurrence/gallery?taxon_key=5289 I got three blogs in return, one of which was about catching Pokémon. Fair swap...
- pierrec 10y agoLet me get this straight, you're using a monitoring tool for the website you work on, to check out how long individual people spend on it after you sent it to them via UrlRoulette? That's kinda neat (in a slightly disturbing way).
- MattBlissett 10y agoI wanted to see the user agent and request headers, since there's another comment about other sites being blocked. I simply looked at basic web server logs. It's a beta site with hardly any traffic, so the only log entries were myself and those from the three users from Urlroulette. I was surprised to see the same IPs were still making requests when I went to close the terminal a while later.
- pierrec 10y agoYeah, log diving is bread and butter, but reading your original comment it sounded like UrlRoulette had some kind of magical feature, where one submits a URL, then gets to see how long the stranger spends on the submitted website. Hence the clarification. It would be an interesting feature actually, though it would probably require some annoying iframe tomfoolery.
- eat_veggies 10y agoIf the site doesn't block cross origin requests, calling window.open() gives access to an event that fires when the tab/window closes.
- 5_minutes 10y agoNice idea. I love randomness and serendipity. There must be something more you can do with this concept though.
- bigly 10y agoInteresting idea, but it seems like it has the potential to get you into a lot of trouble. You don't know what kind of messed up stuff you are going to be redirected to.
- buzz27 10y agoI really struggled with your captcha. I had to solve 10 screens of images, it was very time-consuming and tedious.
- bigbugbag 10y agoAgreed this is a very annoying feature and IMHO unnecessary. But the good news is that the captcha didn't work and told me to get supported browser because firefox 52 apparently is not. I suppose urlroulette is trying to be smart and fails, because recaptcha works on every other site in the same browser, though I still hate it with a passion.
- cyorir 10y agoSounds interesting, but I don't want to try it out myself because I know that the internet is dark and full of terrors. Also, I don't want to get Rick-rolled.
- peterwwillis 10y agohttps://www.youtube.com/watch?v=dQw4w9WgXcQ https://www.youtube.com/watch?v=dQw4w9WgXcQ
- Retr0spectrum 10y agoIt probably goes without saying, but you should definitely use some kind of sandboxed browser/session if you want to try this. One annoying URL someone could submit is superlogout.com, which uses logout CSRF to log you out of a whole ton of websites at once. However, I couldn't get it to work in a private tab, because apparently the invisible captcha fails.
- bigbugbag 10y agoAh! this is a fun one, thanks for sharing. Luckily I'm immune to this as I don't have an account on any of these websites but one and I only log there once every 2 years for about 5 minutes.
- oxguy3 10y agoLol, thanks for the suggestion, just submitted superlogout.com; got a Kotaku article in return
- amorphid 10y agoI submitted the video where I first learned about musician Maggie Rogers. I love it! https://youtu.be/G0u7lXy7pDg?t=18m13s https://youtu.be/G0u7lXy7pDg?t=18m13s
- r721 10y agoA couple of tips: 1) There are URL expanders with API to battle URL shorteners, here are some I found with quick googling: http://www.linkexpander.com/api http://www.linkexpander.com/api https://unshorten.me/api https://unshorten.me/api (The API is limited to 10 requests per hour for new short URLs - too slow for you, probably) http://pro.urlex.org http://pro.urlex.org (paid) 2) You could disallow URLs which are detected with 2 or more engines by VirusTotal: https://www.virustotal.com/en/documentation/public-api/ https://www.virustotal.com/en/documentation/public-api/
- partycoder 10y agoIt's not safe to visit random URLs, especially URLs with parameters in them.
- averagewall 10y agoWhy? Drive by exploits get stomped out by browser makers. What could go wrong? A 0-day being wasted on a stranger?
- partycoder 10y agoMore like tricking you into interacting with a website in an unintended way, not only through GET parameters but through clickjacking and other tricks. https://en.wikipedia.org/wiki/Clickjacking https://en.wikipedia.org/wiki/Clickjacking
- laumars 10y agoThere's no such thing as "GET parameters". I assume you are referring to the query string but that's not necessary for encoding resource specific content. You could use the path structure (which is the common way these days), the domain name itself (eg different sub domains for different content), the user agent string, referrer, IP location (eg GeoIP). This is only just scratching the surface too as I've not even began to cover the client side rules one can apply to create a targeted page. Essentially anything that runs like an application can be dynamically generated to be specific to the visitor and since websites can be executed both at the server side and client side (eg Javascript) you're blindly placing you're trust on any URL. Frankly, these days you can't even trust the domain name itself since punycode and data inlining create easy vectors for spoofing, and DNS poisoning attacks are still widely possible.
- iagooar 10y agoNever heard of someone dying because of visiting a random URL. For those with hyperparanoia, just install a VM.
- laumars 10y ago
- throwaway5752 10y agoIs this some sort of infosec performance art? This seems extremely inadvisable for users or the person running the site. What if someone posts something illegal in the jurisdiction of the viewer or a link to a site with an embedded exploit?
- tyingq 10y agoIs it worse than clicking random links on Reddit, other than maybe you can't see the url first?
- mod 10y agoNot seeing the URL is an incredibly huge difference, on average. Also you have zero context and no hive-mind to check the link for you ahead of time.
- tyingq 10y agoI dunno...you have plenty of context from my point of view. It's a site with the word "roulette" in it that tells you what it's going to do: "Submit to be redirected to the previous visitor's URL!" I knew it was likely to throw me to the wolves.
- johnfn 10y agoWell in GP you asked if there was any difference than clicking links on Reddit. I think you've found one: outside of /new (and even then rarely), posts on Reddit will not throw you to the wolves.
- tyingq 10y agoGeneralizing about Reddit is hard. There are plenty of subreddits where outbound links are dangerous or offensive. Even one where they are almost guaranteed to have a 50/50 chance of being so. https://www.reddit.com/r/FiftyFifty/ https://www.reddit.com/r/FiftyFifty/
- shurcooL 10y agoI tried submitting my personal site, https://dmitri.shuralyov.com https://dmitri.shuralyov.com, and got: URL seems to be invalid, please try again! I tried with and without scheme, no luck. Is it a bug? My site redirects from http to https for all queries.
- matthberg 10y agoThey prepopulate a the http, scroll all the way over, it caught me in a similar issue.
- shurcooL 10y agoI tried without "http://" http://" too, it didn't help.
- tyingq 10y agoIt's because your site responds to HEAD requests with a 405. They are doing a HEAD request to see if the url is valid, and if it returns anything other than 200 OK, they reject the url. $ curl -IX HEAD https://dmitri.shuralyov.com/ HTTP/1.1 405 Method Not Allowed
- shurcooL 10y agoThanks. Do you have a recommendation on how I should handle HEAD requests? Edit: I went with something like this [1] for now. It worked to solve this problem. I can adjust later as needed. [1] https://github.com/shurcooL/home/commit/b4a601ff7a3752feb291535875646c984c3f5634 https://github.com/shurcooL/home/commit/b4a601ff7a3752feb291...
- tyingq 10y agoThe general idea is to return all the same headers as a get, without the body, so that's likely correct. Unless there's code farther down that sends content length, etags, etc. You would want to send those too. Though I don't know that it really matters much.
- Jotra7 10y agoThanks for the ransomware delivery service!
- teen 10y agoi got google.com. woo
- peterkshultz 10y agoReminds me of the game Lose Lose. When you defeat an alien, a random file is deleted from your computer. Please don't play it. https://www.engadget.com/2009/09/30/lose-lose-game-deletes-files-as-you-play/ https://www.engadget.com/2009/09/30/lose-lose-game-deletes-f...
- DonHopkins 10y agoThere was a remote dial-up modem service in the 80's called PC Pursuit [1] that let you make local phone calls with modems in other cities through Telenet's packet switching network. You could play a fun game called "PC Roulette" by connecting to a modem and typing the Hayes modem command "A/" to dial the last number somebody called. [1] https://en.wikipedia.org/wiki/Telenet#PC_Pursuit https://en.wikipedia.org/wiki/Telenet#PC_Pursuit
- ruleabidinguser 10y agoI wish I could see people's reactions to my links. There should be some kind of rseponse form that lets you send a note back to the original sharer.
- andersonmvd 10y agoIt would be cool to somehow be able to send a feedback to the previous user who shared the link. I can see a few things being derivative from this idea. Nice idea, but yeah, horrifying when it comes to security. We really have to trust the previous user or simply leave the website. It would be great if you could perform some scan to check for pornographic content, scripts (js) in the page, malware and so on. That's a nice page to exploit CSRF as you don't need to persuade the user to click in a link, you just redirect him.
- mzzter 10y agoThis could probably go under nsfw.
- c8g 10y agoSubmitting Google? Not funny! Try again! :)
- emanreus 10y agoI just got urlceptioned back to this page :)
- red2awn 10y agoI got yours :D
- bigbugbag 10y agoPut something in burn after reading mode to a zerobin instance[1] and share it to urlroulette. [1]: https://github.com/sebsauvage/ZeroBin https://github.com/sebsauvage/ZeroBin
- SaintGhurka 10y agoPut in something innocuous but interesting to me. Got porn in return. And I'm at my in-law's home on their network. I can't believe I'm still making rookie mistakes at my age.
- MichaelApproved 10y agoYou think they're keeping logs of what sites people visit on their network?
- SaintGhurka 10y agoNo, but I still want to respect their rules. And they're in the room with me.
- cube00 10y agoIf chat roulette has thought me anything it's never click anything that includes the word 'roulette' when there are witnesses around.
- MichaelApproved 10y agoHonest question, did you all have a conversation about no porn on their network or are you making an assumption that they wouldn't like it? I'm curious what the "no porn" conversation would be like.
- SaintGhurka 10y agoWe've never discussed it and I don't really have to ask. Yes I'm just making the assumption but it's with a high degree of confidence.
- dabber 10y agoI was hesitant to use this for the obvious reasons but in the end decided to roll the dice... Of course, the first link I get starts an immediate download of the ubuntu 17.04 iso. Vindication on the first role.
- sklivvz1971 10y agoI tried to put my own website but it says url invalid... something must be broken (for repro: http://sklivvz.com/ http://sklivvz.com/)
- detaro 10y agoSee comments below, discussing other non-working sites: you don't implement HEAD requests correctly.
- Proven 10y agoLeft a porn site URL
- kwhitefoot 10y agoThe captcha makes it extremely tedious, too slow, no fun at all.