8 ms·

This pattern needs to die. Whenever I paste a link in any sort of messaging app - iMessages to Slack - it puts a thumbnail and summary, polluting the entire co

This pattern needs to die. Whenever I paste a link in any sort of messaging app - iMessages to Slack - it puts a thumbnail and summary, polluting the entire conversation with tons of noise. Messaging apps have no business in looking up the URL. Just let it pass as a link. Fuck everything about this and we need to push back on this nonsense.

nitrogen 6y ago
I like link previews. I don't like when they are managed server-side instead of client-side.
- crazygringo 6y ago
  Caching a link's title and thumbnail server-side will save your site potentially millions of requests from Facebook and elsewhere. Seems like a benefit for site owners to me. Not to mention that the server is reducing the image size of a thumbnail, potentially converting from HTTP to HTTPS, and so on.
  - lixtra 6y ago
    > Seems like a benefit for site owners to me. Maybe, but it’s definitely less control for the site owner. Maybe she wants to do analytics on the previews (how far shared, which ip regions) or delete the content at a specific time. Etc.
- elviswolcott 6y ago
  The issue with doing them client side (other than the missed cache opportunity of using a server) is that it means you're having every user in the chat send a request to an arbitrary URL from their device. Also CORS makes this impossible 99% of the time.
  - ekimekim 6y ago
    The third approach, which Signal uses as a privacy preservation measure, is for the sender to generate the link preview on send. Of course, this then opens up abuse where the sender can arbitrarily control the "link preview" to say whatever they want.
- ufmace 6y ago
  Also considering the sibling story, at least the server-side preview builder is definitely entirely unauthenticated to every possible service. A preview builder running on the client side might conceivably pick up your authentication to something in various circumstances.
crazygringo 6y ago
I disagree completely, I find it extremely useful. Most links are unreadable (e.g. an ID to a cloud file), and are truncated anyways even if readable. The preview gives me the title of the webpage, which is infinitely more useful -- especially letting me know whether it's a document I've already seen (and don't need to open) or something new, and if so, what.
- systemvoltage 6y ago
  To me it pollutes the discussion away from the messages and puts a bunch of thumbnails where it could just be a clean text conversation. The thing that bothers me is also that I, as a user, have no choice - it just does it automatically. Do you like IRC?
  - katbyte 6y ago
    this is one of those "people like different things" situations and a config option should be added to support both.
    - JadeNB 6y ago
      Slack, and I suspect most other messaging apps, has such a config option.
  - occamrazor 6y ago
    Whatsapp allows to delete the link box: enter the link, wait for the preview, backspace, and send. The hyperlink remains clickable too.
    - shultays 6y ago
      Slack does it as well
  - JadeNB 6y ago
    I suspect that most apps have a way to turn this off. Slack certainly does. That doesn't stop other users from seeing previews of your links, if it's set up that way for them, but it does prevent you from seeing previews of others' (and your own) links.
compiler-guy 6y ago
Part of the goal here is to prevent people from clicking on malicious links. A preview helps with that. Or, more simply, you can't be rickrolled if you know the destination in advance.
- netsharc 6y ago
  The next level would be for the server to see who is requesting content. Facebook IP? "Here's some harmless HTML!". Browser IP? "Here's an executable pretending to be a harmless page!"
mikece 6y ago
A funny story (well, funny because it didn't happen to me) was chronicled on a recent episode of Corey Quinn's "Whiteboard Confessions" -- https://www.lastweekinaws.com/podcast/aws-morning-brief/whiteboard-confessional-click-here-to-break-production/ https://www.lastweekinaws.com/podcast/aws-morning-brief/whit... -- where Slackbot's auto URL unfurling feature "clicked" an SNS alert unsubscribe link when a tech posted the a report including that link into a slack channel. If nobody lost their job over this triggering a SEV-1 alert I'm sure they had a laugh about it later. Another issue with auto-unfurling links or generating previews of URLs is the potential for stalking. If I'm hunting my ex and I know their cell phone number AND that they have an iPhone I can simply send a link to a website and let iOS generate the preview... which then pings the URL of the website which I set up and I can now run geo-IP resolution and narrow down where my ex is (and maybe I follow up with a well-crafted PDF exploit when I'm ready to narrow down even more on an area). While systemvoltage was a bit brusque in how the complaint was worded above, these "friendly and helpful" features of Slack, SMS, and other apps can have devastating unforeseen consequences. I question the value of having to opt out of these features instead of making them opt-in instead.
- systemvoltage 6y ago
  haha, wow. This is some story. Thanks for sharing.
- crazygringo 6y ago
  That's an interesting idea of a security breach. In practice it's going to be difficult because: 1) You can't do effective geolocation on cell phone IP address, except perhaps at a country level [1] 2) Your ex would need to open your message to trigger the link preview loading. If you're stalking them, they're probably either ignoring you or blocking you 3) At most, if the ex is connected to a Wi-Fi network like Starbucks and opens the message, you'll be able to get the city they're in, maybe. But at the end of the day, what you'd get from link previews is no different from embedding a tracker image in an e-mail. And while it requires someone to suspect they're being stalked, blocking would prevent all of this. [1] http://www.cs.yale.edu/homes/mahesh/papers/ephemera-imc09.pdf http://www.cs.yale.edu/homes/mahesh/papers/ephemera-imc09.pd...
- 6y ago

nitrogen 6y ago

I like link previews. I don't like when they are managed server-side instead of client-side.

crazygringo 6y ago
Caching a link's title and thumbnail server-side will save your site potentially millions of requests from Facebook and elsewhere. Seems like a benefit for site owners to me. Not to mention that the server is reducing the image size of a thumbnail, potentially converting from HTTP to HTTPS, and so on.
- lixtra 6y ago
  > Seems like a benefit for site owners to me. Maybe, but it’s definitely less control for the site owner. Maybe she wants to do analytics on the previews (how far shared, which ip regions) or delete the content at a specific time. Etc.
elviswolcott 6y ago
The issue with doing them client side (other than the missed cache opportunity of using a server) is that it means you're having every user in the chat send a request to an arbitrary URL from their device. Also CORS makes this impossible 99% of the time.
- ekimekim 6y ago
  The third approach, which Signal uses as a privacy preservation measure, is for the sender to generate the link preview on send. Of course, this then opens up abuse where the sender can arbitrarily control the "link preview" to say whatever they want.
ufmace 6y ago
Also considering the sibling story, at least the server-side preview builder is definitely entirely unauthenticated to every possible service. A preview builder running on the client side might conceivably pick up your authentication to something in various circumstances.

crazygringo 6y ago

I disagree completely, I find it extremely useful. Most links are unreadable (e.g. an ID to a cloud file), and are truncated anyways even if readable. The preview gives me the title of the webpage, which is infinitely more useful -- especially letting me know whether it's a document I've already seen (and don't need to open) or something new, and if so, what.

systemvoltage 6y ago
To me it pollutes the discussion away from the messages and puts a bunch of thumbnails where it could just be a clean text conversation. The thing that bothers me is also that I, as a user, have no choice - it just does it automatically. Do you like IRC?
- katbyte 6y ago
  this is one of those "people like different things" situations and a config option should be added to support both.
  - JadeNB 6y ago
    Slack, and I suspect most other messaging apps, has such a config option.
- occamrazor 6y ago
  Whatsapp allows to delete the link box: enter the link, wait for the preview, backspace, and send. The hyperlink remains clickable too.
  - shultays 6y ago
    Slack does it as well
- JadeNB 6y ago
  I suspect that most apps have a way to turn this off. Slack certainly does. That doesn't stop other users from seeing previews of your links, if it's set up that way for them, but it does prevent you from seeing previews of others' (and your own) links.

compiler-guy 6y ago

Part of the goal here is to prevent people from clicking on malicious links. A preview helps with that. Or, more simply, you can't be rickrolled if you know the destination in advance.

netsharc 6y ago
The next level would be for the server to see who is requesting content. Facebook IP? "Here's some harmless HTML!". Browser IP? "Here's an executable pretending to be a harmless page!"

mikece 6y ago

A funny story (well, funny because it didn't happen to me) was chronicled on a recent episode of Corey Quinn's "Whiteboard Confessions" -- https://www.lastweekinaws.com/podcast/aws-morning-brief/whiteboard-confessional-click-here-to-break-production/ https://www.lastweekinaws.com/podcast/aws-morning-brief/whit... -- where Slackbot's auto URL unfurling feature "clicked" an SNS alert unsubscribe link when a tech posted the a report including that link into a slack channel. If nobody lost their job over this triggering a SEV-1 alert I'm sure they had a laugh about it later. Another issue with auto-unfurling links or generating previews of URLs is the potential for stalking. If I'm hunting my ex and I know their cell phone number AND that they have an iPhone I can simply send a link to a website and let iOS generate the preview... which then pings the URL of the website which I set up and I can now run geo-IP resolution and narrow down where my ex is (and maybe I follow up with a well-crafted PDF exploit when I'm ready to narrow down even more on an area). While systemvoltage was a bit brusque in how the complaint was worded above, these "friendly and helpful" features of Slack, SMS, and other apps can have devastating unforeseen consequences. I question the value of having to opt out of these features instead of making them opt-in instead.

systemvoltage 6y ago
haha, wow. This is some story. Thanks for sharing.
crazygringo 6y ago
That's an interesting idea of a security breach. In practice it's going to be difficult because: 1) You can't do effective geolocation on cell phone IP address, except perhaps at a country level [1] 2) Your ex would need to open your message to trigger the link preview loading. If you're stalking them, they're probably either ignoring you or blocking you 3) At most, if the ex is connected to a Wi-Fi network like Starbucks and opens the message, you'll be able to get the city they're in, maybe. But at the end of the day, what you'd get from link previews is no different from embedding a tracker image in an e-mail. And while it requires someone to suspect they're being stalked, blocking would prevent all of this. [1] http://www.cs.yale.edu/homes/mahesh/papers/ephemera-imc09.pdf http://www.cs.yale.edu/homes/mahesh/papers/ephemera-imc09.pd...
6y ago