4 ms·

Yes, it's hard to give the poster benefit of the doubt. I haven't run https://top-fwz1.mail.ru/js/code.js https://top-fwz1.mail.ru/js/code.js myself but a quic

Yes, it's hard to give the poster benefit of the doubt. I haven't run https://top-fwz1.mail.ru/js/code.js https://top-fwz1.mail.ru/js/code.js myself but a quick glance at it seems to indicate that it tries to harvest data from the page (references to "gender", "age", etc) and some shady-named variables like "bait". Also a function that fetches data from top-fwz1.mail.ru and then tries to submit a hidden 1px*1px form created in an iframe using this data and who knows what else. All other archive.ph links from the poster seem to contain the same JS code from mail.ru, which makes it either doubly suspicious, or just means their computer or network is infected with something that injects it into their pages, who knows.

hericium 5y ago
Thanks - nice quick research. I have flagged this user's recent submissions containing his comments with links to archive.ph.
- seszett 5y ago
  See my other comment though, it seems like the injection is performed by archive.ph itself. I tried to archive simply my own blog (a very simple page without any JS) and the script gets injected there as well. So it might just be a coincidence that mitchbob happens to be the one who posted a link where that script gets noticed. It's hard to know for sure of course.
  - hericium 5y ago
    I've seen it and only flagged posts with [comments by the same author with links to] malicious content. It doesn't matter whether user is affiliated with this content's host or phishing campaign since this is most of his HN activity. This should stop even if is unintentional.
    - pvg 5y ago
      If you think someone's doing something wrong, email the mods. You can't be starting some innuendo campaign and vote brigading against some user just because you have a bad feeling about their posts, that's in the guidelines.
      - hericium 5y ago
        I've flagged malicious content and don't consider this brigading. When I saw that this isn't a problem with a single account, I made a Tell HN[1] 20 minutes ago to tell both mods and the community to exercise caution. [1] https://news.ycombinator.com/item?id=30670319 https://news.ycombinator.com/item?id=30670319
        pvg 5y ago
        Again, if you think someone is doing something wrong, do what the guidelines tell you and email the mods. Same goes for voting stuff. Tell HN doesn't tell the mods anything, they don't see every post and comment.
- dang 5y ago
  archive.is and its variants have been a popular way to link to archived articles on HN, and elsewhere, for years now. There's no reason to believe that mitchbob was doing anything other than trying to be helpful to users. Tons of legit HN users do that. Let's not pick on one to make a witch out of.
rosndo 5y ago
Fuck, have you never seen an analytics script before? >All other archive.ph links from the poster seem to contain the same JS code from mail.ru, which makes it either doubly suspicious, or just means their computer or network is infected with something that injects it into their pages, who knows. This is top.mail.ru, a very common analytics platform not different from google analytics. Archive.today uses it. What’s the purpose of this witch hunt? Xenophobic bullshit over the .ru TLD?

hericium 5y ago

Thanks - nice quick research. I have flagged this user's recent submissions containing his comments with links to archive.ph.

seszett 5y ago
See my other comment though, it seems like the injection is performed by archive.ph itself. I tried to archive simply my own blog (a very simple page without any JS) and the script gets injected there as well. So it might just be a coincidence that mitchbob happens to be the one who posted a link where that script gets noticed. It's hard to know for sure of course.
- hericium 5y ago
  I've seen it and only flagged posts with [comments by the same author with links to] malicious content. It doesn't matter whether user is affiliated with this content's host or phishing campaign since this is most of his HN activity. This should stop even if is unintentional.
  - pvg 5y ago
    If you think someone's doing something wrong, email the mods. You can't be starting some innuendo campaign and vote brigading against some user just because you have a bad feeling about their posts, that's in the guidelines.
    - hericium 5y ago
      I've flagged malicious content and don't consider this brigading. When I saw that this isn't a problem with a single account, I made a Tell HN[1] 20 minutes ago to tell both mods and the community to exercise caution. [1] https://news.ycombinator.com/item?id=30670319 https://news.ycombinator.com/item?id=30670319
      - pvg 5y ago
        Again, if you think someone is doing something wrong, do what the guidelines tell you and email the mods. Same goes for voting stuff. Tell HN doesn't tell the mods anything, they don't see every post and comment.
dang 5y ago
archive.is and its variants have been a popular way to link to archived articles on HN, and elsewhere, for years now. There's no reason to believe that mitchbob was doing anything other than trying to be helpful to users. Tons of legit HN users do that. Let's not pick on one to make a witch out of.

rosndo 5y ago

Fuck, have you never seen an analytics script before? >All other archive.ph links from the poster seem to contain the same JS code from mail.ru, which makes it either doubly suspicious, or just means their computer or network is infected with something that injects it into their pages, who knows. This is top.mail.ru, a very common analytics platform not different from google analytics. Archive.today uses it. What’s the purpose of this witch hunt? Xenophobic bullshit over the .ru TLD?