4 ms·

Tell HN: Exercise caution with links to archive sites

29 points by hericium 5y ago

Some users comment on posts with links to various archiving sites containing copies of linked article. This is obviously welcome when linked article is a garden / behind paywall but often the article is perfectly readable with JS disabled and archive site requires running Google's, Cloudflare's JS code or worse. Some archive sites - like archive.ph - attempt to run malicious code on viewers' devices. It seems that archive.ph's copies of various articles[1] all attempt to run at least a script from mail.ru domain that appears[2] to "harvest data from the page (references to "gender", "age", etc) and some shady-named variables like "bait". Also a function that fetches data from top-fwz1.mail.ru and then tries to submit a hidden 1px*1px form created in an iframe using this data (...)" [1] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=archive.ph&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... [2] https://news.ycombinator.com/item?id=30669851 https://news.ycombinator.com/item?id=30669851

jacquesm 5y ago
Indeed. There are a couple of users that provide these as a service to the community but there are also users who seem to be pushing predominantly malicious sites without ever contributing in any other way. Personally I would rather see all those archive links gone because they have the exact same problems that link shorteners did, even if they are benign today they could easily turn malicious tomorrow.
forgotpwd16 5y ago
That's strange. The archive.ph is another URL for archive.today, a well-known archive service[0]. Could it be it has been compromised? [0]: https://en.wikipedia.org/wiki/Archive.today https://en.wikipedia.org/wiki/Archive.today
- perihelions 5y ago
  It's been affiliated with mail.ru analytics for years: https://news.ycombinator.com/item?id=23316085 https://news.ycombinator.com/item?id=23316085 ("Ask HN: Who owns archive.is, and why are they trustworthy?") (2020)
  - forgotpwd16 5y ago
    What found strange is the malicious part as thought to mean some exploiting code exists. Is it that or just analytics?
    - rosndo 5y ago
      It’s just regular analytics, not different than Google Analytics. OP is just a russophobic asshole.
perihelions 5y ago
Archive.is mirrors have been linked north of 15,000 times on HN over 9 years [0]. (Archive.is is the more popular URL for the same [1] service). I'm skeptical that actually-malicious behavior would have gone unnoticed for so long, on this site of all places. Unless your position is all intrusive analytics scripts are "malware" -- in which case I philosophically agree, but it's futile. [0] https://hn.algolia.com/?query=archive.is&type=comment https://hn.algolia.com/?query=archive.is&type=comment (note Algolia's exact # is nondeterministic and changes on refresh) [1] https://en.wikipedia.org/wiki/Archive.today https://en.wikipedia.org/wiki/Archive.today (Full disclosure: I've linked many of these myself).
- hericium 5y ago
  Last time I checked, archive.is required JS and was showing a page imitating Cloudflare's but using reCaptcha. I actually got downvoted after pointing out that archive.is requires JS when linked article can be read with no JS.
uwu 5y ago
the top-fwz1 script is mail.ru's statistics counter https://top.mail.ru/help/en/rating https://top.mail.ru/help/en/rating > Top Mail.Ru is a statistics system for site owners. You need to get and install the counter code on the pages of your site to collect data. you can see the same code snippet that's on archive.ph here: https://top.mail.ru/help/en/code/receive https://top.mail.ru/help/en/code/receive
jitl 5y ago
Wowee, Websites on the Internet using JavaScript and Tracking Pixels to Record Everything We Do! This is the first time I’m hearing about it (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=Analytics%20privacy&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...). I certainly don’t have any counter measures available to block these activities from happening on my computer (uBlock Origin and similar tools can block these requests). I wonder how common this is (An estimated 55% of all sites on the internet use Google Analytics)?

29 points by hericium 5y ago

jacquesm 5y ago

Indeed. There are a couple of users that provide these as a service to the community but there are also users who seem to be pushing predominantly malicious sites without ever contributing in any other way. Personally I would rather see all those archive links gone because they have the exact same problems that link shorteners did, even if they are benign today they could easily turn malicious tomorrow.

forgotpwd16 5y ago

That's strange. The archive.ph is another URL for archive.today, a well-known archive service[0]. Could it be it has been compromised? [0]: https://en.wikipedia.org/wiki/Archive.today https://en.wikipedia.org/wiki/Archive.today

perihelions 5y ago
It's been affiliated with mail.ru analytics for years: https://news.ycombinator.com/item?id=23316085 https://news.ycombinator.com/item?id=23316085 ("Ask HN: Who owns archive.is, and why are they trustworthy?") (2020)
- forgotpwd16 5y ago
  What found strange is the malicious part as thought to mean some exploiting code exists. Is it that or just analytics?
  - rosndo 5y ago
    It’s just regular analytics, not different than Google Analytics. OP is just a russophobic asshole.

perihelions 5y ago

Archive.is mirrors have been linked north of 15,000 times on HN over 9 years [0]. (Archive.is is the more popular URL for the same [1] service). I'm skeptical that actually-malicious behavior would have gone unnoticed for so long, on this site of all places. Unless your position is all intrusive analytics scripts are "malware" -- in which case I philosophically agree, but it's futile. [0] https://hn.algolia.com/?query=archive.is&type=comment https://hn.algolia.com/?query=archive.is&type=comment (note Algolia's exact # is nondeterministic and changes on refresh) [1] https://en.wikipedia.org/wiki/Archive.today https://en.wikipedia.org/wiki/Archive.today (Full disclosure: I've linked many of these myself).

hericium 5y ago
Last time I checked, archive.is required JS and was showing a page imitating Cloudflare's but using reCaptcha. I actually got downvoted after pointing out that archive.is requires JS when linked article can be read with no JS.

uwu 5y ago

the top-fwz1 script is mail.ru's statistics counter https://top.mail.ru/help/en/rating https://top.mail.ru/help/en/rating > Top Mail.Ru is a statistics system for site owners. You need to get and install the counter code on the pages of your site to collect data. you can see the same code snippet that's on archive.ph here: https://top.mail.ru/help/en/code/receive https://top.mail.ru/help/en/code/receive

jitl 5y ago

Wowee, Websites on the Internet using JavaScript and Tracking Pixels to Record Everything We Do! This is the first time I’m hearing about it (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=Analytics%20privacy&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...). I certainly don’t have any counter measures available to block these activities from happening on my computer (uBlock Origin and similar tools can block these requests). I wonder how common this is (An estimated 55% of all sites on the internet use Google Analytics)?