10 ms·
A URL shortener not shortening the URL but makes it look very dodgy
- WantonQuantum 4y agohttp://not.verylegit.link/WP;tRQAfOE6661trojan+mobiads(.jar.dmg.pdf http://not.verylegit.link/WP;tRQAfOE6661trojan+mobiads(.jar....
- miguelmurca 4y agoHaha, Malware Bytes hates that link
- lucakiebel 4y ago„Turns out this site is powered by money. We ran out of Google App Engine credit. Fear not, we'll get more within 24 hours.“
- tnzk 4y agoI got the same and thought it was the feature and I was about to be charged.
- sshine 4y agoForgive my old-fashioned-ness, but... Why is metered cloud hosting a better choice here than a $5/mo. VPS?
- rubyfan 4y agobetter for who? ;-)
- esskay 4y agoIn 99% of cases its not, people just mistakenly think they need a 'cloud' provider for everything these days.
- capableweb 4y agoFor real. I once worked with a non-IT company who just had one junior developer responsible for everything IT, including websites and their management. When I asked why they don't run everything on some dedicated instance with X GB included in the plan instead of fancy bandwidth pricing so they have static sums to pay each month (reason I was pulled into the project was to decrease spending which increased each month as traffic increased), the person said something akin to "What? How? I didn't know you could even do that"
- esskay 4y agoHad a similar thing at my place. We spend extortionate amounts on AWS for a load balanced setup - we dont make any real use of any of their other services so its not like we're reliant on them for everything. The guy who set it up had (and really still has) no clue that you can get just as reliable setup at a fraction of the cost using a few bare metal servers. Of course when I suggested that we use a huge provider (I think it was probably Hetzner) it was shrugged off as being a bad idea because "they probably run them out of their garage", ignoring the multiple datacenters spread out across Europe where our primary clients are based.
- vbezhenar 4y agoBecause credit is free and $5 is not free, I guess.
- the_other 4y ago"£Free" is rarely £0. It usually means "£you do some of the work yourself and we indirectly profit due to metrics/economies of scale/network effects/data/kudos".
- jeroenhd 4y agoI don't think that's the trick at all. Running up bills will only make people leave for other services once their business does get money flowing. Instead, I believe the reason cloud companies give away free stuff is the same reason Microsoft will give away Windows upgrades to students: if their weird, proprietary API is all you learn, you'll only be able to get started quickly on their platform so the moment you need to pick tech for a small business/your startup, you'll be quicker to choose their service. There's a reason AWS Lambda (and Azure's competitor) is free but OpenStack/vSphere providers expect you to pay off the bat: if your workload and knowledge transfer (relatively) easily, there's no lock-in with which to trick people into choosing you.
- blagie 4y agoPersonally, for long-running things, metered cloud has two upsides: - IaaS, static hosting, etc. can maintain security updates on their end. My own VPS will eventually be broken into if I don't maintain security updates. - Many things are accessed only intermittently. For low access patterns, it's cheaper to pay for what you use. What I'd really like is something like Heroku, Amazon Lambda, or similar, but with an open, competitive ecosystem, and without vendor lock-in.
- jeroenhd 4y agoI don't use these services because I've seen the prices Amazon asks for a gigabyte of traffic but I think you'll have to have VERY intermittent access to make these scaling providers worth the money. If you expect your website to one day go from 100 requests a month to a million a day and expect that traffic to continue from that point on, these services will be a huge benefit for uptime while you rework your code to a more reasonable system. However, a simple $10 VPS with Nginx can handle much more than people seem to expect, assuming you don't use some excessively bloated platform or your content can be cached. In terms of security updates: a cron job to reboot weekly and unattended-upgrades will keep your server safe without much to look into. Your only risk will be end of life software, your own code, and your dependencies, but those aren't fixed by going with some managed platform either. There are definitely upsides to these quick deploy tools if you want to iterate quickly with an API that's not accessible from your dev workstation, setting up a multi tenant K8s/Docker/whatever server to deploy to is much harder than giving devs API keys to push to external parties, but I wouldn't consider these services for 99% of the stuff I would deploy.
- blagie 4y ago"Very intermittent access" is the use-case for most things I build. There's a short tail -- I've built a platform you've heard of and, given this is HN, more likely than not, used. Then there's a long tail: - Home automation - Municipal / school / community sites - Personal web page - Various internal automation within my organization ... and so on. These are things which: 1. Require very simple technology (E.g. storing data in a small key-value store is more than good enough) 2. Should work for the next decade or three with no maintenance 3. Expect to be accessed maybe a couple of times a day, if I'm lucky, and probably much less 4. Most will never scale to gigabytes of data, ever
- moffkalast 4y ago> $5/mo. VPS I think you may even get 256 megs of ram for that these days.
- MayeulC 4y ago1 GB, and 20 GB disk, at OVH. With unlimited bandwidth. Here though, that service could be hosted on a static website (free at github/gitlab/cloudfare/etc), with client-side javascript used to decode data encoded in the url fragment.
- moffkalast 4y agoHmm interesting, haven't heard of those yet. Though seems like I was a bit off, DigitalOcean has a 512MB instance for $4 and Scaleway a 2 GB one for $6.5. But then again Scaleway will also nickle and dime you separately for the IP, the HDD and anything else that they can possibly think of.
- MayeulC 4y agoHmm, I just double-checked OVH's VPS offers and actually, it's 2GB RAM, 20GB disk, 1vcore, unlimited 100Mbps for €3.5/month (€4.20 with VAT). That's their "starter" offer.
- Alupis 4y agoFor $2.50 you can get 1 vCPU, 512MB RAM, 500GB bandwidth, and 10GB storage from Vultr[1]. The only catch is it's IPv6 only, you have to add an extra dollar monthly to get an IPv4 address ($3.50). For $5.00, you get 1GB of RAM, 1TB of bandwidth, 25GB of storage, and an IPv4 address. Not bad... [1] https://www.vultr.com/pricing/ https://www.vultr.com/pricing/
- account42 4y agoHow does it cost them less to serve a HTML page with an image instead of compared to a simple database lookup and HTTP redirect?
- deleted 4y ago[deleted]
- caporaltito 4y agoFinally, something useful posted here
- ohadron 4y agoNicely demonstrates why outsourcing link shorteners is risky - they go out of business and your link is dead.
- vlan121 4y agoInfact this is a problem that we'll face someday.
- comprev 4y agovb.ly is an example of this happening. https://www.theguardian.com/technology/2010/oct/08/bitly-libya https://www.theguardian.com/technology/2010/oct/08/bitly-lib...
- neilv 4y agoThis was predicted and warned about when the link shorteners first appeared, decades ago. But people keep using them (for a while for Twitter, but maybe mainly for analytics, though they could self-host and accomplish the same thing).
- eythian 4y agoThere is an archiveteam project to index all the shorteners and where they direct to. I think it's the default project if you're running the warrior and there's nothing more important going on. https://wiki.archiveteam.org/index.php?title=URLTeam https://wiki.archiveteam.org/index.php?title=URLTeam
- deleted 4y ago[deleted]
- fredley 4y agoMy goto for this purpose used to be https://shadyurl.com https://shadyurl.com but sadly it seems like it's gone, so glad to have a replacement!
- josefresco 4y agoI blogged about ShadyURL in March of 2022 so it hasn't been gone for long! Bummer.
- Semaphor 4y agoThis service: > Turns out this site is powered by money. We ran out of Google App Engine credit. Fear not, we'll get more within 24 hours. > In the meantime, you can use www.shadyurl.com for all your dodgy URL needs. So it might just be that they went down today.
- itslennysfault 4y agoThis is actually source code for ShadyUrl. It's linked at the bottom of the readme. Also, this repo hasn't been updated in 5+ years.
- zikohh 4y agoI don't think it is. It says it's inspired by shadyurl and includes some more spicy features.
- nkozyra 4y agoAh yes, the URL worsener
- fareesh 4y agoy tho
- Towaway69 4y agoy not
- punkspider 4y agoI also recommend the developer's blog. Very detailed and hilarious articles https://mango.pdf.zone/ https://mango.pdf.zone/ I laughed myself to tears reading Operation Luigi: How I hacked my friend without her noticing[1] 1: https://mango.pdf.zone/operation-luigi-how-i-hacked-my-friend-without-her-noticing
- japanman425 4y agoVery good read, content is that of any 14yo in a room with a computer in the early 2000s. Very nostalgic.
- MrGilbert 4y agoI just read the Abbott-Qantas-Story. It's lovely.^^
- thisOtterBeGood 4y agoThe Tony Abbott story has been on hacker news before. It's so funny.
- deleted 4y ago[deleted]
- agentwiggles 4y agoThat was awesome, thanks for sharing. Crazy how easy it can be to get into someone's life!
- kinduff 4y agoSuch a good blog post, had a blast reading it. Thanks for sharing this!
- daneel_w 4y agoDo-gooder AV suites with browser integration are gonna have a field day with this.
- amelius 4y agoNow I can train my colleagues and friends and family to click on dodgy links.
- ryandrake 4y agoNo training needed. That ship has sailed. You could call the link click-here-and-you-will-get-scammed.com/drain/my/bank/account.asp and your colleagues, friends, and family will all click it.
- anshumankmr 4y agoThis is horrible. I love it.
- voytec 4y agoAwful. I like it.
- awesomelvin 4y agoI have a similar website called http://clickhere.lol http://clickhere.lol (yes, the missing ssl is intentional). Has a weak server though..
- giancarlostoro 4y agoI enjoyed the link to your Geocities throwback page: https://marvinborner.de/cool.html https://marvinborner.de/cool.html
- WaffleIronMaker 4y agoThis website seems to be much more reliable! Thanks for sharing.
- dizhn 4y agoThe url it generates is fantastic. It didn't work when putting into the address bar.
- awesomelvin 4y agoHmm weird. Did you click confirm?
- dizhn 4y agoNope. That did it. Thanks.
- sfmike 4y agoquestion besides the lols whats a good use case for this
- ricardobayes 4y agoPretty useful for security awareness training
- AndrewOMartin 4y agoI would consider this innovative, but Office365 has had this built in (and as far as I can tell impossible to turn off) for years. What used to be a sensible link turns into a vast "safe link honest, guv" mess. I call it "man in the middle attack as a service"
- patentatt 4y agoSame with PayPal. I've received perfectly valid emails direct from PayPal that include random sketchy links from third parties that are obvious phishing expeditions. I reported it to PayPal, but the ability still exists.
- 411111111111111 4y agoThat's inherent to features that allow user generated content, which is obviously mandatory in the context of PayPals invoicing feature. The only reason why companies don't care about it in the context of mail is because there is no equivalent to safe browsing for mails, so Domains aren't penalized by Google for sending fraudulent messages at small scale. If this was to change, they'd all pivot to using secondary domains for these mails, like GitHub does for GitHub pages. It would also be a pretty pointless feature as you'd probably complain anyway, as the email would still come from a Paypal owned domain. On the same topic: if you've got a Gmail address you're also able to send from @googlemail.com Is this another security issue in your opinion?
- patentatt 4y agoHow about disallowing urls or even just vetting urls in the messages sent from your own service? One of the ones I received was a link to a fake PayPal login that was something along the of lines of (making this up) http://login.PayPal.com.somethingsketchy.biz/login.php http://login.PayPal.com.somethingsketchy.biz/login.php and was a replica of the PayPal login screen. It was pretty blatant. Seems like they should figure out a way to avoid that is all, because I know my mother would have put in her PayPal credentials to that site and I'd be hard pressed to fault her for it. We train users to check if it's a valid/real email before clicking on links and this was a perfectly real email sent from PayPal with a malicious link. This seems like PayPal's responsibility to me. I'm shocked they don't care about this.
- distantsounds 4y agonot only is this useless but it's been done at least half a dozen times already in the past 2 decades
- layer8 4y agoI would have used honestachmed.link. (https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959)
- hcaz 4y agoThe url shortener I build years ago had a feature for this called 'sketchy' urls - https://duct.me/ https://duct.me/
- easrng 4y agoShould've supported ab.duct.me as a domain.
- timmywil 4y agoThis is old, but I guess it didn’t get as much attention when it was posted in 2017.
- grapesurgeon 4y ago[dead]
- dukoid 4y agoSince the URL is not getting shorter, the original could just be encoded in the generated URL -- there isn't really any need to store anything
- T3RMINATED 4y ago[dead]
- mrweasel 4y agoEven the repo URL looks dodgy: https://github.com/defaultnamehere/verylegit.link https://github.com/defaultnamehere/verylegit.link
- edpichler 4y agoIt is funny, but what are the use cases?
- elonmusk11 4y ago[flagged]
- WaffleIronMaker 4y ago> https://irc.verylegit.link/3R~.QuJR_Do%3ELR;og122virus)javaexploit.js.docm https://irc.verylegit.link/3R~.QuJR_Do%3ELR;og122virus)javae... > Turns out this site is powered by money. We ran out of Google App Engine credit. Fear not, we'll get more within 24 hours. Looks like links are not viewable right now.
- AviationAtom 4y agoLooks like the PoC got the hug of death? I was looking forward to trolling my IT security coworkers with it.
- geekrax 4y agoThis is harmless evil and I absolutely love it!
- tpoacher 4y ago... but, why?
- CobrastanJorji 4y agoIt's beautiful!
- jhoechtl 4y agoThis is such a bad idea without any practical use. Why does it exist?