2 ms·

If it's just a redirect, isn't it going to be bypassed as soon as the first user shares the real URL?

by solardev 2y ago

hosteur 2y ago
That was my thought as well. Not sure what the actual value is here.
- sigmoid10 2y ago
  Especially since links can already be pretty private by default if they are random enough and not shared on any site where a crawler can access them. If you want actual security, you need to protect content on your end. If you don't really care and just don't want it publicly indexed, share it privately and keep it off the surface web.
n_ary 2y ago
I suppose it is the same concept as gumroad vendors. Most of them simply put an s3 url behind the gumroad paywall. Once you are done buying, the s3 url can be shared with anyone.
- solardev 2y ago
  I think the S3 URLs typically expire after a bit, at which point a new one would have to be generated the next time you need to re-download.
  - n_ary 2y ago
    True, but most stuff I bought from gumroad, url never expires. Guess, we tech folks are conditioned to think too much into basics that non-tech folks don’t think about.
jszymborski 2y ago
I ran a similar service when In was in high school. People were using it to distribute links in public settings that were meant for small circle of folks. Lots of club newsletters were distributed this way. People also used it for selling files and things but as you've said it was trivial to defeat and only filtered out the least technical folks. It was surprisingly popular.
- mmanfrin 2y ago
  I, too, ran a similar service in high school. It also got weirdly popular, and then spammers started using it and the FBI sent a shutdown notice to my server provider while I was working at a summer camp (with no internet access) and all my sites got taken down for a week :(
  - jszymborski 2y ago
    I shut down for similar concerns (phishing/spam), albeit before law enforcement required me to. I would certainly be running URLs through block lists, with a Report Abuse system if I were doing this today.
graypegg 2y ago
I guess since you’re going to have to give a password to someone, you can tell them not to do that. Though I’m a bit confused why this is even needed. The sort of thing most people want accessible via a link, but only for certain people, tend to already have unpredictable URLs. I’m not sure how https://gaggledocs.com/documents/aboevdowugwhoaofh https://gaggledocs.com/documents/aboevdowugwhoaofh Is different from https://protectmylink.xyz/owndoavwyagdo https://protectmylink.xyz/owndoavwyagdo + a password Especially when the original url is still publicly accessible on the internet. Additionally, you normally have much better authorization options in the app you’re linking to. I guess you get the benefit of a changeable link, unlike the canonical one? But then a link shortener is almost enough already.
- 8organicbits 2y ago
  Don't combine link shorteners with unguessable URLs, the result is a guessable URL.
deleted 2y ago
[deleted]

If it's just a redirect, isn't it going to be bypassed as soon as the first user shares the real URL?

hosteur 2y ago

That was my thought as well. Not sure what the actual value is here.

sigmoid10 2y ago
Especially since links can already be pretty private by default if they are random enough and not shared on any site where a crawler can access them. If you want actual security, you need to protect content on your end. If you don't really care and just don't want it publicly indexed, share it privately and keep it off the surface web.

n_ary 2y ago

I suppose it is the same concept as gumroad vendors. Most of them simply put an s3 url behind the gumroad paywall. Once you are done buying, the s3 url can be shared with anyone.

solardev 2y ago
I think the S3 URLs typically expire after a bit, at which point a new one would have to be generated the next time you need to re-download.
- n_ary 2y ago
  True, but most stuff I bought from gumroad, url never expires. Guess, we tech folks are conditioned to think too much into basics that non-tech folks don’t think about.

jszymborski 2y ago

I ran a similar service when In was in high school. People were using it to distribute links in public settings that were meant for small circle of folks. Lots of club newsletters were distributed this way. People also used it for selling files and things but as you've said it was trivial to defeat and only filtered out the least technical folks. It was surprisingly popular.

mmanfrin 2y ago
I, too, ran a similar service in high school. It also got weirdly popular, and then spammers started using it and the FBI sent a shutdown notice to my server provider while I was working at a summer camp (with no internet access) and all my sites got taken down for a week :(
- jszymborski 2y ago
  I shut down for similar concerns (phishing/spam), albeit before law enforcement required me to. I would certainly be running URLs through block lists, with a Report Abuse system if I were doing this today.

graypegg 2y ago

I guess since you’re going to have to give a password to someone, you can tell them not to do that. Though I’m a bit confused why this is even needed. The sort of thing most people want accessible via a link, but only for certain people, tend to already have unpredictable URLs. I’m not sure how https://gaggledocs.com/documents/aboevdowugwhoaofh https://gaggledocs.com/documents/aboevdowugwhoaofh Is different from https://protectmylink.xyz/owndoavwyagdo https://protectmylink.xyz/owndoavwyagdo + a password Especially when the original url is still publicly accessible on the internet. Additionally, you normally have much better authorization options in the app you’re linking to. I guess you get the benefit of a changeable link, unlike the canonical one? But then a link shortener is almost enough already.

8organicbits 2y ago
Don't combine link shorteners with unguessable URLs, the result is a guessable URL.

deleted 2y ago

[deleted]