4 ms·

How much of a burden could this really be? The nature of something like this is that the cost to run it naturally goes down over time. Old links get clicked l

How much of a burden could this really be? The nature of something like this is that the cost to run it naturally goes down over time. Old links get clicked less so the hardware costs would be basically nothing. As for the actual software security, it's a URL shortener. They could rewrite the entire thing in almost no time with just a single dev. Especially since it's strictly hosting static links at this point. It probably took them more time and money to find inactive links than it'd take to keep the entire thing running for a couple of years.

londons_explore 1y ago
I think the concern is someone might scan all the inactive links and find that some of them link to secret URL's, leak design details about how things are built, link to documents shared 'anyone with the link' permission, etc.
- cogman10 1y ago
  > I think the concern is someone might scan all the inactive links How? Barring a database leak I don't see a way for someone to simply scan all the links. Putting something like Cloudflare in front of the shortener with a rate limit would prevent brute force scanning. I assume google semi-competently made the shortener (using a random number generator) which would make it pretty hard to find links in the first place. Removing inactive links also doesn't solve this problem. You can still have active links to secret docs.
  - bapak 1y ago
    > You can still have active links to secret docs. If they're have a (passwordless) URL they're not secret.
  - londons_explore 1y ago
    To make the URLs actually short, you need to use most/all of the keyspace. Back when it was made, shorteners were competing to see who could make the shortest URL, so I bet a brute force scan would find everything.
simonw 1y ago
"How much of a burden could this really be?" My understanding from conversations I've seen about Google Reader is that the problem with Google is that every few years they have a new wave of infrastructure, which necessitates upgrading a bunch of things about all of their products. I guess that might be things like some new version of BigTable or whatever coming along, so you need to migrate everything from the previous versions. If a product has an active team maintaining it they can handle the upgrade. If a product has no team assigned there's nobody to do that work.
- rohit89 1y ago
  > If a product has no team assigned there's nobody to do that work. This seems like a good eval case for autonomous coding agents.
- stouset 1y ago
  And you could assign somebody to do that work, but who wants to be employed as the maintainer of a dead product? It’s a career dead-end.
- chrisjj 1y ago
  > I guess that might be things like some new version of BigTable or whatever coming along, so you need to migrate everything from the previous versions. Arrival of new does not neccessitate migration. Only departure of old does.
  - pavel_lishin 1y ago
    But if you don't downgrade the old, then you're endlessly supporting systems, forever. At some point, it does become cheaper to migrate everything to the new.
  - mbac32768 1y ago
    They deprecate internal infrastructure stuff zealously and tell teams they need to be off of such and such by this date. But it's worse than that because they'll bring up whole new datacenters without ever bringing the deprecated service up, and they also retire datacenters with some regularity. So if you run a service that depends on deprecated services you could quickly find yourself in a situation where you have to migrate to maintain N+2 redundancy but there's hardly any datacenter with capacity available in the deprecated service you depend on. Also, how many man years of engineering do you want to spend on keeping goo.gl running. If you were an engineer would you want to be assigned this project? What are you going to put in your perf packet? "Spent 6 months of my time and also bothered engineers in other teams to keep this service that makes us no money running"?
sumeno 1y ago
> How much of a burden could this really be? You know how Google deprecating stuff externally is a (deserved) meme? Things get deprecated internally even more frequently and someone has to migrate to the new thing. It's a huge pain in the ass to keep up with for teams that are fully funded. If something doesn't have a team dedicated to it eventually someone will decide it's no longer worth that burden and shut it down instead.
saagarjha 1y ago
I assume the general problem is people using these links for bad purposes and having to deal with needing to moderate them.

londons_explore 1y ago

I think the concern is someone might scan all the inactive links and find that some of them link to secret URL's, leak design details about how things are built, link to documents shared 'anyone with the link' permission, etc.

cogman10 1y ago
> I think the concern is someone might scan all the inactive links How? Barring a database leak I don't see a way for someone to simply scan all the links. Putting something like Cloudflare in front of the shortener with a rate limit would prevent brute force scanning. I assume google semi-competently made the shortener (using a random number generator) which would make it pretty hard to find links in the first place. Removing inactive links also doesn't solve this problem. You can still have active links to secret docs.
- bapak 1y ago
  > You can still have active links to secret docs. If they're have a (passwordless) URL they're not secret.
- londons_explore 1y ago
  To make the URLs actually short, you need to use most/all of the keyspace. Back when it was made, shorteners were competing to see who could make the shortest URL, so I bet a brute force scan would find everything.

simonw 1y ago

"How much of a burden could this really be?" My understanding from conversations I've seen about Google Reader is that the problem with Google is that every few years they have a new wave of infrastructure, which necessitates upgrading a bunch of things about all of their products. I guess that might be things like some new version of BigTable or whatever coming along, so you need to migrate everything from the previous versions. If a product has an active team maintaining it they can handle the upgrade. If a product has no team assigned there's nobody to do that work.

rohit89 1y ago
> If a product has no team assigned there's nobody to do that work. This seems like a good eval case for autonomous coding agents.
stouset 1y ago
And you could assign somebody to do that work, but who wants to be employed as the maintainer of a dead product? It’s a career dead-end.
chrisjj 1y ago
> I guess that might be things like some new version of BigTable or whatever coming along, so you need to migrate everything from the previous versions. Arrival of new does not neccessitate migration. Only departure of old does.
- pavel_lishin 1y ago
  But if you don't downgrade the old, then you're endlessly supporting systems, forever. At some point, it does become cheaper to migrate everything to the new.
- mbac32768 1y ago
  They deprecate internal infrastructure stuff zealously and tell teams they need to be off of such and such by this date. But it's worse than that because they'll bring up whole new datacenters without ever bringing the deprecated service up, and they also retire datacenters with some regularity. So if you run a service that depends on deprecated services you could quickly find yourself in a situation where you have to migrate to maintain N+2 redundancy but there's hardly any datacenter with capacity available in the deprecated service you depend on. Also, how many man years of engineering do you want to spend on keeping goo.gl running. If you were an engineer would you want to be assigned this project? What are you going to put in your perf packet? "Spent 6 months of my time and also bothered engineers in other teams to keep this service that makes us no money running"?

sumeno 1y ago

> How much of a burden could this really be? You know how Google deprecating stuff externally is a (deserved) meme? Things get deprecated internally even more frequently and someone has to migrate to the new thing. It's a huge pain in the ass to keep up with for teams that are fully funded. If something doesn't have a team dedicated to it eventually someone will decide it's no longer worth that burden and shut it down instead.

saagarjha 1y ago

I assume the general problem is people using these links for bad purposes and having to deal with needing to moderate them.