4 ms·

Considering a URL shortener is basically a KV data store, why? It's an insanely low amount of code to maintain a URL shortener.

morkalork 1y ago
I remember there was a blog by someone who implemented their own url-shortener and it turned into a huge amount of work fighting spam, scams and malicious actors abusing the system to the point of their domain was being threatened with blacklisting. But then again, if anyone has the transferable skills to handle that, it would be google since they're already battling the same bad people on all their other services.
- kentonv 1y ago
  But those problems all went away six years ago when Google stopped accepting new links.
  - Maxion 1y ago
    URLs rot, domains expire. So I don't think the problem went away completely.
  - jsploit 1y ago
    It's still being abused by people registering expired domains.
    - morkalork 1y ago
      Exactly, there is no guarantee that what a shortened url pointed to 10 years ago is the same as today, or even the same owner or administrator.
      - kentonv 1y ago
        OK but the same vulnerability exists if short URLs weren't used -- in that case the link source would link directly to the now-hijacked domain. So why does Google have to care about this? Is it because they're worried that the domain name goo.gl in the link implies a Google endorsement? Seems like they should have thought of that before launching the service in the first place? Still, the frequency of actual abuse must be low and going down over time (due to the data set being read-only since 2019 and actual traffic to these links surely decreasing as time goes on)...
  - deleted 1y ago
    [deleted]
pimlottc 1y ago
Because maintaining it will not get anyone a promotion
kentonv 1y ago
Yes, particularly when considering they stopped accepting new links six years ago. It's a read-only data set and the total storage backing it is probably trivial by Google standards. But they actually backtracked and said they'll keep the "active" links working. Why even spend the effort to remove the "inactive" links? They must feel they represent some sort of liability? Or would it have been too embarrassing to just cancel the whole turn-down plan?
- olejorgenb 1y ago
  I'm not sure if this is the definition of "active" the have used, but: <quote> Over time, these existing URLs saw less and less traffic as the years went on - in fact more than 99% of them had no activity in the last month.</quote> I'm sure it's correct that the wast majority of links would never be used again, but to gauge which links this is I'd say you should measure at LEAST a year.
rsync 1y ago
I run a public URL shorter and you are correct: it is relatively simple and inexpensive to operate and there is no reason it can’t continue operating into the indefinite future. I disagree with the op on one major point… They suggest that the proper way for a service like this to operate is with a public database of links… However, when I think of all of the different ways, one might use a shorter, it seems obvious that many links would necessarily be sensitive and/or private. Therefore, I consider myself to have a dual mandate: privacy of the links created, and a duty, that I have assumed, of running the service for decades.
- jszymborski 1y ago
  I think that's fair. 301works.org[0], for example, requires its members to upload their DB to Internet Archive, but IA keeps it private. They then ask for the technical control of the domain to be transferred 301works.org in the event of the site's closure so they can continue serving the traffic. I do think that, however, that a service can keep their DB public _iff_ users know that's the case before creating links. Often times, folks are just shortening public links, but it is true that people sometimes share "private" links (e.g., Google Doc private links, etc...) which shouldn't be enumerated. [0] https://archive.org/details/301works-faq https://archive.org/details/301works-faq
procaryote 1y ago
Running any public facing service as a company with a brand and security policies is a non-zero amount of work Also, don't use link shorteners... and don't build link shorteners as it just enables people to use them.
karel-3d 1y ago
It's not technically but abuse is a problem with any user-submitted data and always will be
- giancarlostoro 1y ago
  Sure, but as others have noted, they dont accept new links since... 6 years ago. So in the grand scheme of things... It's really pointless, and breaks obscure portions of the web where these links might still be.

morkalork 1y ago

I remember there was a blog by someone who implemented their own url-shortener and it turned into a huge amount of work fighting spam, scams and malicious actors abusing the system to the point of their domain was being threatened with blacklisting. But then again, if anyone has the transferable skills to handle that, it would be google since they're already battling the same bad people on all their other services.

kentonv 1y ago
But those problems all went away six years ago when Google stopped accepting new links.
- Maxion 1y ago
  URLs rot, domains expire. So I don't think the problem went away completely.
- jsploit 1y ago
  It's still being abused by people registering expired domains.
  - morkalork 1y ago
    Exactly, there is no guarantee that what a shortened url pointed to 10 years ago is the same as today, or even the same owner or administrator.
    - kentonv 1y ago
      OK but the same vulnerability exists if short URLs weren't used -- in that case the link source would link directly to the now-hijacked domain. So why does Google have to care about this? Is it because they're worried that the domain name goo.gl in the link implies a Google endorsement? Seems like they should have thought of that before launching the service in the first place? Still, the frequency of actual abuse must be low and going down over time (due to the data set being read-only since 2019 and actual traffic to these links surely decreasing as time goes on)...
- deleted 1y ago
  [deleted]

pimlottc 1y ago

Because maintaining it will not get anyone a promotion

kentonv 1y ago

Yes, particularly when considering they stopped accepting new links six years ago. It's a read-only data set and the total storage backing it is probably trivial by Google standards. But they actually backtracked and said they'll keep the "active" links working. Why even spend the effort to remove the "inactive" links? They must feel they represent some sort of liability? Or would it have been too embarrassing to just cancel the whole turn-down plan?

olejorgenb 1y ago
I'm not sure if this is the definition of "active" the have used, but: <quote> Over time, these existing URLs saw less and less traffic as the years went on - in fact more than 99% of them had no activity in the last month.</quote> I'm sure it's correct that the wast majority of links would never be used again, but to gauge which links this is I'd say you should measure at LEAST a year.

rsync 1y ago

I run a public URL shorter and you are correct: it is relatively simple and inexpensive to operate and there is no reason it can’t continue operating into the indefinite future. I disagree with the op on one major point… They suggest that the proper way for a service like this to operate is with a public database of links… However, when I think of all of the different ways, one might use a shorter, it seems obvious that many links would necessarily be sensitive and/or private. Therefore, I consider myself to have a dual mandate: privacy of the links created, and a duty, that I have assumed, of running the service for decades.

jszymborski 1y ago
I think that's fair. 301works.org[0], for example, requires its members to upload their DB to Internet Archive, but IA keeps it private. They then ask for the technical control of the domain to be transferred 301works.org in the event of the site's closure so they can continue serving the traffic. I do think that, however, that a service can keep their DB public _iff_ users know that's the case before creating links. Often times, folks are just shortening public links, but it is true that people sometimes share "private" links (e.g., Google Doc private links, etc...) which shouldn't be enumerated. [0] https://archive.org/details/301works-faq https://archive.org/details/301works-faq

procaryote 1y ago

Running any public facing service as a company with a brand and security policies is a non-zero amount of work Also, don't use link shorteners... and don't build link shorteners as it just enables people to use them.

karel-3d 1y ago

It's not technically but abuse is a problem with any user-submitted data and always will be

giancarlostoro 1y ago
Sure, but as others have noted, they dont accept new links since... 6 years ago. So in the grand scheme of things... It's really pointless, and breaks obscure portions of the web where these links might still be.