On Link Shortening Services OR Spammers Are Winning

 

I am mostly finished with my new website shortenthatreallylongurlintosomethingsimpleandeasytoshare.info, a satirical (but working) URL shortening service. I was looking into how to design the site, and found something interesting.

The spammers are winning:

• http://pnt.me/
• http://eepurl.com/
• http://u.nu/unu-discontinued
• http://1u.ro/ (temporary, it seems)
• http://eezurl.com/welcome.php
• http://fhurl.com
• http://www.hurl.ws/
• http://kl.am/
• http://lurl.no/
• http://ncane.com/
• http://shrinkster.com/
• http://urlborg.com/a/ (Login created)
• http://ye-s.com/ (my favorite heads up message)
• http://zz.gd/
• http://hao.jp/
• http://idek.net/

Huge Note: Lots, at least 30 of the services I checked out were down/gone/something else. The ones listed are ones that had an actual announcement about spammers. Tons of services have started putting in Turing (captcha) tests. Many have started checking their links against those in http://www.surbl.org/ or http://www.spamhaus.org/dbl/ or http://code.google.com/apis/safebrowsing/ or http://www.malware.com.br/ or other similar services, presumably some cron jobs that scans entries regularly. They have started preventing search engine robots from following, which helps prevent people from gaining link reputation illicitly.

Many sites have been acquired by other sites. (http://makeashorterlink.com/)

Articles about spammers and/or URL shortening services worth a read:

• http://www.certmag.com/read.php?in=3863
• http://bits.blogs.nytimes.com/2009/05/07/bitly-eclipses-tinyurl-on-twitter/
• http://technology.timesonline.co.uk/tol/news/tech_and_web/article6947344.ece
• http://www.economist.com/node/17249654
• http://blog.washingtonpost.com/securityfix/2006/06/spam_spotted_using_tinyurl.html
• http://www.stopthehacker.com/2010/02/19/analyzing-url-shorteners/
• http://joshua.schachter.org/2009/04/on-url-shorteners.html
• http://searchengineland.com/analysis-which-url-shortening-service-should-you-use-17204
• http://en.wikipedia.org/wiki/URL_shortening (yes, really)
• Lists of Services
  • http://code.google.com/p/shortenurl/wiki/URLShorteningServices
  • http://www.dmoz.org/Computers/Internet/Web_Design_and_Development/Hosted_Components_and_Services/Redirects/
  • http://mashable.com/2008/01/08/url-shortening-services/

My favorite Services for whatever reason

• http://tinyarrows.com/ – takes advantage of Unicode cleverly.
• http://omf.gd/ – amusing site, ambiguous countdown. Little explanation
• http://chilp.it/ – I have a thing for minimalism.
• http://rickroll.it/ – beautiful! Rick Rolled!
• http://tr.im/ - modest, insults bit.ly
• http://safe.mn/ – focused on security and transparency

So what Security Measures/Features should a good URL shortening service use?

• Be Transparent - http://ur1.ca/ Lets their database be known publicly and forfeits its own rights, and this is what the other services should do too.
• Provide API’s for both shortening and longer-ing. Let sites like http://untiny.me/ unshorten your site. I have programmed a link unshorten-er before, and trust me. API’s are easier than trying to figure out the redirect. (also: http://www.rexswain.com/httpview.html)
• Provide a preview option. http://tinyurl.com/preview.php has a cookie services, and a few other services let the subdomain (http://peek.snipurl.com/) how a preview, not just redirect.
• Rate Limiting – A Spam prevention technique.
• Turing Test. If you are serious about getting rid of spam, force users to enter captcha to shorten a link. Many, many, sites such as http://ow.ly/ do this.
• Registration. If users register once (with captcha), and are remembered thru cookies, the hassle is not too great. If users links are detected as SPAM, its easy to delete ALL of the links that they have submitted
• Spam Site Checking. Scan the database for known spam links. (four services listed above). Delete them. If you have a user, or IP, you can block and delete similar, probably spam, links to for terms-of-use abuse.
• Prevent Double Dipping – Do not let already short URL’s from shortened sites be shortened. This is a way the spammers are getting around malware link detection. They use an untrusted redirect site (the many we saw being taken down) that is then put in a popular shortening service that people, because they are idiots, trust.
• Use a 301 Redirect, not a 302.
• Allow custom (vanity) URL’s. Not security, just a nice touch.
• If you have users/registration, let the users delete their URL’s.
• Don’t use a “frame bar”. See http://searchengineland.com/the-growth-of-framebars-kevin-rose-on-the-diggbar-17416
• List of links? http://crum.pl/multi has a place where you put a list of links into a site. I cant say I would use this, and can’t recommend, but it’s a useful feature to be available to the user. For me, this would be using my http://pinboard.in/u:squirrel tag, or date, collection, and linking to that.

The wonderful world of ebay

Turning 18 has giving me many privileges with account creation on the internet. Sites require I be 18, and now I am. Of course I am talking about eBay. I just got my eBay accout (hdyar) and am about to take the internet by storm. My first purchase? Some aviator sunglasses. I lost the old ones (not true, I know where they are, a diner in white plains, NY). NY first bid is on some 3D printed parts for reprap 3D printers. I plan to get some summer cash by selling things on ebay. Ill use this blog to post updates on both projects

I like cold

I can't do hot. The current temperature is 95, and its been above 93 all week. I am dying. I can't handle the heat. All winter long, I would walk outside with Isaiah Clark. He would put on a fourth layer, I would remain in my T-shirt, and we would exchange equevalent glances: really?

Hockey conditioned me for cold. After you have showered in below freezing water- literally forming Ice by the drain - after doing that somewhat regularly, nothing else seems cold. Sure, I may shiver or get goosebumbps or chatter my teeth, but you wont hear my complain about it! Because it could always be colder. I'm just used to it.

But ... Its fucking hot!

How Windows UAC should work

It should not give you pop-ups if you are already on an administrator account, only if you are on a non-administrator account should that popup exist, and then the kid can call over the adult, have them look at that the kid is trying to do, then type password and let them install whatever.

Just saying, redundancy is good, but not if it doesn’t actually do anything. We aren’t re-entering our password on popups (some don’t have one), we are just clicking a box that makes my graphics and giant monitor go black for a bit. Poopy!

 

On a side note, I plan to buy a chromebook when they are released and use to take notes when in college, dropbox sync to main machine. Portability acquired. With the cloud.

Yesterday's todo list

Wake up
remember to eat breakfast
Play tf2, finally hit 100 hours of gameplay time
Get rid of extra shampoo bottles in shower
Graduate high school
Brainstorm and write sketches
Don't forget dinner
Reminder: pulp fiction now Streaming on Netflix

As a side note, I did not eat lunch. Forgot.

My life is practice

What I do is not entertain, not write, not juggle, not tell stories, not play music, not write code. I don't do any of that. I practice them. For every minute  I am juggling in front of somebody, I am spending 8 hours practicing. I sent such a rediculus amount of time practicing, it entirely dwarfs nearly everything else I do. Therefore: my life is practice.

College. Uhhhh.... yeah

Huh school is done with, except for graduation ceremony and all that good Stuff. I've applied housing preferences at depauw but little else. My sister, purdue, is getting back housing info and such. ITAP honors program has me go on campus a few days early, but I don't have any info. I have no I to for anything, and don't know what I should be doing.

So I am going to ignore the problem, naturally, and enjoy my summer and these 8000 open houses.