18

This issue was raised to some degree in another question, here.

URL shorteners pose several risks to users, which we as IT Security professionals should all be keenly aware of and sensitive to.

Primarily, the threat is that (absent special tools or plugins) you never really know what website is behind a shortened URL until you've clicked on it - at which point it is usually too late to avoid whatever threats lay behind it. This not only leaves the user vulnerable to intentionally posted malicious links, but also to the possibility that the URL shortner's service may be hacked and the links may be redirected en masse.

Secondarily, it has also been mentioned that some shortened URLs have a finite lifetime, leaving the links dead after awhile. This of course means that links which originally had great value on this site could eventually flat-out die irrecoverably.

I suggest we keep an eye out for these shortened URLs, both in actual posted URLs and in hyperlink destinations, and that users with edit privileges un-shorten them wherever they are found. Additionally, there should be a note added to the FAQ which states that shortened URLs should not be used here.

1

4 Answers 4

15

Absolutely Iszi - while many folks do now use plugins to show the destination URL, the risk of a malicious link is too high.

I think best way to handle it is to first comment, requesting the poster corrects it themselves, and if they don't either edit it yourself if you have high enough rep, or flag for a mod.

12

When I see them on ServerFault I do make a point of changing them. It's a level of indirection we don't need, and they have many risks. They make sense for space-constrained media like Twitter, but in the SE ecosystem where length isn't an issue I have trouble coming up with even one legitimate usage.

4
  • +1. I don't understand why the are used on any SE site
    – Earlz
    Feb 20, 2011 at 22:53
  • @Earlz Links to schemas that aren't http, https or ftp
    – badp
    Feb 20, 2011 at 23:04
  • 4
    The "Legitimate usage" is in comments. We have only 600 characters here, so if you need more than a link or two you can be screwed out of being able to fit your response into a single comment. It also offers a neat solution for cases where there are special characters in URLs (i.e. ()) which the Markdown parser does not like. Feb 28, 2011 at 2:08
  • 3
    It's a shame URLs count towards the maximum comments length.
    – Jacco
    May 20, 2011 at 17:40
3

+1 They have no upside in this case and only downsides. They do not follow any standard and are bad for the web. Sometimes there is a reason to use them despite their downsides, but this is not one of them.

2

Isn't the argument applicable to all SE sites and not just IT Security? Maybe there should be a feature to detect and automatically de-shorten such links. Wouldn't be that difficult to implement.

1
  • Perhaps propose the feature on Meta.SO?
    – Iszi
    Feb 17, 2011 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .