There is a current "show your personal site" post on top of HN [1] with 1500+ comments. I wonder how many of those sites are or will be hammered by AI bots in the next few days to steal/scrape content.
If this can be used as a temporary guard against AI bots, that would have been a good opportunity to test it out.
AI bots (or clients claiming to be one) appear quite fast on new sites, at least that's what I saw recently in few places. They probably monitor Certificate Transparency logs - you won't hide by avoiding linking. Unless you are ok with staying in the shadow of naked http.
Okay, but then what? Host your sites on something other than 'www' or '*', exclude them from search engines, and never link to them? Then, the few people who do resolve these subdomains, you just gotta hope they don't do it using a DNS server owned by a company with an AI product (like Google, Microsoft, or Amazon)?
I really don't know how you're supposed to shield your content from AI without also shielding it from humanity.
My site is hosted on Cloudflare and I trust its protection way more than flavor of the month method. This probably won't be patched anytime soon but I'd rather have some people click my link and not just avoid it along with AI because it looks fishy :)
I've been considering how feasible it would be to build a modern form of the denial of service low orbit ion cannon by having various LLMs hammer sites until they break. I'm sure anything important already has Cloudflare style DDOS mitigation so maybe it's not as effective. Still, I think it's only a matter of time before someone figures it out.
There have been several amplification attacks using various protocols for DDOS too...
Yeah I meant using it as an experiment to test with two different links(or domains) and not as a solution to evade bot traffic.
Still, I think it would be interesting to know if anybody noticed a visible spike in bot traffic(especially AI) after sharing their site info in that thread.
Glad I’m not the only one who felt icky seeing that post.
I agree my tinfoil hat signal told me this was the perfect way to ask people for bespoke, hand crafted content - which of course AI will love to slurp up to keep feeding the bear.
Not producing or publishing creative works out of fear that someone will find them and build on top of them is such a strange position to me, especially on a site that has it's cultural basis in hacker culture.
Anubis flatly refuses me access to several websites when I'm accessing them with a normal Chromium with enabled JS and whatnot, from a mainstream, typical OS, just with aggressive anti-tracking settings.
Not sure if that's the intended use case. At least Cloudflare politely masks for CAPTCHA.
How is AI viewing content any different from Google? I don’t even use Google anymore because it’s so filled with SEO trash as to be useless for many things.
LLM led scraping might not as it requires an LLM to make a choice to kick it off, but crawling for the purpose of training data is unlikely to be affected.
Sounds like a useful signal for people building custom agents or models. Being able to control whether automated systems follow a link via metadata is an interesting lever, especially given how inconsistent current model heuristics are.
I shortened a link and when trying to access it in Chrome I get a red screen with this message:
Dangerous site
Attackers on the site you tried visiting might trick you into installing software or revealing things like your passwords, phone, or credit card numbers. Chrome strongly recommends going back to safety.
I think it’s perfectly reasonable to make something useless for fun, it’s an interesting idea.
But what I’d like to understand is why there are so many of the same thing. I know I’ve seen this exact idea multiple times on HN. It’s funny the first time, but once it’s done once and the novelty is gone (which is almost immediately), what’s the point of another and another and another?
I think it's just someone learning something new most of the time.
I have home made url shorteners in go, rust, java, python, php, elixir, typescript, etc. why? because I'm trying the language and this kind of project touches on many things: web, databases, custom logic, how and what design patterns can I apply using as much of the language as I can to build the thing.
Right. But the question is why redo the exact same joke? Why not come up with another twist (like the URL lengthener) or do no twist but be useful?
I’m not criticising the author or anyone who came before. I’m trying to understand the impetus between redoing a joke that isn’t yours. You don’t learn anything new by redoing the exact same gag that you wouldn’t learn by being even slightly original or making the project truly useful.
Ideas are a dime a dozen. You could make e.g. a Fonzie URL shortener (different lengths of “ayyyyy”), or an interstellar one (each is the name of a space object), or a binary one (all ones and zeroes)… Each of those would take about the same effort and teach you the same, but they’re also different enough they would make some people remember them, maybe even look at the author and their other projects, instead of just “oh, another one of these, close”.
If you're learning, it's better to recreate something exactly as it is, so that you have something against which to verify your output. Plus, not everyone is an idea person, and I'd wager that most devs are implementation people, not idea people.
I’d argue that if you’re learning and are so inexperienced you need to recreate something exactly, you should instead recreate something real and useful—of which there are more examples—than one joke.
Plus, I don’t think I’ve seen another of these which is exactly like this (just extremely close in concept), so the argument doesn’t hold.
A joke isn’t the best example because there are jokes that never changes but the delivery is a sign of mastery. The Aristocrats is like Bach’s cello suite for comedians.
The Aristocrats is a special case where the setup is the joke instead of the punchline. The point is the inventiveness of the journey. If it was told with the same setup every time, it wouldn’t be funny.
I can’t speak for the author, but this strikes me as the kind of thing you might not want to check prior work on. It just seems like a fun little project and sometimes seeing that other people have done it can be a bit demotivating.
The author posted this project on reddit a few days ago where they mentioned their motivation: "I have a coworker who is constantly talking about the glory days of ShadyUrl, but that website has been down for several years at this point, so I figured I would create an alternative."
URL Shortener is still one of the most popular System Design questions, building this project is a great way to have some experience / understanding of it, for example.
I agree. But a URL shortener with a twist isn’t just fun, it’s funny. The joke—as opposed to the usefulness—is what’s interesting about it. But when the same joke is overdone, it’s no longer funny.
> building this project is a great way to have some experience / understanding of it
I actually forgot that this had been done before until you mentioned it.
Giving the author the benefit of the doubt, they may have not seen it before, or was bored and just wanted to make a toy.
And it seems like many in HN are in enough a similar boat to me to have up voted it to trending, so at least some people found it entertaining, so it fulfilled its purpose I suppose.
It's a good question though, and I don't think anyone really knows the answer.
One reason is that not all these websites manage to make equally "creepy" links, even though the basic idea is the same. I remember one version which was a lot more alarming than the current example, with links containing a mix of suspicious content hinting at viruses, phishing, piracy/warez sites, pornography (XXX cams), and Bitcoin scams. I don't remember that website, but the current case seems rather weak by comparison.
That makes it even more confusing. If you’re making something creepy, I can see the argument for “whatever exists isn’t creepy enough, I’ll do it better” but not the reverse.
It's possible the current website is older, or that the creator doesn't know about better alternatives. (Also, they do produce rather short links, unlike some of the others, which don't pass as "URL shorteners". Though not sure whether that's relevant.)
I got one where the called script ended in ".pl" and I had a flashback to the 90s. My trousers grew into JNCOs, Limp Bizkit started playing out of nowhere and I got a massive urge to tell Slashdot that Alan Thicke had died.
What's up with the creepy ads on this website? It seems like they are actually sketchy ads and not just fake ads for comedic effect. One shows some scammy nonsense about your device being infected and the other links to a real VPN app.
Please don’t use 3rd party relays for your URLs. It’s bad enough to have your own server, domain, etc. as single points of failure and bottlenecks without adding a 3rd party into the mix, who either themselves or someone that takes over their domain later track users, randomly redirect your users to a malicious site, or just fail.
I know people have fond memories of long ago when they thought surely some big company’s URL shortener would never be taken down and learned from that when it later was.
As someone who built a standard shortener (coz.jp), this is hilarious. I spent so much time trying to make links look trustworthy; doing the exact opposite is a surprisingly fun concept.
It seems appropriate that, for a website whose purpose is to make links which raise your suspicions, the visual design itself also raises your suspicions.
This is fun. Is it not checking for previously submitted URLs though? I can seemingly re-submit the exact same URL and get a new link every time. I would expect this to fill the database unnecessarily but I have no idea how the backend works.
Am I missing something, or would these essentially be implemented via DNS records? It's not clear to me that keeping the links in a database would be necessary at all (unless the DNS records are what you mean by "database")
The other day in a Facebook Messenger group chat I tried to link to https://motherfuckingwebsite.com/ as a joke, but Messenger kept blocking it. It's quite overzealous with its blocking.
Msn.com
Office.com
Sharepoint.com
Hotmail.com
Etc, plus all the subdomains they insert before them. It makes it very easy to create phishing emails that look plausible.
I've been at a company that internally sends out fake links that log the user and links to an educational page on internet safety.
I honestly don't mind too much since it's a once a year thing (hacktober) and honestly companies should be trying to catch out employees who click any and all links.
I added google.com and it spit out https://twitterDOTc1icDOTlink/install_Jy7NpK_private_videoDOTzip
Interesting that it spit out a .zip url. Was not expecting that so I changed all the “.” to “DOT” so I don’t get punished for posting a spammy link despite this literally being a website to make links as spammy and creepy as possible.
I always end up making my own, they're so simple to write.
Saves using one of the "free" ones which looks like its free but you're actually on a free trial, then you can't access your links after that trial expires.
edit: gpt-oss 20B & 120B both eagerly visit it.
There is a current "show your personal site" post on top of HN [1] with 1500+ comments. I wonder how many of those sites are or will be hammered by AI bots in the next few days to steal/scrape content.
If this can be used as a temporary guard against AI bots, that would have been a good opportunity to test it out.
1. https://news.ycombinator.com/item?id=46618714
I really don't know how you're supposed to shield your content from AI without also shielding it from humanity.
My site is hosted on Cloudflare and I trust its protection way more than flavor of the month method. This probably won't be patched anytime soon but I'd rather have some people click my link and not just avoid it along with AI because it looks fishy :)
There have been several amplification attacks using various protocols for DDOS too...
Still, I think it would be interesting to know if anybody noticed a visible spike in bot traffic(especially AI) after sharing their site info in that thread.
Unless you mean DDoS protection, this one helps for sure
I agree my tinfoil hat signal told me this was the perfect way to ask people for bespoke, hand crafted content - which of course AI will love to slurp up to keep feeding the bear.
Not sure if that's the intended use case. At least Cloudflare politely masks for CAPTCHA.
Are you sure the block isn't due to the authors of those websites using some other tool in addition?
I shortened a link and when trying to access it in Chrome I get a red screen with this message:
But what I’d like to understand is why there are so many of the same thing. I know I’ve seen this exact idea multiple times on HN. It’s funny the first time, but once it’s done once and the novelty is gone (which is almost immediately), what’s the point of another and another and another?
I have home made url shorteners in go, rust, java, python, php, elixir, typescript, etc. why? because I'm trying the language and this kind of project touches on many things: web, databases, custom logic, how and what design patterns can I apply using as much of the language as I can to build the thing.
I’m not criticising the author or anyone who came before. I’m trying to understand the impetus between redoing a joke that isn’t yours. You don’t learn anything new by redoing the exact same gag that you wouldn’t learn by being even slightly original or making the project truly useful.
Ideas are a dime a dozen. You could make e.g. a Fonzie URL shortener (different lengths of “ayyyyy”), or an interstellar one (each is the name of a space object), or a binary one (all ones and zeroes)… Each of those would take about the same effort and teach you the same, but they’re also different enough they would make some people remember them, maybe even look at the author and their other projects, instead of just “oh, another one of these, close”.
You may want to learn about design and novelty. Some people just want to learn about execution.
Plus, I don’t think I’ve seen another of these which is exactly like this (just extremely close in concept), so the argument doesn’t hold.
Edit: I see referencnes to shadyurl in the comments and I have heard of that, but probably wouldn’t have thought of it.
https://xkcd.com/1053/
Again, this was not a criticism, but a genuine question.
URL Shortener is still one of the most popular System Design questions, building this project is a great way to have some experience / understanding of it, for example.
I agree. But a URL shortener with a twist isn’t just fun, it’s funny. The joke—as opposed to the usefulness—is what’s interesting about it. But when the same joke is overdone, it’s no longer funny.
> building this project is a great way to have some experience / understanding of it
https://news.ycombinator.com/item?id=46632329
Giving the author the benefit of the doubt, they may have not seen it before, or was bored and just wanted to make a toy.
And it seems like many in HN are in enough a similar boat to me to have up voted it to trending, so at least some people found it entertaining, so it fulfilled its purpose I suppose.
It's a good question though, and I don't think anyone really knows the answer.
https://jpmorgan.c1ic.link/logger_zcGFC2_bank_xss.docm
Definitely not meta
Deceptive site issue
This web page at [...] has been reported as a deceptive site and has been blocked based on your security preferences.
What's going on? I can't find any setting to disable this.
[1] https://news.ycombinator.com/item?id=45295898
edit: fixed typo
I use them in tests, just for fun: https://github.com/ClickHouse/ClickHouse/blob/master/tests/q...
Funnily enough the domains appear to have been bought up and are now genuinely shady.
I love this version and I hope you do too.
I know people have fond memories of long ago when they thought surely some big company’s URL shortener would never be taken down and learned from that when it later was.
For example, the healthcare.gov emails. For links to that domain, they would still transform them with lnks.gd, even though:
1) The emails would be very long and flashy, so they're clearly not economizing on space.
2) The "shortened" URL was usually longer!
3) That domain doesn't let you go straight to the root and check where the transformed URL is going.
It's training users to do the very things that expose them to scammers!
https://c1ic.link/campaign_WxjLdF_login_page_2.bat
You seem to be able to encode arbitrary text, so long as it follows [A-Za-z0-9]+\.[A-Za-z0-9]+
https://wellsfargo.c1ic.link/TODO_obfuscate_url_8wyS7G_hot_s...
https://news.ycombinator.com/item?id=31386108
And got: https://c1ic.link/account_kPvfG7_download_now.bat
https://c1ic.link/ad_k9OFWW_redeem_gift.bat
What would be a good name here? A URL redirector?
Thanks!
Edit: looks like you need an invite code.
Bummer
In example.com/blah, the /blah part is interpreted by the host itself.
And apart from that I would indeed consider DNS records a database.
Msn.com Office.com Sharepoint.com Hotmail.com Etc, plus all the subdomains they insert before them. It makes it very easy to create phishing emails that look plausible.
I honestly don't mind too much since it's a once a year thing (hacktober) and honestly companies should be trying to catch out employees who click any and all links.
Eventually we got asked to please make it stop. I asked them to please stop sending fake phishing emails to robots.
https://c1ic.link/bzSBpN_login_page_2
Edit: Chrome on Android warned me not to visit the site!
And got https://twitter.web-safe.link/root_4h3ku0_account_verificati...
Interesting that it spit out a .zip url. Was not expecting that so I changed all the “.” to “DOT” so I don’t get punished for posting a spammy link despite this literally being a website to make links as spammy and creepy as possible.
https://wiki.archiveteam.org/index.php/URLTeam
Saves using one of the "free" ones which looks like its free but you're actually on a free trial, then you can't access your links after that trial expires.