Old Bitly Links Are Being Hijacked

(ransomnews.com)

82 points | by hspeiser 2 hours ago ago

43 comments

  • Alive-in-2025 2 minutes ago ago

    There's a lot of abandoned url ownership things on the internet. We need something like a bureau that keeps track of what it was for. We do have archive.is or .org to save the content at a url (side note - are these archivers legal or in some country that allows this?).

    I do often come across an article occasionally where someone is writing about a narrow topic that I'm interesting in, but I can't find them any more - maybe they had a vauge user name that isn't resolvable.

    You have sites trying to block spammers, but you have over-active groups like Reddit that seem to delete accounts aggressively with no information about what you did wrong. I want a meta id that I own, that people can check I'm the real "foo-bar1418", and that can't be deleted or taken over.

    It feels like there's still room for a super-crosssite-ID. But there are also spammers, haters etc that sites have to deal with.

  • tonymet 2 minutes ago ago

    This is a lesson for any entry point including usernames , subdomains, url slugs. Anything of value will be abused.

  • 5kyl4b an hour ago ago

    this is why i have always been against link shorteners :)

    • tibbon 27 minutes ago ago

      Same. It's been marketing and other departments that have claimed to need them for ease of use, but then also that same department wants to shove a lot of long text in the url for SEO...

      I've warned several times over the years that these links will rot and our going to be out of our control, but... that's what they want!

    • naruhodo 42 minutes ago ago

      This is why I'm suddenly in favour of link shorteners.

      • mock-possum 42 minutes ago ago

        Ah yes the duality of man

  • j45 10 minutes ago ago

    The convenience of link shorteners is one thing, running them on your own domain seems to still make the most sense.

    • clickety_clack 4 minutes ago ago

      Ya. I could see random individuals using them on twitter, but McDonalds couldn’t figure out a way to create shortened links on their own domain?

  • g-b-r an hour ago ago

    Somewhat related, I've been getting a lot of spam with links to urls of big, reputable, organizations, such as universities.

    You'd think that the organization was hacked, but in all these case instead these were old domains that used CNAMEs.

    The domain that the CNAME pointed to was once owned and used by the organization, but at some point it was let go, and it ended up being purchased by the spammers.

    So, the spammers were able to use links that looked safe, and maybe that also helped with passing spam filters.

    Thus, if you manage domains, please keep track of the ones with CNAMEs, recommend the users to tell you when they stop using them, and maybe check every once in a while (better if automatically) that the domain they're pointing to hasn't changed hands.

    I'd be curious to know how the spammers find these old cname domains, by the way.

  • sparkling 21 minutes ago ago

    >"and is disabling the affected links."

    Wouldn't it make more sense to restore the original destination URL?

    • xp84 9 minutes ago ago

      if the original people had kept their accounts active they would still be the original URL. That's on BK, Trump, etc.

      Obviously, them's the breaks though when you voluntarily rent URLs from random companies. Bitly could sell their whole domain to (insert whatever organization you trust the least) and every URL you've ever made either breaks or is redirected to whatever that entity wants.

  • OgsyedIE an hour ago ago

    The tweet that McDonald's Sweden is proud of what they've achieved, redirected to the Wikipedia page for 9/11, is probably the most quintessentially 'Gen Z' joke to the point that dictionaries ought to use it as the example.

    • B-Con 19 minutes ago ago

      What aspects make it so quintessentially "gen z"?

      • xp84 5 minutes ago ago

        I'm guessing some combo of dark humor, and the fact that they don't remember 9/11 so they don't mind joking about it, plus ironically trolling big corporations.

  • Seattle3503 29 minutes ago ago

    Is there a version of this "article" not written by AI? Feels like this was just an AI scraping twitter and writing an article.

    • Oarch 10 minutes ago ago

      It really took ages to get anywhere. Even the section explaining how the hack happened left me non the wiser.

  • logicallee an hour ago ago

    What's the value proposition of link shorteners? I mean, why do companies, or customers, use them?

    • frio an hour ago ago

      My company use a shortener to reduce how much data gets encoded into QR codes that we use, thus making them work better in marginal lighting conditions with worse phones. However, it is entirely self-hosted (301/302 redirect is not a difficult service to build) to protect us from this exact kind of problem.

      Traditionally they were useful at the height of Twitter's heyday, because it used to limit Tweets to 140 characters. SMS is a similar use case, but I disliked it there even more, because it normalised getting official messages from random shortcodes with shortened links -- just like a phishing campaign.

      • basch 31 minutes ago ago

        Can’t you just run that internally on a one character subdomain?

        • xp84 7 minutes ago ago

          You certainly can, I'd happily set one up for my company if they'd let me, but the marketing organizations that generally use these things are 99% of the time only distant cousins from people like me in the orgchart family tree. They just go sign up accounts, use a marketing credit card, and do whatever, and they only talk to people in the tech side of the company after some mess or disaster is made (e.g. "Oh no, we used a URL shortener that went out of business/sold to a porn site/etc")

    • fma 7 minutes ago ago

      I don't need shorter links per-se but I need a way to track the effectivness of the links I send out to the public for marketing purposes. I could put tracking ids and such but it doesn't look as good.

      I also have links to my Google reviews, Google Maps etc and it's better show bitly.com/business-google-reviews and bitly.com/business-google/map than https://maps.app.goo.gl/sGa1KAU2131212cqU7

    • rr808 21 minutes ago ago

      I always thought it was good for tracking eg you have different links for different advertisements and you can track which ones get used.

    • ronsor an hour ago ago

      Shorter links.

      Or for historical context, this is all Twitter's fault since its character limit included links too.

      • sincerely 31 minutes ago ago

        Before twitter, it was forum signatures with a character limit :’)

      • LoganDark an hour ago ago

        Worth noting it doesn't anymore, all links are now worth the same by going through Twitter's own link shortener.

    • akerl_ an hour ago ago

      It’s often more convenient to have shorter links. Both for human convenience and length-limited mediums.

      And many of them provide analytics to see who’s clicking your link.

    • urbnspacecowboy an hour ago ago

      To make affiliate/tracker links harder to spot and work around.

    • aviperl 44 minutes ago ago

      Short urls are nicer if someone's got to write them down, remember the url, and make for a less dense QR code too. That's what I use them for.

      I host my own now, for free and for fun.

    • nsoam an hour ago ago

      That’s like asking what’s the value proposition of TwitPic. You had to be there.

    • _ette 38 minutes ago ago

      The other replies have largely covered most use cases they can also be handy for less tech savvy people to quickly generate links with unique analytics for marketing purposes.

    • MOARDONGZPLZ an hour ago ago

      Shorter links

    • LordShredda 27 minutes ago ago

      Back in the day every useful link you found on forums used to be shortened with an advertisment proxy service that promised a few pennies per click in exchange for making the user sit through a minute of ads.

    • g-b-r 28 minutes ago ago

      While usually purported to be for the shortness, it's almost always to track their usage.

      It's lovely when books use them, and by the time you read them they don't work anymore.

    • llm_nerd an hour ago ago

      Before Twitter, they were used to put URLs on physical things like business cards. They increased in popularity once Twitter imposed a 140 character limit.

      People then saw that there were lots of secondary benefits. As another comment mentioned, hiding affiliate forwarders / query strings were a huge use back when everyone was trying to score those kickbacks. And then getting metrics on every clickthrough.

  • ares623 an hour ago ago

    We used to worry about link shorteners. We still do, but we used to, too.

  • rvz an hour ago ago

    Link shorteners are just waiting to get abused.

    Imagine if someone is using curl | bash on a shortened URL because "it's too long" and you can't see where the link is going.

    • nvme0n1p1 30 minutes ago ago

      Weird tangent. curl|bash doesn't work with link shorteners anyway because you need an extra flag to handle redirects.

      • xp84 3 minutes ago ago

        Obviously should probably never use this in the |bash situation, but it's `-L` -- in general a good one to use by default unless you're only using curl to inspect redirect headers or something.

  • hspeiser 2 hours ago ago
    • 5kyl4b an hour ago ago

      these were also taken down, unfortunately

      • dylan604 an hour ago ago

        Unfortunately? Are part of the team hijacking the links? Taking them down is a good thing

        • ForHackernews 40 minutes ago ago

          ^ The No Fun Patrol here to stand with the corporate machine against harmless hijinks.