Hacker News Reader

Comment by solardev | Hacker News Reader

If it's just a redirect, isn't it going to be bypassed as soon as the first user shares the real URL?

I guess since you’re going to have to give a password to someone, you can tell them not to do that.

Though I’m a bit confused why this is even needed. The sort of thing most people want accessible via a link, but only for certain people, tend to already have unpredictable URLs. I’m not sure how

https://gaggledocs.com/documents/aboevdowugwhoaofh

Is different from

https://protectmylink.xyz/owndoavwyagdo + a password

Especially when the original url is still publicly accessible on the internet.

Additionally, you normally have much better authorization options in the app you’re linking to.

I guess you get the benefit of a changeable link, unlike the canonical one? But then a link shortener is almost enough already.

Don't combine link shorteners with unguessable URLs, the result is a guessable URL.

I ran a similar service when In was in high school. People were using it to distribute links in public settings that were meant for small circle of folks. Lots of club newsletters were distributed this way.

People also used it for selling files and things but as you've said it was trivial to defeat and only filtered out the least technical folks.

It was surprisingly popular.

I, too, ran a similar service in high school. It also got weirdly popular, and then spammers started using it and the FBI sent a shutdown notice to my server provider while I was working at a summer camp (with no internet access) and all my sites got taken down for a week :(

I shut down for similar concerns (phishing/spam), albeit before law enforcement required me to.

I would certainly be running URLs through block lists, with a Report Abuse system if I were doing this today.

That was my thought as well. Not sure what the actual value is here.

Especially since links can already be pretty private by default if they are random enough and not shared on any site where a crawler can access them. If you want actual security, you need to protect content on your end. If you don't really care and just don't want it publicly indexed, share it privately and keep it off the surface web.

I suppose it is the same concept as gumroad vendors. Most of them simply put an s3 url behind the gumroad paywall. Once you are done buying, the s3 url can be shared with anyone.

I think the S3 URLs typically expire after a bit, at which point a new one would have to be generated the next time you need to re-download.

True, but most stuff I bought from gumroad, url never expires. Guess, we tech folks are conditioned to think too much into basics that non-tech folks don’t think about.

Reply on news.ycombinator.com