Hacker News Reader

Comment by Kliment | Hacker News Reader

Note how this means that anyone who is tricked into clicking that link has just blacked-out their entire institution. This has massive potential for abuse.

View on HN

I almost wish I was back at uni so I could have some fun with this.

Spam every academic email with link to "I thought you might find this paper interesting", lockout every university in the world? It only takes one click by one unsuspecting victim per institution. I wonder what would happen if someone includes that DOI in a publication reference. Watch which institutions go dark, and you know who is doing your blind review.

Yep - the naughtiness you could get up to with this is almost endless. I get the feeling that this will not be with us for much longer as every university in the world is about to get locked out.

Undergrads won't open that link, and grad students and faculty are too busy.

To really do damage, you need to create something that'll go viral, and piggyback the link on it. Undergrads will click anything that looks fun. Make it look fun and you're golden.

If you're up for a little fraud, get a list of faculty and undergrad e-mails and send e-mails to undergrads purporting to be from faculty saying, "Please read this and be ready to discuss in class on Monday." The hit rate will be low, but you're bound to get a few students who really do have that professor's class on Monday and will click it.

You wouldn't need to click the link. Just include it on another page as an img src. Right?

Things like signatures on forums visited by university students are the first to come to mind. Embed it through one of the many referer-stripping redirectors out there, and none could be the wiser...

Send it to the adminstrative staff then, they spend about 50% of their day surfing.

That isn't true. http://blog.codinghorror.com/preventing-csrf-and-xsrf-attack...

You're assuming the creator of the spider trap also put in CSRF protections. However, if you read the article, you'll see that it is only a link, with no CSRF protection at all. Therefore, it is quite true that spamming research mailing lists could lock a lot of people out. In fact, since this spider trap is triggered on a GET request, you would just need to embed the link as an image, script, or stylesheet and get the target to visit a page.

You could even embed the URL as an image in the email, and if images are enabled, it would trigger a GET request.

They have posted a reply here: http://www.asihcopeiaonline.org/doi/pdf/10.1046/9999-9999.99...

Appropriately, "The requested article is not currently available on this site."

That looks like the spider trap link.

That's the joke.

This sort of Slashdot-esqe misdirection is not exactly appropriate on HN. It starts with black-holing universities with a link mislabeled as a response, but could quickly devolve into misdirections to other black holes of Slashdot that (I assume) we really don't want here.

As a user of HN, don't tell me or others what's appropriate, thanks.

Nitrogen is right. This sort of Slashdot-esqe misdirection is not exactly appropriate on HN.

Not to mention the fact that if someone at a university does click the link, they could ruin any number of people doing research there. That includes undergrads doing a last-minute reference to their thesis and tenured professors about to cure cancer.

I know it was meant as a joke but some people click first and think later...

Reply on news.ycombinator.com