the ability to edit titles is great. But the ability to edit the URL of a post is dangerous. - Lemmy.ml

3 years ago by DrYes to c/sysadmin

1. I create a well crafted post to a normal site that gets 10.000 upvotes. 2. I change the URL to a malicious site. 3. ??? 4. Profit

I don't know how to crosspost properly.

I think this is a serious design flaw. If you agree please upvote the post on lemmy.ml community for visibility

njinx 75 points 3 years ago

Yeah this seems like a pretty huge oversight. I'd file an issue on GitHub ASAP.

save

path: 0 356627, hotness: undefined, score: 75, children: 0

ilickfrogs 69 points 3 years ago

I hadn't even come across it yet but holy hell that's a scammer/malicious actors paradise.

save

path: 0 357645, hotness: undefined, score: 69, children: 0

trent 14 points 3 years ago

On Kbin's end the thread ID is 57540 and the appended text is simply a hint to what is on the other side of the link (i.e. it doesn't change anything). This is standard practice and you see it a lot across the web
Try this: https://kbin.social/...

save

path: 0 359398, hotness: undefined, score: 14, children: 2

18107 17 points 3 years ago

StackOverflow had the same feature until people started abusing it for SEO. After that, they decided to remove the option.

save

path: 0 359398 365034, hotness: undefined, score: 17, children: 1

lich_hegemon 1 point 3 years ago

Makes sense. SE is profit driven. They want to be at the top of the list when people Google stuff.

For a service like this tho, is that really that big of an issue?

save

path: 0 359398 365034 381122, hotness: undefined, score: 1, children: 0

SlappyRedcheeks 7 points 3 years ago

There is also now way to see the underlying url of a hyperlink in the Jerboa app.

save

path: 0 378299, hotness: undefined, score: 7, children: 0

CSFFlame 5 points 3 years ago

I kinda like it, but it should be operable for the mods (so it flags it for them to check, or whatever automod eventually shows up can hide the post until it's cleared)...

save

path: 0 360957, hotness: undefined, score: 5, children: 1

overzeetop 3 points 3 years ago

I like the ability to edit, but agree that some kind of limitations should be on it. Requiring mod review of a URL change would, at least, put one level of check into the system. The other option would be to simply allow only mods to change the URL. That doesn't prevent a bad actor who is a mod, but that seems less likely than a standard user.

save

path: 0 360957 376824, hotness: undefined, score: 3, children: 0

CookieJarObserver -47 points 3 years ago

save

path: 0 356894, hotness: undefined, score: -47, children: 7

eric5949 49 points 3 years ago

save

path: 0 356894 357138, hotness: undefined, score: 49, children: 3

kakes 5 points 3 years ago

And it's worth noting that this was/is rampant in comments on Reddit.

save

path: 0 356894 357138 365140, hotness: undefined, score: 5, children: 2

teuast 7 points 3 years ago

there was an entire genre of posts where posters would say "ask me any question and then edit your comment to make me look bad"

there were also times i'd call out a racist and they'd edit their comment to make it look like i'd called out as racist someone who was saying something totally innocuous. but then i was usually not the only one doing it, and the comments in questions usually got downvoted to oblivion, not to mention the time-of-edit indicators, so anybody with half a brain cell could figure out exactly what had happened.

save

path: 0 356894 357138 365140 375238, hotness: undefined, score: 7, children: 1

MarxusOrlyius 4 points 3 years ago

there were also times i’d call out a racist and they’d edit their comment to make it look like i’d called out as racist someone who was saying something totally innocuous.

This is why you I pretty much always quote what I'm replying to.

save

path: 0 356894 357138 365140 375238 379688, hotness: undefined, score: 4, children: 0

callyral 2 points 3 years ago

you could edit the post or a comment but not the post title

save

path: 0 356894 364343, hotness: undefined, score: 2, children: 2

CookieJarObserver 0 points 3 years ago

save

path: 0 356894 364343 370141, hotness: undefined, score: 0, children: 1

lich_hegemon 1 point 3 years ago

In a text post, yeah. Not in a link post

save

path: 0 356894 364343 370141 381148, hotness: undefined, score: 1, children: 0