<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>blog.flo.cx &#187; 2009 &#187; June &#187; 25</title>
	<atom:link href="http://blog.flo.cx/2009/06/25/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.flo.cx</link>
	<description>Tech, Food, Life</description>
	<lastBuildDate>Thu, 10 May 2012 21:36:44 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.2</generator>
		<item>
		<title>loops and stretching with urlshorteners&#8230;</title>
		<link>http://blog.flo.cx/2009/06/loops-and-stretching-with-urlshorteners/</link>
		<comments>http://blog.flo.cx/2009/06/loops-and-stretching-with-urlshorteners/#comments</comments>
		<pubDate>Thu, 25 Jun 2009 10:48:12 +0000</pubDate>
		<dc:creator>flo</dc:creator>
				<category><![CDATA[english]]></category>
		<category><![CDATA[OnlineLife Net Webapps]]></category>
		<category><![CDATA[bit.ly]]></category>
		<category><![CDATA[internet]]></category>
		<category><![CDATA[net]]></category>
		<category><![CDATA[qr.cx]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[spam]]></category>
		<category><![CDATA[tr.im]]></category>
		<category><![CDATA[url]]></category>
		<category><![CDATA[url shortener]]></category>

		<guid isPermaLink="false">http://blog.flo.cx/?p=1493</guid>
		<description><![CDATA[there has been some discussion (via @mstrohm) on the security of urlshorteners and i have been thinking about this the past days. putting the problem of the bottle neck aside it leaves us with the possibility of spamming and/or loops and missing transparency when looking at urlshortening services. let&#8217;s say the advantage of shortening urls [...]
No related posts.]]></description>
			<content:encoded><![CDATA[<p>there has been <a href="http://unweary.com/2009/04/the-security-implications-of-url-shortening-services.html">some</a> <a href="http://joshua.schachter.org/2009/04/on-url-shorteners.html">discussion</a> (via <a href="http://twitter.com/mstrohm">@mstrohm</a>) on the security of urlshorteners and i have been thinking about this the past days.</p>
<p>putting the problem of the bottle neck aside it leaves us with the possibility of spamming and/or loops and missing transparency when looking at urlshortening services. let&#8217;s say the advantage of shortening urls has to compensate one of the disadvantages; let&#8217;s take the bottle neck. it&#8217;s clear that one cannot shorten a url and expect the link to be independent or maybe distributed like DNS at the same time.</p>
<p>still there are 3 problems which have to be solved:</p>
<p>spamming: there are concepts which we know from mail services that can narrow this issue down. <a href="http://is.gd">is.gd</a> uses the <a href="http://www.surbl.org/">surbl</a> blacklisting service to check for spams. with a little fine tuning this is manageable.</p>
<p>loops: similar to the spamming problem, there must be a blocklist of sites that are not accepted for shortening. <a href="http://qr.cx">qr.cx</a> already implements a list of about 200 services that are blocked from shortening. <a href="http://is.gd/tech.php">is.gd</a> is saying so too, although they accepted qr.cx links and others at the time of writing. this is really easy to implement and should be done by every shortening service.</p>
<p>transparency: the problem here is that users cannot see where they are going when clicking a shortlink. the solution is again very easy to implement. <a href="http://tinyurl.com">tinyurl</a> implements it by putting &#8216;preview&#8217; as subdomain <a href="http://preview.tinyurl.com/m5l96j">http://preview.tinyurl.com/m5l96j</a> and <a href="http://qr.cx">qr.cx</a> by putting &#8216;/get&#8217; behind the shortlink: <a href="http://qr.cx/1r8/get">http://qr.cx/1r8/get</a>.</p>
<p>curious as i am i decided <span id="more-1493"></span>to make a little experiment. i tried to make an extra long urlshortener chain. i started with a twitter post which i shortened with qr.cx. so far so good. i went over to bit.ly and shortened that link, then 1link.in, 2su.de, 3.ly, 6url.com, 9mp.com, adjix.com, and so on. see the complete list below.</p>
<p>interestingly there were a lot of services on my list that didn&#8217;t exist any more (LOST URL (domain grabber), TIMEOUT, NO ROUTE TO HOST (server down)). others &#8216;shortened&#8217; links that were actually shorter before (very useful)!!!</p>
<p><a href="http://blog.flo.cx/mycontent/2009/06/useful_shorteners.jpg"><img class="aligncenter size-medium wp-image-1501" title="useful_shorteners" src="http://blog.flo.cx/mycontent/2009/06/useful_shorteners-300x190.jpg" alt="useful_shorteners" width="300" height="190" /></a></p>
<p>just one service did delete my spam attempt in the 12 hours since i linked all these shorteners. just about 2 blocked other urlshorteners from beeing shortened.</p>
<p>every service did shorten the link above it (except when noted otherwise):</p>
<pre style="height:350px;">
<code>tweet on twitter 

http://twitter.com/flowolf/status/2312852042

http://qr.cx/8bm

http://bit.ly/1o4Rd

http://1link.in/zzvso

http://2su.de/d7

http://3.ly/2rr

http://4url.cc/ - TIMEOUT AT CREATION

http://www.6url.com/0ZHZ

http://9mp.com/zrEhS

http://a2n.eu - LOST URL

http://adjix.com/7ftd

http://a.gd/132bec

http://a.nf/dff3f1

http://arm.in/48J

http://b65.us - LOST URL

http://bit.ly/eKnP0

http://bloat.me/2Ax3

http://budurl.com/wghk

http://buk.me - LOST URL

http://burnurl.com/dp592p

http://canurl.com/ - LOST URL

http://chilp.it/?20c705

http://chod.sk/abxb8

http://cli.gs/BYZShQ

http://clop.in/HghGAA

http://clop.decenturl.com/asdf

http://doiop.com/m2m87j

http://dwarfurl.com/77751

http://easyuri.com/28af

http://easyurl.net/74612

http://fhurl.com/c10859

http://fly2.ws/a9q1MJ6

http://fon.gs/oblw5o/

http://foxyurl.com/7h4

http://fwd4.me/n96

http://fwdurl.net - LOST URL

http://g4.ms/62986f

http://g8l.us - suspended for spam

http://get-shorty.com/shorty/g4/

http://gonext.org - LOST URL

http://good.ly/g7i54l

http://gurl.es/dIQ

http://hex.io/16xq

http://idek.net/GXj

http://ilix.in/0dba2

http://is.gd/1cgO3

http://ix.it - LOST URL

http://j2j.de/tEM65G

http://jdem.cz/bnbk4

http://jijr.com/ - TIMEOUT AT CREATION

http://kisa.ch/9g54

http://kl.am/X5o

http://kore.us/mXiJ0j

http://kots.nu/2qq2da

http://krz.ch/60466

http://kurl.us - LOST URL

http://lin.cr/qwi

http://linxfix.de/y8zi7 - MANY URLS FOR SAME LINK POSSIBLE
http://liteurl.net - LOST URL

http://litturl.com/5e5

http://LNK.by/cVr

http://lnk.in - ACCOUNT NEEDED
http://lnkurl.com - LOST URL

http://lurl.no/hu

http://memurl.com/ - php error
   -  working on the system to prevent spammers - nice <img src='http://blog.flo.cx/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> 

http://xrl.us/bex9nh

http://micurl.com/i60p5j

http://migre.me/2Mdt

http://miklos.dk/!DpLrci

http://min2.me/4w

http://minilien.com/?KSFQfl5fB3

http://minurl.fr/nw8

http://minurl.org - SITE UNAVAILABLE (404)

http://moourl.com/m5vj8

http://muhlink.com - LOST URL

http://myurl.in/aVuHU

http://myurl.us - timeout
http://nanoref.com - ACCOUNT NEEDED

http://ndurl.com/6J

http://ne1.net - ACCOUNT NEEDED

http://faingai.notlong.com

http://nutshellurl.com/9i1

http://ow.ly/fLK1

http://pendek.in/007na

http://pic.gd/acf852

http://www.piurl.com/1lSq

http://plexp.com - LOST URL
http://plurl.me - NO ROUTE TO HOST

http://pnt.me/qIMJEs

http://poprl.com - TIMEOUT

http://pt2.me/2e

http://Puke.It/mvwm3p

http://qurl.com/v16ht

http://qurlyq.com/4l7

http://rde.me/lw

http://redir.ec/bDDv

http://redirx.com/?sdsn

http://r.im/1t17

http://rnk.me/ku

http://rubyurl.com/92DZ

http://safe.mn/8V

http://sai.ly/lQX

http://sfu.ca - timeout

http://shorl.com/sufebytuvode

http://shorterlink.com/?U1T92G

http://short.ie/bgwybm

http://shortlinks.co.uk/l5j

http://shortn.me/Ae

http://short.to/heur

http://alturl.com/mnhg

http://shrinklink.co.uk - NOT WORKING
http://shrinkr.com - TIMEOUT

http://shrtn.com/6

http://shrtnd.com - LOST URL

http://shrt.st/5ik

http://shurl.net - down
     - (Sorry, we're down for now. The link
         you followed most likely linked to a
         virus anyway)

http://shrt.st/5ik

http://simurl.com/huccut

http://smallr.com/a6p

http://smallr.net/ - YEAH blocked the above url!
http://smallr.net/5y6 - shortened http://shrt.st/5ik
http://smarturl.eu - EMPTY SITE

http://smfu.in/736491

http://snipr.com/kt2jp

http://sn.vc/1LUQ

http://song.ly/l/1djtku

http://srnk.net/p9NsG

http://starturl.com/evwer

http://su.pr - ACCOUNT NEEDED

http://surl.co.uk/?8840

http://tighturl.com - YEAH is blocking other shorteners!

http://www.timesurl.at/2ddada

http://tini.us - DB ERROR

http://tiny123.com/0vd

http://tiny.cc/uttcx

http://tinylink.com/?TD5EWc1gsF

http://tinyurl.com/mzob3o

http://tobtr.com - LOST URL
http://to.vg/iq - blocked tinyurl,
     accepted http://tinylink.com/?TD5EWc1gsF
http://traceurl.com - ACCOUNT NEEDED

http://tr.im/pDAV

http://twurl.nl/whwpyp

http://twip.us/tw3zb9

http://twirl.at/wi

http://twitpwr.com - twitter ACCOUNT NEEDED
http://twitthis.com - twitter ACCOUNT NEEDED

http://tw6.us/iy

http://uiop.me/A8

http://u.mavrev.com/dvpg

http://unfaker.it - LOST URL

http://u.nu/6cie

http://ur1.ca/688n

http://url9.com/za

http://urlborg.com - google ACCOUNT NEEDED

http://urlbrief.com/63ba41

http://url.co.uk/7m860

http://urlcover.com/edr

http://urlcut.com/1rqbk

http://urlcutter.com - NO ROUTE TO HOST

http://urlhawk.com/fxp

http://url.ie/1wwo

http://url.lotpatrol.com/?x=3298

http://urlsmash.com - LOST URL
http://urltea.com - SITE UNAVAILABLE (404)

http://urlvi.be/mbuhu

http://ur.ly/yds

http://urlzen.com/knr

http://virl.com/8d045

http://vl.am/I23

http://vtc.es/cBx

http://w3t.org/90b3b

http://wapurl.co.uk/?G21FSRW

http://wlink.us//2fx

http://www.canurl.com - LOST URL
http://www.digbig.com - ACCOUNT NEEDED

http://dwarfurl.com/7ddf0

http://www.ezurl.eu - SITE UNAVAILABLE (404)

http://fly2.ws/e-ZoUuY

http://www.shortenurl.com - LOST URL

http://alturl.com/o2a6

http://shredurl.com/XL

http://www.urlpire.com/?QFBGK

http://www.x.se/vbg9

http://x.vu/1695

http://zi.ma - NO ROUTE TO HOST

http://zz.gd/6d3160

http://nic6g.th8.us

</code></pre>
<p>i would not recommend visiting all these links! this can take a LONG time. although it is interesting to see what different shorteners do. some just grab the long url from the database and redirect you (0.2 seconds), some add a frame (gets really ugly with a lot of shorteners in a row <img src='http://blog.flo.cx/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' />  ), some need confirmation to proceed and some just wait 10 seconds before they do something.</p>
<p>this nice little experiment showed me how little these service providers care about security. i&#8217;m curious if this is going to change. maybe just with the more popular services.</p>
<p>No related posts.</p> <p><a href="http://blog.flo.cx/?flattrss_redirect&amp;id=1493&amp;md5=db56e1cc03a7546a47ff64290def3e83" title="Flattr" target="_blank"><img src="http://blog.flo.cx/wp-content/plugins/flattr/img/flattr-badge-large.png" alt="flattr this!"/></a></p>]]></content:encoded>
			<wfw:commentRss>http://blog.flo.cx/2009/06/loops-and-stretching-with-urlshorteners/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		<atom:link rel="payment" href="https://flattr.com/submit/auto?user_id=30067&amp;popout=1&amp;url=http%3A%2F%2Fblog.flo.cx%2F2009%2F06%2Floops-and-stretching-with-urlshorteners%2F&amp;language=de_DE&amp;category=text&amp;title=loops+and+stretching+with+urlshorteners%26%238230%3B&amp;description=there+has+been+some+discussion+%28via+%40mstrohm%29+on+the+security+of+urlshorteners+and+i+have+been+thinking+about+this+the+past+days.+putting+the+problem+of+the+bottle+neck+aside...&amp;tags=bit.ly%2Cinternet%2Cnet%2Cqr.cx%2Csecurity%2Cspam%2Ctr.im%2Curl%2Curl+shortener%2Cblog" type="text/html" />
	</item>
	</channel>
</rss>

