Hacker News Reader

Hacker News

Comment by criddell | Hacker News Reader

Full thread

criddell

Microsoft does this with Skype too. They say it's for detecting malicious links.

View on HN

As always in big tech, you're damned if you do and damned if you don't.

Oh, I don’t know. I refuse to use Facebook Messenger and I have yet to be damned (at least to my knowledge)!

I meant from the perspective of tech employees that have to decide whether to add this kind of monitoring.

Honestly, This is good to prevent malware but I imagine this breaks a bunch of things if for eg. If the link has a limited visit count. The link will "expire" before the recipient gets a chance to view it.

To be fair, an HTTP GET request should never modify the state of the system - hitting a link should not change anything.

If you need to expire links then make the initial link display a form with a submit button (which does a POST) to reveal the content (and expire the link). Legitimate crawlers don’t submit forms so it should be safe.

> To be fair, an HTTP GET request should never modify the state of the system

In theory. But that's not how the world I live in seems to work.

I think it's pretty common practice. Otherwise search engine web crawlers would be wreaking havoc.

No, both your logic and premise are incorrect. To give just one example, rate-limiting is clearly widespread stateful practice applied to GET requests, and it doesn't cause web crawlers to wreak havoc on anything.

So they might as well don’t; at least then we get some modicum of privacy.

This is certainly how I feel, but "damned if you do and damned if you don't" doesn't imply that the level of damnedness is equal. The balance between fettering "malicious" speech/activity and preserving privacy seems to be strongly tilting in the mainstream towards the former recently; "tech platforms have a responsibility to heavily police the content on their systems" is apparently a lot more resonant with most people than "tech platforms should preserve the privacy of their users".

Why not simply ask the user then?

I have absolutely no problems with the don't. I don't think any central body should be responsible for policing my private conversations and it just seems like a convenient excuse for these companies to perpetuate the surveillance.

And all email into Office 365. Gets pulled into a sandboxed environment where items such as pdfs, in fact all attachments, are ‘exploded’ and all the links investigated ie executed and checked for malicious end points or payloads. I was in a meeting recently with someone from Microsoft where they explained this (I might be misrepresenting what she said, she was an expert in this field, and I’m definitely not). I was shocked though at the capability of the system to examine content so such an extent.

If Microsoft really wanted to help Skype security it would be pretty easy to realise an account has been hacked when people are suddenly message a link to all their contact list they never have for 10 years.

The amount of time I've gotten those obviously spammy links form people I have never talked to in a decade plus.... cant be hard to red flag these.

And I do appreciate that they're doing that even. I want that, just like I want spam filtering on my email.

It's what else might be going on with the link analysis that's worrisome.

Just remember that almost every feature that’s “announced” is a masquerade for ad-tech software to do its thing.

Example, Facebook asking for phone numbers in the name of “security” when they don’t give a shit about security. They wanted to tie a phone number to the owner, and create a social graph based on their contact uploads.

Reply on news.ycombinator.com