Hacker News Reader

Comment by hericium | Hacker News Reader

Yes, it's hard to give the poster benefit of the doubt.

I haven't run https://top-fwz1.mail.ru/js/code.js myself but a quick glance at it seems to indicate that it tries to harvest data from the page (references to "gender", "age", etc) and some shady-named variables like "bait". Also a function that fetches data from top-fwz1.mail.ru and then tries to submit a hidden 1px*1px form created in an iframe using this data and who knows what else.

All other archive.ph links from the poster seem to contain the same JS code from mail.ru, which makes it either doubly suspicious, or just means their computer or network is infected with something that injects it into their pages, who knows.

Thanks - nice quick research. I have flagged this user's recent submissions containing his comments with links to archive.ph.

See my other comment though, it seems like the injection is performed by archive.ph itself. I tried to archive simply my own blog (a very simple page without any JS) and the script gets injected there as well.

So it might just be a coincidence that mitchbob happens to be the one who posted a link where that script gets noticed. It's hard to know for sure of course.

I've seen it and only flagged posts with [comments by the same author with links to] malicious content. It doesn't matter whether user is affiliated with this content's host or phishing campaign since this is most of his HN activity. This should stop even if is unintentional.

If you think someone's doing something wrong, email the mods. You can't be starting some innuendo campaign and vote brigading against some user just because you have a bad feeling about their posts, that's in the guidelines.

I've flagged malicious content and don't consider this brigading. When I saw that this isn't a problem with a single account, I made a Tell HN[1] 20 minutes ago to tell both mods and the community to exercise caution.

[1] https://news.ycombinator.com/item?id=30670319

Again, if you think someone is doing something wrong, do what the guidelines tell you and email the mods. Same goes for voting stuff. Tell HN doesn't tell the mods anything, they don't see every post and comment.

archive.is and its variants have been a popular way to link to archived articles on HN, and elsewhere, for years now.

There's no reason to believe that mitchbob was doing anything other than trying to be helpful to users. Tons of legit HN users do that. Let's not pick on one to make a witch out of.

Fuck, have you never seen an analytics script before?

>All other archive.ph links from the poster seem to contain the same JS code from mail.ru, which makes it either doubly suspicious, or just means their computer or network is infected with something that injects it into their pages, who knows.

This is top.mail.ru, a very common analytics platform not different from google analytics. Archive.today uses it.

What’s the purpose of this witch hunt? Xenophobic bullshit over the .ru TLD?

Mitchelbob appears to post dozens of links to archive.ph and not much else, is this an organized phishing attempt or just an issue with archive.ph?

Come on you guys - users obviously do that because they want to be helpful to readers. If you look through mitchbob's comments it's not hard to find perfectly legit posts on other things, e.g. https://news.ycombinator.com/item?id=30435861

... indeed, looks like all the recent links to archive.ph that I can find in HN comments (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...) have this same JS code injected.

They seem to submit a link then post an archive.ph link as a comment.

What could possibly make you think that this was a phishing attempt?

Because you are a xenophobic asshole and think all Russians are evil hackers trying to steal your data? It’s really sad to see such nastiness rearing it’s head on HN.

top.mail.ru is a huge analytics platform, exactly like google analytics, run by the biggest tech company in Russia.

Reply on news.ycombinator.com