Hacker News Reader

Because you are installing programs on your computer from a "shortened URL", which could point anywhere. Your examples use a URL that is the final destination so you can make an informed decision whether you are willing to trust that URL.

If you use the "append a +" bit.ly feature, you can check where it ends up, but not everybody knows to do that. https://bitly.com/psChocInstall+

View on HN

A non-shortened URL can point anywhere as well. The only way to "make an informed decision" is to put the URL in your browser—that goes for shortened and non-shortened URLs.

If I were to attack someone with such a scheme, I would take care of serving clean files to a web browser (say, with the user-agent string) and the infected files to command-line invocations. :)

Yes, that's quite a security risk, but it also affects shortened and non-shortened URLs equally.

With a non-shortened URL you have one attack vector, hack the website. With a shortened URL you have two attack vectors, hack the website or hijack the shortened URL to point to your own server.

Would providing the full link be a better idea? For the installer experience, people wanted short and memorable.

Reply on news.ycombinator.com