This seems simple to fix - deactivate all links that didn’t become part of a published comment.
I’m sure this is hard, especially at that scale - then again it seems doable eventually.
I’m sure this is hard, especially at that scale - then again it seems doable eventually.
If you set it to short (hours) it'll be pretty annoying and confusing for people. If you set it too long (more than a day), scammers will just keep generating new links.
It's not that simple to fix, certainly not with these kind of timeouts. The only solution is to not have a "trusted" URL like that.
> This seems simple to fix - deactivate all links that didn’t become part of a published comment.
Currently, a major convenience for the malware spreader is being able to put malware on the server and get a usable URL back without submitting the comment. Deactivating links for unsubmitted comments that were canceled is orthogonal to identifying malware, and wouldn't make the comment readers more vulnerable than they already are.