I'm still not sure why we're now basing our entire economy around advertising crap to people that they don't want or need, the web was ad free and worked great for many years before all this nonsense.

The fact that most all of the smart people in tech have been subsumed into ad tech is one of the most depressing things I could have possibly imagined 21 years ago. What a massive misuse of resources.

If I click on an ad for funeral services I might buy something but probably won't. But I may have just confirmed that a close relative just died. That factoid is worth something to a great many people beyond the local funeral parlor who paid for the ad. I should expect real estate agents and quack financial advisers to be knocking on my door by the end of the day.

Found via https://www.reddit.com/r/ProgrammerHumor/comments/8a3oku/bra...

I see 3 models for websites: completely donation based, advertising based, or subscription based. Many sites would have trouble getting the donations they would need to operate. Subscription based means only rich people can afford to use it. Advertising means poor people get the same functionality as rich people.

As with most things on the internet, the porn industry did it first.

That subscription might be reasonable for a middle class person in the US, but way too expensive for the average person in a poorer country. Ads put everyone on the same footing.

And if you want to do research on a topic across many different websites, it'll happen that they won't all be in the same community, so you'll have to pay subscription fees to many different communities, sometimes just for a single page view.

Of course it was canceled at some point, and now it looks like there is some meager effort to require sites to opt-in somehow.... I can't tell if any sites have actually done so.

Too bad, because I really liked the old experience.

Using it to keep up with politics or news can quickly lead you to some of the most highly concentrated cesspools of humanity's worst thoughts. There will be abject ignorance or just plain noise among the top replies to pretty much any tweet by The Economist, the New York Times, Barack Obama (actually any politician), ...

However, I've found it healthy and helpful to tap into active communities built around certain computer science topics, like machine learning, or "ML Twitter."

The problem is that twitter follows the redirects to show the final URL, presumably to support advertising companies that use third-party link tracking software like bit.ly, if they just showed the actual link they wouldn't have this problem.

Visit https://cards-dev.twitter.com/validator and paste in the spam URL there. You'll see that the validator warns that it is being redirected, but follows it anyway.

CNN is blameless (as far as I can tell).

I’m thinking through how Twitter would combat something like this. IMO they would flag new domains for manual approval (or hey, require TFA for self-serve ad accounts!) but both of these add to the cost and friction of their adtech.

Always a bummer when good security practice gets overruled by the need to squeeze every cent of revenue they can.

Display the real link domain by default, but offer custom domains for manually verified advertisers. That obviously involves some degree of cost, but it's worthwhile to preserve trust in the platform.

twitter's bot can pull the link via Tor with a randomized UA

I can detect public Tor IP addresses and give them a different redirect with Zerodrop: https://eligrey.com/blog/zerodrop/

For links in Tweets, they can show the actual URL (domain part at least) instead of the t.co shortened URL.

[1]: https://charlesngo.com/cloaking/ [2]: https://support.google.com/adspolicy/answer/6020954?hl=en#31... [3]: http://fortune.com/2017/08/09/facebook-cloaking-spam-adverti... [4]: https://wp.josh.com/2019/05/06/breaking-news-google-adwords-...

Ad campaigns commonly use tracking redirects and it may be an intentional Twitter feature that the preview card hides intermediate domains.

https://news.ycombinator.com/item?id=19858552

You have to ensure that the damage is limited and reversible even if your trusted users (or worse, staff) are hacked or turn malicious. Though this system is usually harder to build and generalize.

The author could've used screenshots, but he wanted to use a live example, so instead of giving the non-technical person a straight link to ads.twitter.com, he just told him he'd written an article on the problem [0]

[0]: https://twitter.com/Fishblogger/status/1132737507827834885?s...

1. https://twitter.com/sephr/status/1056626456770428929

2. https://twitter.com/sephr/status/1055751684146655232

I'll be setting up a Mastodon machine soon, deleting my Twitter account, and making sure that my posts are forever owned by myself and my online voice can't ever be taken away from me again.

Obviously, if you load the image directly, it'll still be webp.

It has fiddled my .htaccess to

RewriteCond %{HTTP_ACCEPT} "image/webp" [or] RewriteCond %{HTTP_USER_AGENT} "Page Speed" RewriteRule .* - [E=Cache-Control:vary=%{ENV:LSCACHE_VARY_VALUE}+webp]

But... now I think about it, I probably still have CloudFlare cacheing on. Which means that won't get hit some of the time. Hmmmm.... Let's see if my server can survive HN without a CDN.

Essentially, my t-mobile mobile phone number was hijacked (despite I had a PIN, which the attacker didn't need - poor security practice by t-mobile), and after that they proceed to change the password of my Twitter account using the phone.

Thankfully I was close to a t-mobile shop in San Francisco, and ~40 minutes later I regained control of my SIM card. Nothing else has been affected so far.

FYI, T-mobile can't be sued for damage resulting from something like this. We have to "thank" judge Scalia for this.

As of now, Twitter is slowly responding to my issue, despite I had a few friends there try to help.

[0]: https://news.ycombinator.com/item?id=19998553

Thank your legislature, not your judiciary.