This Link Could Have Been Anything [Reddit Spam Issue]
By Daniel Miessler on June 5th, 2007: Tagged as Reddit | Security | Spam
Dear Reddit Team,
As you will no doubt have already noticed, this link does NOT reside on reddit.com, despite it appearing like it did on the website.
This means that people are currently able to post links to any domain they want and make it look like it came from the reddit domain (see image below).
<
p style=”text-align: center”>
(clearly not the case)
I’ve sent you (the Reddit team) an email through the feedback function and will be happy to show you how I did it (assuming you don’t already know) as well as offer any other assistance.
Kind regards,
– Daniel Miessler E: daniel@dmiessler.com W: http://dmiessler.com G: 0xD4A8FFF6
[Edit] I haven’t heard from the reddit team and someone’s figured it out in the comments, so I’ll go ahead and mention it here. The problem is that all links on the reddit page don’t point to the real destinations, but rather to reddit-homed redirects for the purpose of counting clicks. This means that when you submit something, reddit makes a nice reddit-based link to any domain you submit. If you then submit THAT link you reproduce the effect.
I think one solution would be to place the target domain in the reddit-created link so that it can be filtered when people submit links that point to the “reddit” domain. So:
--
if link points to reddit.com
check to see target domain
if not reddit.com
drop input
else
let it through
--
[Edit 2] The reddit team finally contacted me and acknowledged the bug, so I removed my story from the site. I find it commendable that they didn’t remove the link themselves; and they didn’t even ask me to do so. Kudos to reddit.:
