24

I came across this suggested edit on Movies.SE this morning. The edit cut out two shortened links (TinyUrl), claiming they linked to a virus, and added a disclaimer not to click said links in the answer, defacing it. I rejected it with the following custom reason:

That's a good intention but also contradicts author's intent, and can't easily be verified. I'll drop that in chat and see, thanks if it's confirmed

I did post it in M&TV chat, asking for advice in future similar situations, but to no avail so far - and I reckon this might be of interest network-wide.

My issue here is that the edit does conflict with author's intent, but if it's done in good faith, it raises an obvious security problem. On the other hand, once I'm presented with someone saying the link is malicious, I have zero intention of clicking it to check. So, as a reviewer, what action should I take?

  • Approve: in the present case that makes no sense because of the defacing bit, but barring that it might sound reasonable. I have not checked whether the link is malicious though, so I could be taking part in the loss of somewhat valuable information.

  • Improve Edit or Reject and Edit: same thing, as I haven't made sure whether my edit prevents an actual security threat, this doesn't sound optimal.

  • Reject: but I'm still not sure the links are safe!

  • Skip: I can, but other reviewers will (I hope) have the same question I did.

Couple of thoughts:

  • sure, as always I can mod-flag. But I'm guessing at least one mod will have the same question, won't they?

  • there is a bit of guidance out there basically saying "if you're going to make drastic changes to a post for security concerns, please leave a comment and post your own answer instead". That works fine(ish) with code, but links? How many people read comments to check links in posts aren't malicious? And posting a new answer without links, in this case, doesn't make sense.

  • something that comes to mind to check whether the link isn't evil is to try it from a virtual machine, but that's not 100% reliable and isn't something that could/should be expected from curators.

Advice?

Improve this question
7
  • 4
    Always flag for moderator. if it is a virus then at least their computer is infected ... wait ...
    – rene
    May 15, 2019 at 15:44
  • 4
    I would say that the edit is inappropriate. However, it would be fine to raise a moderator flag on the basis of potential harm in the post. (How a moderator should then deal with it is another question that I don't really know the answer to.) I do think that simply stating there are malware links is not very useful. Anybody could say that about any link. Something more substantive should be provided.
    – Jason Bassford
    May 15, 2019 at 15:44
  • 16
    If you're unsure and don't want to open it, you can always use an online tool that traces all the redirects of a URL like getlinkinfo.com -- in this case, the URLs appear to end up at an Amazon page for the books, which is clearly not malicious. Despite some of our distaste for anything Amazon. I would still edit the links, though. They clearly used TinyURL to preserve their own affiliate slugs for the Amazon links (because we automatically add our own and strip others). That's a stupidly annoying use of a URL shortener that prevents users from seeing where it's supposed to go.
    – animuson StaffMod
    May 15, 2019 at 15:47
  • 3
    @animuson That getlinkinfo site is both really helpful and something I'd never heard of before. Could we put that in a FAQ or How-to somewhere for dealing with obfuscated URLs?
    – DavidW
    May 15, 2019 at 16:05
  • There are also a lot of extensions for browsers you can get
    – Stormblessed
    May 15, 2019 at 16:24
  • 4
    Re: "...there is a bit of guidance out there basically saying "if you're going to make drastic changes to a post for security concerns, please leave a comment and post your own answer instead".". I don't think that piece of guidance meant for these kinds of security concerns. It's probably aimed at sites like Stack Overflow where inexperienced users often post codes which are prone to security pitfalls (like SQL injection). Simply leaving a comment on a post which clearly contains a link to a virus doesn't make sense. Those should be edited out and reported as soon as possible.
    – user437611
    May 15, 2019 at 17:10
  • Have you seen preview.tinyurl.com?
    – forest distrusts StackExchange
    May 17, 2019 at 1:44

2 Answers 2

Reset to default
10

Depends. In the specific case you cite, Reject and Edit would have been the correct choice. In general, I'd always replace shortened URLs with the corresponding elongated versions as that helps users to have a rough idea of where the link is pointing to if they hover their mouse over it. Now your particular issue seems to boil down to "how should I check whether a link is safe without opening it?".

Firstly, as @animuson suggests you could use a redirect checker to detect where the link points to. Then check the target URL using something like Google's Safe Browsing Site Status and VirusTotal, which will let you know if there's any known malware on the site. To get more details about the domain, you could also plug the URL into Wolfram Alpha. Finally, if you do find anything suspicious about the domain, it's best to edit out the link(s) (ideally, without damaging the rest of the post), flag for a moderator and perhaps leave a comment for the OP asking them to add an alternative non-suspicious link instead.

Improve this answer
0
7

In this particular case, you can replace tinyurl.com with preview.tinyurl.com. This will show you what site it is going to redirect to. In this particular example, you can see that both of the allegedly malicious links redirect to Amazon. If it's ever not as obvious, you can safely visit the link by prepending view-source: to it. That will cause the browser to fetch the raw HTML and display it as plain text, rather than rendering it and potentially running malicious JavaScript or triggering a download.

Visiting the TinyURL preview page will show something like this:

Preview of TinyURL.com/S4Jericho
This TinyURL redirects to:

    http://www.amazon.com/Jericho-Season-4-Kalind
    a-Vazquez/dp/1613776047/ref=sr_1_1?s=books&am
    p;ie=UTF8&qid=1366906961&sr=1-1&k
    eywords=jericho+season+4

Proceed to this site.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .