the ability to edit titles is great. But the ability to edit the URL of a post is dangerous. - Lemmy.ml
the ability to edit titles is great. But the ability to edit the URL of a post is dangerous. - Lemmy.ml
1. I create a well crafted post to a normal site that gets 10.000 upvotes. 2. I change the URL to a malicious site. 3. ??? 4. Profit
I don't know how to crosspost properly.
I think this is a serious design flaw. If you agree please upvote the post on lemmy.ml community for visibility
Yeah this seems like a pretty huge oversight. I'd file an issue on GitHub ASAP.
I hadn't even come across it yet but holy hell that's a scammer/malicious actors paradise.
On Kbin's end the thread ID is
57540and the appended text is simply a hint to what is on the other side of the link (i.e. it doesn't change anything). This is standard practice and you see it a lot across the web
Try this: https://kbin.social/m/[email protected]/t/57540/THLPFWYHYULHDTPUYWHDUYPHWUDUYWHUYDWHUYWHPDStackOverflow had the same feature until people started abusing it for SEO. After that, they decided to remove the option.
Makes sense. SE is profit driven. They want to be at the top of the list when people Google stuff.
For a service like this tho, is that really that big of an issue?
There is also now way to see the underlying url of a hyperlink in the Jerboa app.
I kinda like it, but it should be operable for the mods (so it flags it for them to check, or whatever automod eventually shows up can hide the post until it's cleared)...
I like the ability to edit, but agree that some kind of limitations should be on it. Requiring mod review of a URL change would, at least, put one level of check into the system. The other option would be to simply allow only mods to change the URL. That doesn't prevent a bad actor who is a mod, but that seems less likely than a standard user.