http://www.archiveteam.org/index.php?title=URLTeam
(edit: and you can imagine how useful that's going to be once browsers start checking the Wayback whenever they see a 404... we're getting close to starting a trial of that with Firefox, with other browsers to follow.)
That's not the primary use-case for it[2][3], but we're happy to support people shortening URLs if they want to. The reason there's room for this is that our URL shortening function has no ads, no third party tracking, no bloat ... no dark patterns.
That's worth something to some people.
[1] Oh By, Inc.
But it’s still a closed, proprietary database and there’s no way to decode an “Oh By Code” if the service goes down, which is the disadvantage number one you have with URL shorteners.
> The real utility are the easily recognizable codes, prefixed with "0x".
Why not using a prefix that helps differentiate your codes from hexadecimal numbers? How do you plan to get people to know your service if it’s not recognizable? Let’s say I put one of those codes on my business card, I still have to write somewhere that people should use 0x.co to access the content, which ruins the advantage of having just one code rather than a URL to my website (literally anyone knows how to open a URL in a browser).
I used to run a public one but it was getting abused for spam so I stopped.
And when your URL shortener goes down, all links are dead. Shortening URLs is the last thing you want to do when you need to preserve pages that might go down. Caching is a better solution.
q3k@nihilism ~/Projects/longs $ python2 -c "print 'GET / HTTP/1.1.\r\n' + 'a'*2000 + '\r\n\r\n'" | nc 127.0.0.1 1337
q3k@nihilism ~/Projects/longs $ PORT=1337 ./longs
*** Error in `./longs': free(): invalid next size (normal): 0x000000000155a5f0 ***
...
EDIT: It also throws a whole bunch of warning when compiling. [moved this here from the first line after child post mention]
I don't have much experience with C outside of embedded systems, so my security practices in C are probably less than ideal for PC/server based code.
Cool hacks are cool I guess but from the sounds of it, the C code is a bit scary. If you had to build this, why not build it in Rust? At least it wouldn't be so terrifying from a security standpoint and you'd still get whatever performance is supposedly needed.
It really isn't a project that I'd recommend to anyone, unless I wanted a shell on their machine. I'm quite distraught that it is getting this many (seemingly blind) upvotes.
https://www.reddit.com/r/C_Programming/comments/4p5ung/longs...
(After a few minutes of poking)
I can see at least one buffer overrun dependent on database contents, and I wouldn't be surprised if there's public-facing vulnerabilities in this thing, but I don't want to spend another 5 minutes looking.
https://github.com/riolet/longs/blob/master/longs.c#L238 looks like an example of a buffer overflow.
Etc.
But that said, building a proper HTTP stack is not trivial.
If you want to use C language, then why not create Nginx module?
Nginx already solved the hard problems:
* HTTP parser
* Distribute work via event loop on multiple workers
* Useful load balancing strategies (not as great as HAProxy, but i am satisfied with it)
* Serious effort in dealing with CVE
* Widely used and battle tested
Here's a fine guide on how to write Nginx module in C: http://www.evanmiller.org/nginx-modules-guide.html
Here's the short url of http://news.ycombinator.com --> lon.gs/amk
Going to lon.gs/amk redirects me to an overstock.com address for a specific product.
The site doesn't appear to have been hacked, at least there's no affiliate link in the URL I was sent to. It just appears the site is broken.
So to sum it up - a great post, excellent work with a tool that has a lot of potential for specific scenarios. When deploying if using things like Cloudfare Edge and giving it a bit of Productizing (my day job is as a Product Manager for a global ERP business) then this could be a hit (pun intended :-J ).
YOURLS was popular for a while, and I tried it, but I was concerned with running a not very popular PHP app even on shared hosting. At least Wordpress gets decent attention. I was worried of people compromising my own YOURLS instance against me.
http://www.cvedetails.com/vulnerability-list.php?vendor_id=1...
No idea about equivalents for nginx, or something that could run on Github Pages (these would probably be the same, given that nginx doesn't have an equivalent to .htaccess out of the box).
This is why you should never use C in networked code or when working with third-party data unless you absolutely bloody well have to: It's just too many ways to fuck up, and most programmers will.
$ curl -i http://lon.gs/abf
HTTP/1.1 301 Moved Permanently
Location: foo
X-Evil-Header: evilvalue
(they claim to have fixed this elsewhere in the thread, but I guess some of the "evil" URLs still work)
EDIT: Very strange, the redirect now goes to a URL I didn't enter... (http://www.sadfasdfasfdasdfsadfasd.com)
What are the api endpoints? docs? Can you view a list of all shortened urls? Can you delete shortened urls?
Can you change the base domain of lon.gs?