115

I've had this happen on a couple of my old answers using JSBin: I'd done up a quick example and linked to it like this: http://jsbin.com/iyucuy (not marked up as a link on purpose, keep reading). At the time that was correct, but the way JSBin works, if you do a raw link like that, following it automatically redirects you to the most recent edit. Spammers figured that out and edited a bunch of bins for their nefarious purposes (that's what's happened to the link above). Also, people following the link and then modifying things for their own purposes inadvertently also make the SO link go the wrong place.

Linking instead to the original version (http://jsbin.com/iyucuy/1/) fixes it.

Could we do a wholescale, mass-edit doing something effectively like this (expressed in JavaScript just for the example);

postText = postText.replace(/(http:\/\/jsbin\.com\/[^/\s\r\n]+)\/?(?=[\s\r\n]|$)/g, '$1/1');

E.g., converting http://jsbin.com/identifier or http://jsbin.com/identifier/ to http://jsbin.com/identifier/1 but leaving http://jsbin.com/identifier/2, http://jsbin.com/identifier/43, and such alone?

Unsurprisingly, a DSE query asking for a count of all such posts times out, but this ugly query suggests that I personally have over 500 unversioned JSBin links out there (if I haven't screwed the query up, my test data is in it as a comment), which is out of about 1500 JSBin links total in my posts. I'm an outlier, but still, I suspect we have a lot of these out there, and that a good portion of them are linking to nefarious websites.

Obviously such a bulk-update would need to be done carefully...

(Is this a ? Pretty sure it's not ...)


(This is yet another reason Stack Snippets need some love from SE development. So people aren't tempted to use off-site resources like JSBin or jsFiddle that SE can't control. I always use snippets when they don't block features I need to show what I'm doing, but I've heard more than a couple of people say they were "so broken" that they just don't use them at all.)

7
  • 47
    Yikes. That's a nasty problem. Commented Apr 30, 2016 at 9:38
  • 46
    Other people can create new default versions of someone's jsbin? That's a terrible design on jsbin's part. Commented Apr 30, 2016 at 22:37
  • 1
    @AlexanderO'Mara: Absolutely terrible, yes. You can kinda see how they got there, but... I think they've changed it now, but it was like that for a long time. Commented May 1, 2016 at 7:30
  • 8
    This is why I've never liked JS Bin, and I've always had a very hard time working with any answers that rely on it.
    – BoltClock Mod
    Commented May 1, 2016 at 8:44
  • 1
    @BoltClock: Yeah, JSBin is far from the best of these sorts of tools. Many, many moons ago, JSBin was my preference of jsFiddle because A) It was a lot faster (still is, particularly with those ads on jsFiddle now), B) It didn't have the Truly Surprising Default of wrapping everything in a window.onload function, and C) It worked with IE6-IE8 when that was still a thing. But yeah, it's always been a bit of a pain to use, and I don't use it anymore. Commented May 1, 2016 at 9:07
  • 2
    @T.J.Crowder wait, jsfiddle has ads? Somehow I never bothered to check uBlock. Commented May 2, 2016 at 10:11
  • @JanDvorak: Yes, lower left-hand corner. Frequently (for me here in the UK) the ad script prevents jsFiddle from loading for ~10-30 seconds. I don't fundamentally have any problem at all with a discreet ad block to help fund the server(s), but it would be nice if it didn't cause load problems. Commented May 2, 2016 at 10:14

1 Answer 1

52

I'm the author of JS Bin.

Firstly, the redirect spam has long been a problem, and (I can only assume) since JS Bin is coming up on 8 years old, it's been the goto tool for abuse.

I addressed the redirect spam a few years ago with this: http://jsbin.com/blog/security-limited-output#limitedfulloutputforanonymousbins - but I can see, with the bin you raise in particular, it's still a problem, and maybe I should be harder on my redirection to the editor (which blocks these redirects). If it makes sense, I can apply this to all anonymously created bins (it actually makes sense from a security POV).

The bigger issue (for your community) is that the "version-less" URL always redirects to the latest bin. And historically, anonymously created bins would allow other anonymous users to add to the history (this was also closed off a number of years ago - the exact date I'm not 100% sure of).

I get that the intention is to move away from 3rd party bin services, but I wonder if there's anything I can do to work with your community to fix these URLs in the mean time.

The problem that needs to be solved is knowing what version the URL intended to link through to. Possibly the easiest and dirtiest solution is to always link to the first revision if the referrer is stackoverflow.com? It would obviously get the wrong result for a good deal of other bin URLs, but it would probably address a LOT more of the spamming issues.

I definitely understand @Boltclock's issue and I'm not sure there's anything I can do on JS Bin's side to raise confidence, mostly because it's a legacy problem.

Anyway. I'm here, someone pointed this thread out to me on Twitter (I'm @rem), if you want to me to see if I can make any changes that help, please do get in touch (or via an issue on https://github.com/jsbin/jsbin/issues/new).

12
  • 43
    Extremely good of you to offer to spend time on this. Commented May 2, 2016 at 14:06
  • But I think we have to fix it at our end, the redirect based on referrer would be too fragile (think right-click copy-url-to-clipboard). That is, unless you wanted to globally change JS Bin's behavior with versionless URLs (e.g., go to first, not latest, latest version), which is a pretty big behavior change to apply globally. Or perhaps do that for bins that are likely susceptible to this problem? E.g., before you plugged that hole? Commented May 2, 2016 at 14:08
  • (A note about this meta site: People will vote up/down based on whether they think the answer is a good solution to the problem, as distinct from being really great of you to offer to help. So if you don't see massive upvoting on this answer, please know that it's not because the community doesn't value the offer, which is very kind.) Commented May 2, 2016 at 14:09
  • Hey Remy. (You might recognize me from Twitter ;p) Yeah I see this is a nontrivial issue. Just wanted to let you know I do admire the work you've put into JS Bin even though I don't personally use it and I avoid questions that rely on it for the reasons mentioned. Hopefully the spam problem can be mitigated in any case!
    – BoltClock Mod
    Commented May 2, 2016 at 14:22
  • 3
    I've taken a quick look at the JSBin source code and I see you're keeping track of the creation time of each revision. A stopgap measure could be to let the un-versioned URL redirect to the latest revision that isn't too far from the previous one. (So if one version is from February 2015 and the next is a year later, JSBin will redirect to the former.) Commented May 2, 2016 at 14:41
  • @T.J.Crowder - that all sounds reasonable. Aside: I wasn't looking for upvotes, just wanted to reach out to let you all know I'm here if there's anything I can -try- to do :)
    – Remy Sharp
    Commented May 2, 2016 at 14:43
  • 1
    @T.J.Crowder sorry, meant to add that, yes, it would be too big of a behaviour change to switch the versionless to default globally. That said, I think maybe you're on to something WRT to applying this only to the July 2004 posts. user2428118's suggestion isn't too bad, but could quickly end up doing many queries just to find the "best" latest bin. But I'll take a look at that too.
    – Remy Sharp
    Commented May 2, 2016 at 14:46
  • 2
    As for preventing future abuse, how about "freezing" the default version number if a bin is shared publicly - for example, if it is visited from a non-JSBin referrer, an unknown IP block or simply any visitor who doesn't have the session cookie associated with the creation of the bin. Commented May 2, 2016 at 15:01
  • 1
    (For lurkers: Remy meant "...only to posts before July 2014..." above e.g., when he made the change [described here.) Commented May 2, 2016 at 16:50
  • In addition to freezing the default version once a bin is shared publicly, perhaps you could also freeze the default version after a bin has been inactive for some time period (a week? a month?).
    – Teepeemm
    Commented May 2, 2016 at 19:52
  • 1
    How about allowing an "as of" DateTime parameter in JSBin and updating links from SO to use the DateTime of the post revision when the link was added?
    – psaxton
    Commented May 2, 2016 at 20:09
  • I think @psaxton's suggestion might be closest, but I'm not 100% sure that the database is optimised to pull this off cleanly (but I will take a look). The UI for JS Bin had an overhaul some time ago along with URLs. If you share a URL, only the owner (if they're signed in) can add changes. If it's via the "share" box, the options are clear. If it's via the location bar, it's always latest...and I've discussed this at length, I'm not sure there's anything I can do...
    – Remy Sharp
    Commented May 2, 2016 at 21:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .