logoalt Hacker News

Aachen • yesterday at 9:31 PM • 0 replies • view on HN

Usually the file is already gone by the time they finished reporting it, but otherwise delete and ban the uploader if it's a valid report. Criminals don't seem to use my site for malware spreading, though, because all uploads expire after a number of hours. Much better to put it somewhere that's stable until the victim clicks on it, like Google Drive or whatnot. You'd say Google is also responsible for infecting innocent victims right?

So far as I can tell, the malware uploaded to my site is when people use it as a virtual usb stick; transferring files to a lab system or something else they already have access to. A multiplayer remote desktop site was popular for a while, loads of links to shared virtual machines and sometimes people would upload screen recordings of something that happened (usually social things like someone saying something edgy in a chat that runs alongside). Since it's a lab environment, the users enjoy letting loose all sorts of malware and they'd use my site to get it there, but they always already had access or you can't type in the URL and execute the file

There was one instance where someone did make a self-spreading piece of malware, custom for my site. It would try to occupy a lot of short links, so pretty much no matter what you guessed, you'd end up finding that Windows executable and, if you ran it, it would upload itself to create yet more valid download links. Didn't do anything malicious to infected machines, just a nuisance to the site until I banned IP addresses that continued to spam the site

Of course, that's just focusing on the malware. The vast majority of uploads are screenshots, legit software (matching sha2sum with a known good source), long links or commands someone would otherwise have to type over, stuff like that. On occasion there's waves where some community will decide to use it for something, like rich Koreans sharing chatroom links for about a year comes to mind. A few teachers use it for very short temporary links that they can write on the chalkboard/whiteboard for students to download coursework from. It was down for 2h last week due to a power outage and one of my old teachers opened a github ticket about it, that was nice to see :)