-
I create a well crafted post to a normal site that gets 10.000 upvotes.
-
I change the URL to a malicious site.
-
???
-
Profit
It makes it a little bit easier to do, but it is not difficult to replicate this effect without changing the URL in the title - using a redirected URL and changing the redirect address, for example.
I think that this small increase in the way this kind of attack can be delivered is more than counter-balanced by the convenience of having editable titles.
There’s also
-
I create a well crafted post woth a url to a normal site in the body of my post that gets 10.000 upvotes.
-
I change the URL to a malicious site.
-
???
-
Profit
This pretty much - any user can do the same to a link in the body of a post
Yeah, I had exact same thoughts lol, check my other comment with my thoughts and let me know what you think. Maybe I missed something.
-
Yeah, this is why reddit didn’t allow it. I don’t think Lemmy should either.
One down vote?? Why lol
The url and title should both be locked after a post. The contents should be free to change, that way updates and such can be posted if necessary.
Comments can continue to work as-is, there is a similar danger there, but it doesn’t matter nearly as much.
Titles being editable is really useful. So many posts have misleading titles, causing posts to have to either get removed or flaired (I don’t think we have an equivalent of flairing yet).
Plus, unless we’re prohibiting editing the body or even comments within posts, it has similar risks to editing the title or URL. Though the post URL is the one most likely to get clicked and thus is the highest risk.
It is something tooling could help detect. Moderator tools could detect posts changing the URL and flag the post for review. The general idea of spam filters apply well here. Spam filters aren’t just for completely preventing spam, but also for flagging potential spam. We could train spam filters on diffs of comments so that they can recognize when posts seemed to have completely changed in a way that we’d classify as spam.
