[zinekeller]

Unfortunately, most people just throw "eh, it's low-maintenance".

To bring down the point, here's the source code for that link shortener: https://github.com/technoweenie/guillotine. It was last updated in 2015. If you don't believe that this is the source code, this was directly linked to in its announcement: https://github.blog/2011-11-10-git-io-github-url-shortener/. If the extreme lag (in an attempt to save the links) is indicative if its backbone, it's probably just running in a single server, which is very likely to be horribly outdated. It might not be due to the cost of removing the malicious links, it might be that Git.io as a platform has a cost in of itself (even excluding common things like domain and hosting costs).

[userbinator]

It was last updated in 2015

You just proved the point.

[zinekeller]

... and you didn't understand the underlying problem, which proves my point of people quickly dismissing "low-maintenance" applications. This isn't a Windows application which still chugs because of immense herculean compatibility made by Microsoft, this application, which was supposed to be quickly installable in Heroku... isn't. That says a lot.

[maryjpenny]

Heroku you say? Could it be related to this?

https://github.blog/2022-04-15-security-alert-stolen-oauth-u...

“The applications maintained by these integrators were used by GitHub users, including GitHub itself.”

[zinekeller]

Very unlikely to be honest, especially that there's no private* data present in Git.io.

* Technically the links are not publicly listed, which might jeopardise some obnsscure but technically-available repository, but it doesn't store private data.

[maryjpenny]

Historical DNS TXT shows that git.io was (and probably still is) hosted on Heroku.

From the original post: “due to the security of the links redirected with the current git.io infrastructure”

What does “security of the links” even mean? Disclosure? Tampering?

[freemint]

Adversaries submitting nasty stuff and have it behind the git brand.