Webware

Twitter's dramatic rise has helped ignite an industry to shorten Web addresses to fit within 140-character messages. With the technology, though, comes a new handful of challenges.

Among the challenges are reliably connecting people to the Web sites they want to reach, keeping spam and phishing attacks at bay, and maintaining the service into the future.

Joshua Schacter, founder of Yahoo's Delicious site for storing and sharing Web bookmarks and now a Google programmer, summarized the issues in an April rant about short-URL problems. "I feel that shorteners are bad for the ecosystem as a whole," he concluded.

TinyURL's interface for creating short Web addresses.

(Credit: Screenshot by Stephen Shankland/CNET)

Until a remote future arrives when Twitter and the telecommunications industry decide 140-character messages are too short, though, URL-shortening services aren't going to go away. Fortunately, their potential problems can mitigated through careful use, and newer services such as Bit.ly are being designed expressly to avoid the pitfalls.

And even if some service falls by the wayside and stops functioning--well, welcome to the real world, where not all information is preserved.

"In the digital age, everything has a certain amount of bitrot," said Paul V. Mockapetris, who invented the Domain Name System (DNS) that serves as the Internet's address book.

Growing like weeds
URL-shortening services are abundant and becoming more so. They're usually designed with a priority on minimum character length, not easy reading: Is.gd, Bit.ly, Twurl.nl, Tr.im, Sn.im", Cligs, and TinyURL. If you want to see dozens more, Mashable has a long list.

And the traffic they handle is large. On a typical day right now, Bit.ly is used to create 5 million to 7 million shortened URLs each day, and it handles 25 million requests to expand them--and the growth rate is at a breakneck 5 percent to 15 percent week over week, the company said. Snipurl has delivered 53 billion since its inception. And TinyURL has a database of 293 million URLs.

URL-shortening services have been around for years--TinyURL was founded in 2002, and SnipURL, which also operates Sn.im and Snurl, in 2001. The services typically were used to keep long URLs from being split into chunks in e-mail, where line limits of 80 or fewer characters could break up a Web addresses.

So what's new now? First, Twitter, and second, shortening URLs is becoming an actual business--notably at present through the addition of "analytics" features that can let those who use the service see data about how many people clicked on links, when, where they're located, and the Web page where they found the shortened link.

TinyURL's funding today primarily comes from advertising on its Web page, but that's changing, said founder Kevin Gilbertson. "I'm working on something else that should increase that (revenue) quite a bit," Gilbertson said. He declined to share details at this stage beyond saying, "It will not change any functionality."

He's employed contractors, but with the new funding, he expects to hire full-time programmers and improve his computing infrastructure. Also coming is analytics. "We will be offering that sometime here soon," Gilbertson said.

Snipurl has been run as "a personal endeavor," said leader Shashank Tripathi, with just three employees, but the new climate has got him thinking about venture financing.

Getting analytical
Analytics are important for URL shorteners, in part because it helps the services break out of low-value freebie use to corporate accounts that need to track what's going on.

Bit.ly can tell you how many people clicked your short URL, where they clicked it, and which country they live in.

(Credit: Screenshot by Stephen Shankland/CNET)

"We have a bunch of commerce providers who have embedded Bit.ly into their systems. They're using it for tracking and understanding ROI (return on investment) on various promotions," said John Borthwick, Betaworks CEO and a Bit.ly investor.

Bit.ly is just shy of a year old. So why get started now when there already are dozens of alternatives? In short, to do it better, Borthwick said.

"At Betaworks, we had a series of companies who said there's a need for an URL shortener that was more scalable and reliable than the stuff out there today, that had real-time metrics associated with it, and that had an open API (application programming interface) so people could encode and read decodes through the API," he said. "So we said that's a problem we think we can solve."

The API lets third-party software such as TweetDeck or Twhirl call upon Bit.ly's servers to create a short URL. It also can be used to more easily show the destination URL hidden away behind the short URL.

URL shorteners also can give insight into hot trends by spotting sites people are sharing moment by moment. Bit.ly Now spotlights Bit.ly's top Web addresses hourly.

Grappling with reliability
Then there's the problem of reliability. URL shorteners add a new step to the process of retrieving a Web page, and when the service goes down, Web pages can become inaccessible.

"We've had some growing pains and some issues," such as a database replication issue in March and a faulty switch in April, said TinyURL's Gilbertson. And Snipurl's Tripathi said traffic spikes such as those from Michael Jackson's death can be tough to accommodate.

Compare that to DNS, an arrangement of impressive scale that converts a typed address, such as "slashdot.org," into the numerical Internet Protocol address that's actually houses the address, 216.34.181.48. There are primary "root" servers for DNS, but countless servers on the Internet mirror the primary address book or portions of it, providing broad protection against failure.

DNS is used not only every time a person visits a Web page--several times per page in many cases--but also each time an e-mail is delivered. And while it's had issues, it's generally been highly reliable.

The shortener companies are working on greater reliability for their services. And in fairness, their scale of operation, while growing, is vastly smaller than the DNS.

Still, there's a longevity issue. Shurl.net and URLtea.com no longer function, for example. It's easier to start a shortening service than it is to maintain it for perpetuity.

"Many knockoffs have come and vamoosed," Tripathi said, but he expects Snipurl to do better. "Unlike recent post-Twitter entrants into the space, our links have been around since 2001. While we cannot guarantee anything, we can tangibly claim to have been the best in terms of longevity."

Even without shortening services, URLs aren't guaranteed to last forever. Some "linkrot" is inevitable as companies come and go, services such as Geocities are closed, Net addresses are sold, and people decide not to pay the annual fee to maintain their domains. Here, Bit.ly can actually help by maintaining its own copy of the page.

Can you trust that link?
One of the problems with short URLs is knowing what you're getting into when you click them. Is that link really the fun video of the guy tripping into the lake, or is it site that will spam you or attempt to install malware? Is it really a warning from your bank about a bad transaction, or is it a phishing attack to try to fool you into parting with your password?

Clicking many regular URLs involves a leap of faith, to be sure, but not being able to see a "youtube.com" or "bankofamerica.com" name because it's masked by a short URL makes that leap even longer.

TweetDeck has a preferences option to show details of shortened URLs before you open them.

(Credit: Screenshot by Stephen Shankland/CNET)

"My thinking is that the No. 1 concern is the masking of dodgy domain names from user inspection, for example, those registered in .cn for seemingly English-language sites," said Vern Paxson, a University of California-Berkeley associate professor of computer sciences who focuses on Internet security.

Some services don't do much to help the situation. "Add adverts to your URL to get FREE Traffic," promises the LongURL.net site. "When you send this link to newsgroups, forums, Twitter, Facebook and other social networks, people will load source Web page with your own ad."

And SNVC asks, "Are you an affiliate marketer looking to cloak your affiliate links?...If you choose to check the 'Hide Real URL?' box then it will allow you to keep your shortened URL in the address bar by using a hidden-frame trick."

But avoiding the issues of opaque links is top of mind for many services. For example, adding the word "preview" in front of a TinyURL link will show a Web page with the destination URL expanded. Greasemonkey scripts and extensions let some browsers automatically show the expanded link. And Bit.ly's API permits the Tweetdeck application to automatically show the ultimate destination.

Many services also try to screen out nefarious Web pages through use of blacklists such as SpamCop or Google's Google Safe Browsing. There's brand value in being seen as a shortening service that can be trusted.

"With our brand, we're trying to create a relationship with our users where it's understood we're looking out for them," said Andrew Cohen, a member of Bit.ly's still-small team.

Clicking links from your friends involves trust--they're your friends, after all. But as Twitter becomes evolves into a global conversation, with tweets revealed through search and hashtag identifiers, short URLs from strangers become more common. The more companies use URL shorteners for analytics purposes, the more people will encounter those links outside of Twitter, too.

Fundamentally, URL shorteners are just the latest iteration an old problem.

"The trust issue...is not fundamentally different from other Web, email, and link techniques that are out there," said UC Berkeley professor Randy Katz. "It all comes down to context and being sufficiently aware not to blindly open anything suggested to you."

Few people would characterize the popular and influential microblogging service Twitter as "secure." Hack attacks on Twitter, and Twitter users, appear to be increasing (latest: Twitter hit with "Don't Click" clickjacking attack).

There are two potential security issues currently plaguing the popular social network: the popular use of link shorteners like TinyURL that lead users to unknown destinations, and a single login system that some hope will be fixed with the arrival of OAuth.

Don't click on that link!
Whenever I see an interesting tweet followed by a TinyURL link, I click it. I'll admit it. I don't even consider the ramifications of my actions and often, I'm surprised by where I go.

TinyURL troubles?

(Credit: Don Reisinger/CBS Interactive)

But I don't think I'm alone. TinyURL is the most common link you'll see on Twitter, but it's also one of the easiest ways for a malicious user to expose you to issues ranging from phishing scams to malware installs.

Luckily, Twitter is aware of this issue, and according to its co-founder, Biz Stone, the company is working on ways to make linking safer on the site.

"User security is absolutely a concern and we're working to make the interface safer in that regard," Stone told ZDNet blogger Jennifer Leggio. "We are looking into other ways to display shared links, for example noting whether a link goes to a picture or a video or some other media element. While more a feature, this could help in addressing some of the risk with the URL redirection."

Ginx, a new third-party service (which ironically requires your Twitter login credential to function; see next section), automatically expands shortened URLs before you click on them.

But what about stopping the use of TinyURL, Bit.ly, and other link-shortening services altogether? So far, Twitter has not indicated that it wants to do that and, as some security experts claim, it shouldn't consider that option.

Peter Gregory, a professional security expert and blogger at the Securitas Operandi blog, said he believes TinyURL use "basically comes down to trust: do you trust the source of the link, or is the creator of the link luring you into visiting a malicious Web site that will attempt to implant malware on your computer?"

Both TinyURL and Bit.ly seem poised to answer that call.

Last year, TinyURL introduced a major improvement to the service that anyone using Twitter should use: a preview feature.

TinyURL's preview feature doesn't require registration and instead asks to place a cookie on your machine. Once you surf to the company's preview page, it asks if you want to enable a TinyURL preview. If so, you only need to click the link on the site and from that moment forward, any TinyURL link you click in Twitter or elsewhere across the Web won't immediately send you to the destination site. Instead, you will be redirected to a TinyURL preview page that allows you to examine the link and decide if you want to go to the respective page.

Previews will keep you secure

(Credit: TinyURL)

Bit.ly, another URL-shortening service, provides a Firefox plug-in that allows you to preview links. With both solutions running, the risk of being redirected to a malicious site should be cut down considerably, though not eliminated--nothing in link security is a sure thing.

But that's just one security issue Twitter and its users are forced to confront each day.

(Credit: Mozilla)

TinyURL Generator is a new experimental Firefox extension that makes it easier to grab a TinyURL of whatever page you're on. Once installed it will automatically create and save a smaller, shorter URL from TinyURL.com when new pages are visited. The TinyURL is then copied to your clipboard for easy copying and pasting in an e-mail or IM conversation.

For frequent TinyURL users this might be a better route than using one of the many available bookmarklets since it saves you a click and a copy/paste. On the flip side, it doesn't work so well when used in tandem with Web mail services because it will copy over the URL of your e-mail provider over the site you just visited. If you want to avoid that, be sure to have your Gmail, or whatever service you're using, open beforehand.

Update: As reader raggermany points out this is very similar to TinyURL Creator which also gives you a TinyURL for any page you're on. The big difference however is that TinyURL Generator converts links passively in the background.

Related: 10 links to shorten your links

Thanks to the restriction on the length of posts in nanoblog services like Twitter, the world needs URL shortening services like TinyURL and similar sites. The shortening services are free, though. So one has to ask, how do they make money? And where's my cut?

There are (at least) two URL shorteners that are ad-supported. Not only do they have a revenue model, but they share their revenues with people who use them.

The new kid on the block here is Adjix. Like TinyURL, it creates short links. But the pages users get directed to get a small ad frame above the content. People who create Adjix links get reimbursed at a $0.10 CPM (cost per thousand), or $0.0001 per link. Clickthoughs on the ads pay off at $0.20 each. Advertising is sold at a $0.35 CPM with a $0.75 click-though fee. That's a nice margin for Adjix.

The older LinkBee also pays for referrals. Rates are not listed on the site, but the company claims a 50 percent revenue share, better than Adjix. LinkBee top banners are bigger and more intrusive than Adjix, but the service also offers the option of putting interstitials (also called "blocker ads" by people who hate them) in front of destination pages. While annoying to some, interstitials don't change the experience on the destination site, or interfere with sites' own advertising programs once you get to them.

For its part, TinyURL creator Kevin Gilbertson is on the record stating that he could make a million dollars a month, "if he chose to attach a pop-up advertisement on each URL," according to his hometown paper, the Minneapolis Star Tribune. "But he won't, on principle," the report says. TinyURL instead makes revenue from Google ads on the its main site. That works when you have traffic at the TinyURL volumes; it wouldn't work so well for newer services. There's no revenue share model on TinyURL.

Ad-supported URL shorteners make economic sense, but only if you don't look too hard. Open your eyes beyond a squint and you realize that people who share URLs via shorteners are likely doing so to get some value out of the traffic that they already understand, whether it's ads on the site they are linking to, or spreading their marketing message, or simply sharing what they love with people they like. Putting an advertisement in front of that transaction can reduce the value of the link. With the low pay-back from the monetized shortened links, users could actually end up losing money with these services instead of making it.

As a tool for spammers, though, monetized short links make a ton of sense. But for everyone else, not so much.

Not content to just sit around recovering from Independence Day shenanigans this past weekend, TinyURL released a much-needed feature to its URL-shortening service that others have had for ages: vanity URLs. This means the nonsensical shortened URLs it spits out from your 1,000 character-plus links can now be changed to whatever name you want after the forward slash--that is as long as it hasn't been taken by someone else.

With the popularity of TinyURL and it's automatic integration with services like Twitter, most of the good ones have already been snatched up, so if you're looking to get a vanity mini URL from another similar service, your best bet is to go with one of the little guys. My CNET colleague Nicole Lee did a great roundup on some competitors back in March. Of the bunch, my favorite MooURL has always seemed to have the most open of any, but now that I've told you, the secret is out.

Now you can make TinyURL vanity URLs too.

If you're a frequent Webware, reader you might remember Grooveshark, and Grooveshark Lite--two different but equally awesome music-sharing and listening tools. From those same folks comes TinySong, a bit of a play on large link sharing services like TinyURL. However, instead of sharing Web sites with your friends, you're linking them straight to the track.

The service uses the same built-in song search found in Grooveshark Lite, and will simply jump whoever opens the link right to the Web based jukebox. What's nice is whoever is searching will have the short link copied to their clipboard automatically. For popular songs there's also a fairly good diversity of variations and remixes.

One thing missing from TinySong is a way to make multi-song playlists, but you can simply use Grooveshark Lite and share the playlist link with a friend. See also services like MuxTape and Mixwit for such a task.

[via Delicious]

TinySong lets you search for songs hosted on the Web and share them with friends using a small, sharable link like you'd get on services like TinyURL.

(Credit: CNET Networks)

Webware reader Amy wrote in to let us know one of her favorite Firefox plug-ins shortText just got updated with a handy new feature. It will now automatically go through any page you're on and seek out any TinyURLs, converting them to the actual URL so you can see where the page links to.

If you want to accomplish a similar feat, there's also a bookmarklet called Embiggen, which will do the same thing without you having to install anything. The key difference between the two is that shortText packs in a bundle of other features like letting you write Twitter tweets that are well over the 140 character limit and link all your posts up to a centralized page where you can keep track of replies more easily than on Twitter.

Any TinyURLs on a Twitter post or elsewhere on the Web will automatically be converted with shortText.

(Credit: Shorttext.com)

LinkBunch is a redirection and shortening service for multiple Web links. The service takes as many links as you can throw at it and puts them together in a "bunch," so when users clicks your link they simply come to a link dump with Snap previews of each page. There's also a simple option to open all of them in their browser window.

If you're used to TinyURL, UrlTea, et al, you know these services can be exceptionally useful for taking large links (like the ones you get from browsing on Amazon.com), and shrinking them down for sharing in IM and SMS messages, or a micropublishing tool like Twitter, Pownce, and Jaiku.

The one bummer is that unlike other redirect services, if you simply plug in one link, clicking on the LinkBunch URL will take you the link dump page instead of straight there--something I hope will be added as an option in later iterations. For the lazy, there's also a Firefox plug-in that takes your open tabs and turns them into a LinkBunch automatically--which is handy in case you're scared of copy and paste.

I've created an example LinkBunch of various CNET Networks sites here.