Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

tnfy.link - What's about ID?

Hello everyone! Welcome to the second part of my series about tnfy.link — yet another URL shortener! In this post, we’ll dive into the fascinating process of generating short links. While this might sound straightforward, choosing the rig…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Hello everyone!



Welcome to the second part of my series about tnfy.link — yet another URL shortener! In this post, we’ll dive into the fascinating process of generating short links. While this might sound straightforward, choosing the right method for link generation comes with unique challenges.



At its core, generating a short link involves creating a short, unique ID for each long URL. The ID should meet several criteria:




  • Be unique to avoid conflicts.

  • Be short enough for practical use.

  • Be easy to type without introducing errors.

  • Be unpredictable to prevent guessing.



After researching various approaches, I identified four main methods for generating short links. Let’s explore them in detail.









1. Random Bytes



The simplest method involves generating random bytes and encoding them. However, it’s important to understand the difference between pseudo-random and cryptographically secure random numbers.






Pseudo-Random Numbers



The math/rand package in Go provides a pseudo-random number generator (PRNG). With the same seed (an initial value), it produces the same sequence of numbers. While this is sufficient for many applications, it’s not suitable for secure or unpredictable link generation.






Cryptographically Secure Random Numbers



For more secure random numbers, the crypto/rand package is ideal. It generates truly random and unpredictable values by leveraging system noise. For example, electromagnetic noise captured at the physical level can be used. This ensures high entropy, but keep in mind that virtual machines may rely on their host for random data, which could slow down generation in high-load environments.






Encoding Random Bytes



Random bytes alone aren’t suitable for URLs, so they must be encoded. Here are the most common encoding methods:





  1. Integer: Converts bytes to an integer. Easy to type but may result in longer IDs.


  2. HEX: Encodes bytes in hexadecimal (0-9, A-F). Case-insensitive and typo-resistant.


  3. Base64: Encodes bytes with characters A-Z, a-z, 0-9, +, /, and =. However, it’s case-sensitive and prone to typos.


  4. Base58: Similar to Base64 but excludes confusing characters (e.g., I, l, O, 0). This makes it more user-friendly. Examples include the implementations by Bitcoin, Ripple, and Flickr.



For user-friendly short links, Base58 is often the best choice due to its balance of compactness and error resistance.



Key Takeaways:




  • Random bytes are unique and unpredictable.

  • Encoding methods like Base58 enhance usability.

  • Cryptographically secure randomness ensures reliability.









2. Hashing



Hashing involves generating a fixed-length value based on the input (e.g., the long URL). While it guarantees consistency—hashing the same input always produces the same output—it lacks randomness. This means multiple requests to shorten the same URL will yield identical IDs, which doesn’t meet the unpredictability requirement.



Adding a random salt to the input before hashing can introduce variability, but at that point, using raw random bytes becomes simpler and more efficient.









3. UUID



UUIDs (Universally Unique Identifiers) are widely used for generating unique values. While they are effective, their default format is too long for short links. However, re-encoding UUIDs (e.g., in Base58) can reduce their size.



An alternative to UUID is NanoID, which generates shorter strings (21 characters by default) by using a customizable alphabet. This allows you to optimize IDs for readability and error resistance.



Why Not Use UUID?

UUIDs are ultimately based on random bytes, so there’s no significant advantage over generating raw random values directly.









4. Sequence



Random values can occasionally result in duplicates, especially under high load or with shorter IDs. While tnfy.link isn’t designed for high-load scenarios, it’s still worth considering potential issues.



Using a sequential counter ensures uniqueness by design. Tools like Redis can implement a distributed counter with the INCR command. However, sequential IDs are predictable. Combining a sequence with random bytes addresses this issue, ensuring both uniqueness and unpredictability.



For example:





  • Random Value + Incrementing Sequence: If two instances generate the same random value, the sequence ensures uniqueness.



Note: Including a sequential component in your IDs might reveal the total number of links generated, which could be undesirable in some contexts.









Conclusion



In this post, we explored various methods to generate short links:





  • Random bytes: Simple and effective, especially with secure encoding like Base58.


  • Hashing: Reliable but lacks randomness for this use case.


  • UUID/NanoID: Great alternatives but add unnecessary complexity compared to raw random bytes.


  • Sequence: Solves collisions but increases ID length.



For most use cases, random bytes with Base58 encoding are sufficient. To handle collisions in high-load scenarios, combining random bytes with a sequential component is a robust option. While this isn’t yet implemented in the current version of tnfy.link’s backend, I plan to add it as an optional feature in the future.



Thanks for reading! I’d love to hear your thoughts and experiences with link generation. Share your feedback in the comments below!






Related Post


If you’re interested in learning more about my projects, check out my article on SMS Gateway for Android.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
1 Warnungen
title: Detect Exploitation - tnfy.link - What's about ID?
id: 6b193a28-7078-4015-910f-3f395c0114ee
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "tnfy.link - What\'s about ID?" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("tnfylink - Whats about ID")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*tnfylink - Whats about ID*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "tnfylink - Whats about ID"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Analyse für identifizierte Bedrohung auf Basis von Live-CTI (ENISA EUVD): CVSS 0.0 · EPSS 0.0% · CISA KEV: nein. Handlungsableitung aus den verlinkten Hersteller-Quellen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten tnfy.link - What's about ID?

Thematisch verwandte Begriffe: tnfylink, Whats, about · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

💬 Kommentare werden geladen…
Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100739 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag