v0.69.0 — A URL short enough to read aloud

A URL short enough to read aloud, and a resolver that refuses the addresses you did not want anyway.

/shorten — short links on the pit

mosh ▸ /shorten https://pit.moshcode.sh/n/blue.eggs/the-post-i-wrote-on-tuesday
✓ https://pit.moshcode.sh/f/k7mq2xd → https://pit.moshcode.sh/n/blue.eggs/the-post-i-wrote-on-tuesday

The pit hands out long URLs constantly — a session mirror, an approval, a name's site, a release asset — and the place they get pasted is a terminal, a chat line, a slide or a QR code, where a 140-character URL wraps and breaks in half. /shorten <url> asks the registry for a code and prints /f/<code>, which answers a 302 to wherever it points.

/shorten list shows every link you have minted with its hit count, /shorten rm <code> takes one down, and --name blue.eggs files a link under a Moshpit name you hold. All of it is on the CLI too, as moshcode shorten.

Minting needs an account. An anonymous shortener is an open redirector with a database attached, which is the thing phishing kits are built out of; tying a code to an account is what makes it revocable and its owner findable. The token moshcode login already wrote is the credential, so a script that can publish to a name can shorten a link with the same header.

It is idempotent per account. Shortening the same URL twice hands back the same code rather than minting a second one — which is what makes the command safe to retry after a timeout, and what stops one destination's hits from being split across two codes nobody can reconcile later.

Three smaller decisions worth naming. The alphabet has no 0/O and no 1/l/I, because somebody reads these off a screen and types them back in. The redirect is a 302, never a 301: a permanent redirect is cached past the point where the link is deleted, and a shortener whose links cannot be taken back is not one to print on a sticker. And the target is http(s) only, checked once on the way in — /f/<code> hands its stored column straight to a browser, so a javascript: scheme reaching that column would be stored XSS with a permalink.

Hits are counted. Who followed them is not.

dns filter — blocking at the bridge

The resolver already answers Moshpit names and forwards everything else. It can now refuse a name instead: ads, trackers, malware and phishing, from the blocklists you choose, applied to every program on the machine rather than to one browser with one extension.

moshcode dns filter on          # --mode nxdomain|zero|refuse, --lists a,b
moshcode dns filter update      # fetch the lists — nothing downloads on its own
moshcode dns filter test ads.example    # would this be blocked, and by which rule
moshcode dns filter allow example.com   # never block it, whatever any list says

Filtering is off until asked for and downloads nothing until told to. Bare moshcode dns filter says what is on and what it has blocked, and test answers the only question that matters when a page half-loads: was that us, and which rule did it.

Upgrading

moshcode upgrade

Nothing in the pit changes shape: /shorten is a new verb beside /post and /prd, and the filter is a subcommand of a dns that behaves exactly as it did with it turned off.