Link shorteners that are outsourced are in my humble opinion an order of magnitude worse for the internet than they would be if in-house.
The way they accrete URLs over time, and then time passes, and anything can happen (your account gets deactivated, shortener company goes out of business / experiences catastrophic data loss / etc) is just asking for permanently broken links which may be unfixable.
Especially when you consider how these services can, unless they're spammy enough to inject gross interstitial ad pages, make 0 revenue from you if you aren't currently paying for a premium service, it's easy to see how they can go under.
Note: Clearly with the kind of ephemeral crap these 2011 tweets were, I'm assuming the 'attacker' publicized "Hey guys look at these funny tweets" because obviously who cares about 15 year old McDonalds marketing messages. But in general it's sad to see these still being used. To be fair to bitly, they do offer the ability to use your own domain at least, but sadly, with a service targeted mainly at marketing departments, usually they don't have the ability to work with the in-house tech team(s) to even set up DNS.
There's a lot of abandoned url ownership things on the internet. We need something like a bureau that keeps track of what it was for. We do have archive.is or .org to save the content at a url (side note - are these archivers legal or in some country that allows this?).
I do often come across an article occasionally where someone is writing about a narrow topic that I'm interesting in, but I can't find them any more - maybe they had a vauge user name that isn't resolvable.
You have sites trying to block spammers, but you have over-active groups like Reddit that seem to delete accounts aggressively with no information about what you did wrong. I want a meta id that I own, that people can check I'm the real "foo-bar1418", and that can't be deleted or taken over.
It feels like there's still room for a super-crosssite-ID. But there are also spammers, haters etc that sites have to deal with.
archive.org is a 501(c)(3) non-profit run publicly and generally follows the law.
archive.is run anonymously, has engaged in ddos campaigns in violation of criminal laws just about everywhere, and has used visitors computers in those campaigns making even visiting the site (when you know of their conduct) a way to violate criminal hacking statutes in most countries.
These days you can buy a short domain easily and create your own short links.
Right now there are around 540 TLDs that anyone can use (not brands or country restrictions) and most are really cheap and haven't been bought out yet.
Same. It's been marketing and other departments that have claimed to need them for ease of use, but then also that same department wants to shove a lot of long text in the url for SEO...
I've warned several times over the years that these links will rot and our going to be out of our control, but... that's what they want!
Somewhat related, I've been getting a lot of spam with links to urls of big, reputable, organizations, such as universities.
You'd think that the organization was hacked, but in all these case instead these were old domains that used CNAMEs.
The domain that the CNAME pointed to was once owned and used by the organization, but at some point it was let go, and it ended up being purchased by the spammers.
So, the spammers were able to use links that looked safe, and maybe that also helped with passing spam filters.
Thus, if you manage domains, please keep track of the ones with CNAMEs, recommend the users to tell you when they stop using them, and maybe check every once in a while (better if automatically) that the domain they're pointing to hasn't changed hands.
I'd be curious to know how the spammers find these old cname domains, by the way.
What is the convenience, really? In 2026, we're rarely speaking/reading URL's. Anything on a print ad can be a QR code. Where that doesn't work, you can say, "go to <company> dot com and search for <product>", like how people used to advertise AOL keywords. Or they can put a link to their active promotions above the fold on their home page.
The main convenience seems to be for pranks, plus it's just another vulnerability as described in the article. At best, they're just something else that has to be maintained forever.
The tweet that McDonald's Sweden is proud of what they've achieved, redirected to the Wikipedia page for 9/11, is probably the most quintessentially 'Gen Z' joke to the point that dictionaries ought to use it as the example.
I'm guessing some combo of dark humor, and the fact that they don't remember 9/11 so they don't mind joking about it, plus ironically trolling big corporations.
Basically, bit-rot-ly missed up by deleting old link names when deleting accounts; people now register old links and redirect them to wherever they want.
if the original people had kept their accounts active they would still be the original URL. That's on BK, Trump, etc.
Obviously, them's the breaks though when you voluntarily rent URLs from random companies. Bitly could sell their whole domain to (insert whatever organization you trust the least) and every URL you've ever made either breaks or is redirected to whatever that entity wants.
My company use a shortener to reduce how much data gets encoded into QR codes that we use, thus making them work better in marginal lighting conditions with worse phones. However, it is entirely self-hosted (301/302 redirect is not a difficult service to build) to protect us from this exact kind of problem.
Traditionally they were useful at the height of Twitter's heyday, because it used to limit Tweets to 140 characters. SMS is a similar use case, but I disliked it there even more, because it normalised getting official messages from random shortcodes with shortened links -- just like a phishing campaign.
You certainly can, I'd happily set one up for my company if they'd let me, but the marketing organizations that generally use these things are 99% of the time only distant cousins from people like me in the orgchart family tree. They just go sign up accounts, use a marketing credit card, and do whatever, and they only talk to people in the tech side of the company after some mess or disaster is made (e.g. "Oh no, we used a URL shortener that went out of business/sold to a porn site/etc")
I don't need shorter links per-se but I need a way to track the effectivness of the links I send out to the public for marketing purposes. I could put tracking ids and such but it doesn't look as good.
I also have links to my Google reviews, Google Maps etc and it's better show bitly.com/business-google-reviews and bitly.com/business-google/map than https://maps.app.goo.gl/sGa1KAU2131212cqU7
The other replies have largely covered most use cases they can also be handy for less tech savvy people to quickly generate links with unique analytics for marketing purposes.
Back in the day every useful link you found on forums used to be shortened with an advertisment proxy service that promised a few pennies per click in exchange for making the user sit through a minute of ads.
Before Twitter, they were used to put URLs on physical things like business cards. They increased in popularity once Twitter imposed a 140 character limit.
People then saw that there were lots of secondary benefits. As another comment mentioned, hiding affiliate forwarders / query strings were a huge use back when everyone was trying to score those kickbacks. And then getting metrics on every clickthrough.
Obviously should probably never use this in the |bash situation, but it's `-L` -- in general a good one to use by default unless you're only using curl to inspect redirect headers or something.
The way they accrete URLs over time, and then time passes, and anything can happen (your account gets deactivated, shortener company goes out of business / experiences catastrophic data loss / etc) is just asking for permanently broken links which may be unfixable.
Especially when you consider how these services can, unless they're spammy enough to inject gross interstitial ad pages, make 0 revenue from you if you aren't currently paying for a premium service, it's easy to see how they can go under.
Note: Clearly with the kind of ephemeral crap these 2011 tweets were, I'm assuming the 'attacker' publicized "Hey guys look at these funny tweets" because obviously who cares about 15 year old McDonalds marketing messages. But in general it's sad to see these still being used. To be fair to bitly, they do offer the ability to use your own domain at least, but sadly, with a service targeted mainly at marketing departments, usually they don't have the ability to work with the in-house tech team(s) to even set up DNS.
I do often come across an article occasionally where someone is writing about a narrow topic that I'm interesting in, but I can't find them any more - maybe they had a vauge user name that isn't resolvable.
You have sites trying to block spammers, but you have over-active groups like Reddit that seem to delete accounts aggressively with no information about what you did wrong. I want a meta id that I own, that people can check I'm the real "foo-bar1418", and that can't be deleted or taken over.
It feels like there's still room for a super-crosssite-ID. But there are also spammers, haters etc that sites have to deal with.
archive.is run anonymously, has engaged in ddos campaigns in violation of criminal laws just about everywhere, and has used visitors computers in those campaigns making even visiting the site (when you know of their conduct) a way to violate criminal hacking statutes in most countries.
Right now there are around 540 TLDs that anyone can use (not brands or country restrictions) and most are really cheap and haven't been bought out yet.
I've warned several times over the years that these links will rot and our going to be out of our control, but... that's what they want!
You'd think that the organization was hacked, but in all these case instead these were old domains that used CNAMEs.
The domain that the CNAME pointed to was once owned and used by the organization, but at some point it was let go, and it ended up being purchased by the spammers.
So, the spammers were able to use links that looked safe, and maybe that also helped with passing spam filters.
Thus, if you manage domains, please keep track of the ones with CNAMEs, recommend the users to tell you when they stop using them, and maybe check every once in a while (better if automatically) that the domain they're pointing to hasn't changed hands.
I'd be curious to know how the spammers find these old cname domains, by the way.
The main convenience seems to be for pranks, plus it's just another vulnerability as described in the article. At best, they're just something else that has to be maintained forever.
Wouldn't it make more sense to restore the original destination URL?
Obviously, them's the breaks though when you voluntarily rent URLs from random companies. Bitly could sell their whole domain to (insert whatever organization you trust the least) and every URL you've ever made either breaks or is redirected to whatever that entity wants.
Traditionally they were useful at the height of Twitter's heyday, because it used to limit Tweets to 140 characters. SMS is a similar use case, but I disliked it there even more, because it normalised getting official messages from random shortcodes with shortened links -- just like a phishing campaign.
I also have links to my Google reviews, Google Maps etc and it's better show bitly.com/business-google-reviews and bitly.com/business-google/map than https://maps.app.goo.gl/sGa1KAU2131212cqU7
Or for historical context, this is all Twitter's fault since its character limit included links too.
And many of them provide analytics to see who’s clicking your link.
I host my own now, for free and for fun.
It's lovely when books use them, and by the time you read them they don't work anymore.
People then saw that there were lots of secondary benefits. As another comment mentioned, hiding affiliate forwarders / query strings were a huge use back when everyone was trying to score those kickbacks. And then getting metrics on every clickthrough.
Imagine if someone is using curl | bash on a shortened URL because "it's too long" and you can't see where the link is going.
https://x.com/realdonaldtrump/status/228935671061020673?a=87...
https://x.com/realdonaldtrump/status/350628162595590148?a=Jk...