It’s due to crypto scammers using it. From the founder’s post:
At some point in the past crypto scammers used JSFiddle to host pages with a wallet code and posted links to that on Twitter.
Due to the nature of JSFiddle, anyone can post anything, so wallet codes are ok – we did implemented a content filter to shadow-ban these.
I asked Twitter if they they could help out and ban twitter accounts that were posting scam tweets that included links to the rouge fiddles.
Twitter just went the easy route and blocked all jsfiddle.net links instead of blocking spammer accounts on their platform.
Tried to contact Twitter many many times, with no reply whatsoever. They most likely have no-explanation-needed-policy, which is why they never replied.
There's nothing that can be done here unless somebody has contact to a higher op at Twitter who has the decision power to help out here.
I don't understand how posting a "wallet code" is dangerous. Is it mining coins while you are browsing the code? Then it just a minor annoyance. Also, browsers should block cryptominers when they are in the background tab.
I would wager most of the people dealing in crypto currencies are actually precisely the kind of people that would fall for pretty much anything. I don't think it's a stretch to say that the fact that they deal in crypto currencies is actually a pretty good indication that they would.
More to the point - there is a significant number of people who started learning about computer security precisely because they got some cryptocurrencies. And frankly, if someone wants to really understand the details, it's hard to miss all the frequent warnings and examples of scams, hacks, leaks.
I saw one of those fake Elon Musk posts in my stream and my first thought was "Wow! Is Elon pushing shady blockchain money things now?" It wasn't until a few seconds later that I realized there was no blue-check and it wasn't him....
Blocking cryptominers or other script isn't possible because of JavaScript's nature as Turing-complete language, much less with new shiny WebWorkers/PWAs. It's also not just a minor annoyance when miners, trackers, and all kinds of other nefarious or just plain garbage scripts drain your batteries and consume power/bandwidth for no other reason than browser vendors being busy to develop webapp platforms and world domination schemes rather than declarative and privacy-focussed content consumption/authoring ... browsers.
I think Digital Ocean shared your view, until recently, when false positives caused them to shutdown a customer business, and a broken support procedure caused them to keep it down. Search HN archives for Digital Ocean from the last week or two and you should be able to find that story.
Couldn't you do the same thing with github.io, S3 Websites, Netlify, the list goes on? Why would they single out JSFiddle among numerous services where one can upload arbitrary code?
On a complete tangent, I think "rogue" might be the most misspelled word for those that otherwise have good spelling. It's still jarring every time I see it, decade after decade.
And "loose" instead of "lose", but that one is just confusing.
And many more that I can't recall at the moment... In my youth I spent an absolutely obscene amount of energy correcting these people, bit now I just automatically lower the veracity of what they're saying each time I see some literacy problem.
That isn't fair to those people because not everyone speaks English as a first language, and phones autocorrect a lot of things that should not be corrected.
There's a fairly big difference: JSFiddle is completely anonymous but GitHub Pages and similar services require accounts and at least in the case of GitHub they have a functional abuse team.
In contrast, JSFiddle can take something down but that's where it ends unless the scammer used a dedicated IP which is easily traced to them.
And even then, scammers can always switch to custom domains. It seems futile to block arbitrary code execution unless they only allow whitelisted domains.
The low-effort snark is unnecessary and weakens the conversation. At least make it witty.
JSFiddle is a pretty low tier target that most people won't miss. Github links aren't. Also, I'd imagine Github Pages is more responsive to taking down scamware, it at least requires an account, and has more of an interested in keeping malicious behavior off the platform.
I assume they mean a mining script - so that the person running the jsfiddle would be mining cryptocurrencies, and the proceeds would go to the scammers wallet address.
>> By wallet code you mean a crypto mining script yes?
>I think I saw some variant of this. It's one of those "send some ETH and receive 2x more back!" With fake "live" transaction listing and fake testimonials.
> Edit: if memory serves me correct, the transactions being listed are actually not fake, though the live aspect is. Same transaction always reappear as if they're new if you refresh, and those transactions is the 2x amount that got send back. It's all just the scammers trying to make the site look legit.
At some point in the past crypto scammers used JSFiddle to host pages with a wallet code and posted links to that on Twitter.
Due to the nature of JSFiddle, anyone can post anything, so wallet codes are ok – we did implemented a content filter to shadow-ban these.
I asked Twitter if they they could help out and ban twitter accounts that were posting scam tweets that included links to the rouge fiddles.
Twitter just went the easy route and blocked all jsfiddle.net links instead of blocking spammer accounts on their platform.
Tried to contact Twitter many many times, with no reply whatsoever. They most likely have no-explanation-needed-policy, which is why they never replied.
There's nothing that can be done here unless somebody has contact to a higher op at Twitter who has the decision power to help out here.