Still requires the xsec_token in there. The URL when linking to a video is invalid without that token (but still works for profiles etc), which makes me think that it still resolves to something on their backend, but it’d get more expensive to process it that way with so many users.
Anyway, the bot was demodded by an admin when the new Lemmy update came out so people can share their rednote links willy-nilly for now. There’s a reason this issue cropped up now, because the Lemmy update didn’t take into account cases like this which use rainbow tables to obscure all the tracking info. Things like Instagram (instagram.com/share/a/blahblah), TikTok etc. will all leak information, which is why I think the admin’s reasoning for this bot’s removal was misguided. As far as I know, rednote shouldn’t leak personal information to people following your links, unlike TikTok… I think. It might recommend the sharer’s account though, but that’s just conjecture, I haven’t used it long enough to test.
@CARCOSA@hexbear.net admins should make the call on whether to continue allowing xhslink URLs or not.
Also note that TikTok links are not being removed by the bot because it cannot, but no one shares TikTok links here because of the site culture that we’ve inculcated, though this relies on people continuing to adhere to it themselves.