Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You shouldn't hotlink someone else's JavaScript

beta.whatispolymath.com

Post reply on HN
Print view View original

11–20 of 102 posts

Re: You shouldn't hotlink someone else's JavaScript

#11

Post by Cthulhu_ »

mjpa wrote: post #7
BadassFractal wrote: post #6

Lots of services out there like browser-update.org tell you to load snippets of js over http from some random location they control. It's pretty unsafe unless you really know who's running the show over there and how secure their system is. Them being compromise could make every user site vulnerable.

There is of course the maintenance issue... what happens when their script is updated and breaks how you use it?

Usually, library scripts are versioned in their filename, so won't be updated after release.

Re: You shouldn't hotlink someone else's JavaScript

#12

Post by jacquesm »

And that's a pretty mild example of what could happen if you did. Hotlinking javascript is an excellent way to allow someone else to pull all kinds of tricks with your visitors and your image. For example, redirecting all your traffic to a shocksite.

Every time you include some externally hosted javascript you open yourself and your visitors to a security risk. And on top of that, if you do it like this you're stealing bandwidth.

When including remotely hosted javascript make sure you have permission, make sure the other party is trustworthy and periodically review the linked script to make sure it does what is advertised (and that's imperfect, it could be you're seeing something else than other visitors).

Re: You shouldn't hotlink someone else's JavaScript

#15

Post by maaaats »

geuis wrote: post #5

Ok there is a better way to handle this than adding some html to a page to make a banner, posting to HN, and hoping for the best. Check for referal headers and throw a 301.

Well, I see it as a great reminder why one shouldn't trust scripts hosted elsewhere into one's site.

Re: You shouldn't hotlink someone else's JavaScript

#17

Post by martin-adams »

There are few techniques you could use that don't affect the visitor experience of your own.

- Detect referrer and return a script that has a warning

- Rotate your script filenames so those hotlinking will soon realise they will need to host it themselves

- Use a CDN yourself and don't encourage them to hotlink

- Slow down the request

For those hotlinking, consider:

- You can't trust the source of the code

- You can't trust that the code will always be there and it will load quickly

- You can't trust the contents of the code may change and break your application

If you want to be sinister to those hotlinking you could:

- Redirect the user (as others have noted)

- Display any message to the user

- Steal data from the user who is using the site hotlinking

- Inject your own adverts into the target web page

- Make the web page do the Harlem Shake

Re: You shouldn't hotlink someone else's JavaScript

#18

Post by akx »

fosap wrote: post #8
geuis wrote: post #5

Ok there is a better way to handle this than adding some html to a page to make a banner, posting to HN, and hoping for the best. Check for referal headers and throw a 301.

I hope referrals will be disabled anytime soon. Firefox has AFAIK disable referrals to other domains by default.

In the case of Javascript hotlinking, that'll do approximately diddly squat though.

  if(/whatispolymath/.exec(location.href)) alert("...");

Re: You shouldn't hotlink someone else's JavaScript

#19

Post by andyhmltn »

Very very lucky. All they had to do was:

document.location = '...'

and route the page to a java drive-by which redirects back afterwards and most of their visitors would've been infected. They are incredibly lucky that the owner of that script was nice enough just to add a simple banner.

Re: You shouldn't hotlink someone else's JavaScript

#20

Post by martin-adams »

akx wrote: post #18
fosap wrote: post #8

Earlier quoted context omitted.

I hope referrals will be disabled anytime soon. Firefox has AFAIK disable referrals to other domains by default.

In the case of Javascript hotlinking, that'll do approximately diddly squat though. if(/whatispolymath/.exec(location.href)) alert("...");

Or better yet, test if it's not your domain, then show a message.
Post reply on HN