Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You shouldn't hotlink someone else's JavaScript

beta.whatispolymath.com

Post reply on HN
Print view View original

61–70 of 102 posts

Re: You shouldn't hotlink someone else's JavaScript

#61

Post by riskable »

borski wrote: post #32
jacquesm wrote: post #12

And that's a pretty mild example of what could happen if you did. Hotlinking javascript is an excellent way to allow someone else to pull all kinds of tricks with your visitors and your image. For example, redirecting all your traffic to a shocksite. Every time you include some externally hosted javascript you open yourself and your visitors to a security risk. And on top of that, if you do it like this you're steali…

The security risk is precisely why a lot of new services provide embeddable content via iframes now, rather than JS. On the other hand, this still isn't perfect - we wrote about it today, actually: https://www.tinfoilsecurity.com/blog/protect-your-website-fr...

As long as you host the JavaScript yourself this shouldn't be a problem. Why would it? Iframes suck.

Re: You shouldn't hotlink someone else's JavaScript

#62

Post by bigiain »

andymcsherry wrote: post #9
geuis wrote: post #5

Ok there is a better way to handle this than adding some html to a page to make a banner, posting to HN, and hoping for the best. Check for referal headers and throw a 301.

Or just send the owner an email: http://www.whois.com/whois/whatispolymath.com

So why should it be the responsibility of some guy who's bandwidth is getting stolen to be nice about notifying the guy who's stealing it - why didn't the site owner feel any obligation to send the .js hosting site owner an email asking if it was OK first?

Re: You shouldn't hotlink someone else's JavaScript

#63

Post by 3825 »

riskable wrote: post #61
borski wrote: post #32

Earlier quoted context omitted.

The security risk is precisely why a lot of new services provide embeddable content via iframes now, rather than JS. On the other hand, this still isn't perfect - we wrote about it today, actually: https://www.tinfoilsecurity.com/blog/protect-your-website-fr...

As long as you host the JavaScript yourself this shouldn't be a problem. Why would it? Iframes suck.

Iframes do suck. However, success of a whole crop of companies like Disqus depends on it sucking less. I am sure this is a known issue for these companies.

Re: You shouldn't hotlink someone else's JavaScript

#65

Post by bhauer »

chewxy wrote: post #3

Screenshot for potential future confused HNers when Polymath realizes it and uses a real CDN: http://i.imgur.com/A8JzHtK.png

Thank you. At first, I didn't see anything of interest and briefly wondered why I was at a site that had nothing to do with the HN subject.

It hit me that the submission was to a demonstration rather than an article, so I temporarily instructed Noscript to allow all domains used by the page. Sure enough, now the banner appeared.

But that speaks to another reason to not use too many scripts hosted by third-parties. It makes for a very cluttered list of domains for users of Noscript and similar to authorize. I just leave sites that have more than a small number. How many third-party analytics, tracking, tools, social sharing, voting, polling, comments, shopping, deals, and other tools do you really need to embed to make a web site these days?

I love when the list is just domain.foo and domain-static.foo and maybe google-analytics or another mainstream analytics domain.

Re: You shouldn't hotlink someone else's JavaScript

#66

Post by wmil »

djm_ wrote: post #43
bulatb wrote: post #31

Earlier quoted context omitted.

They specifically ask people not to do that.

Also, linking to something as possibly unstable as a master branch seems odd at best.

You'd think, but jQuery had to remove code.jquery.com/latest.js because people were linking to it from production sites and complaining when things broke.

Re: You shouldn't hotlink someone else's JavaScript

#67

Post by cl8ton »

A car dealer was hot linking to pictures of our cars from a sports car forum I belong to and using them to sell his same models on eBay.

We changed to pics of Male Enhancement devices and medication and shared with other car forums, we all watched for days and the guy was pretty clueless on what was going on and apparently didn’t check his ads as often as he should.

We even had a vote for what pic appears today poll.

Remember: The first rule of Changing hot linked photos club is to never talk about changing hot linked photos.

Re: You shouldn't hotlink someone else's JavaScript

#70

Post by eric_the_read »

cl8ton wrote: post #67

A car dealer was hot linking to pictures of our cars from a sports car forum I belong to and using them to sell his same models on eBay. We changed to pics of Male Enhancement devices and medication and shared with other car forums, we all watched for days and the guy was pretty clueless on what was going on and apparently didn’t check his ads as often as he should. We even had a vote for what pic appears today poll.…

In the very early days of lolcats, I nearly got fired because an image macro I referenced in an email got replaced, several months later, with.... let's just say it was the sort of image that rivals goatse for disgusting.

Fortunately, my company's IT department had enough of a clue that when I explained what had happened, they agreed it was possible; it was a tense week, though, while they investigated.

I'm not saying the sort of reaction in parent isn't always appropriate, but just be aware that people's lives can be ruined to save a few dollars. I think the OP's solution is ideal: it alerts people to the problem in a very professional way, and provides solutions for the most common cases.

Post reply on HN