Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wondering what to do (if anything) about hotlinking

kryogenix.org

Post reply on HN
Print view View original

31–40 of 49 posts

Re: Wondering what to do (if anything) about hotlinking

#31

Post by Macha »

dylan604 wrote: post #27
tantalor wrote: post #18

Earlier quoted context omitted.

And you are now in violation of GDPR

if that's true, how is every single tracking pixel on the web not in violation of the GDPR?

I mean, every single tracking pixel on the web is a GDPR violation, unless they've established a legal basis to do so. As basically all of noyb's complaints being upheld by DPAs shows, most fail to do so, clinging on to legitimate interest when they fail the balancing test, or consent when the consent form is too deceptive or tipping the scale to count as freely given

Re: Wondering what to do (if anything) about hotlinking

#32

Post by Macha »

MonkeyMalarky wrote: post #19
tantalor wrote: post #18

Earlier quoted context omitted.

And you are now in violation of GDPR

I'm not an expert on GDPR at all so forgive me if these are dumb questions but how? I thought GDPR pertained to a user's personal info? Sending back info about the webpage the script is used on isn't the same. Also who would be in violation, the leachers or the OP? Does GDPR even apply if OP is just a random person on the internet and not a company operating in the EU?

The request would send back personally identifiable information (IP address), which if the OP stored (say in an access log), without establishing a legal basis, then it would be a GDPR violation. By OP, since the tracking is occuring on their server and not at the behest of some other data controller.

Re: Wondering what to do (if anything) about hotlinking

#33

Post by michaelteter »

noobermin wrote: post #26

The author is too kind. I don't know why you should bend over backwards for anti-social folks, it just allows them to perpetuate their bad behavior.

People who do this are probably just ignorant (under-skilled), not necessarily antisocial.

Doing this obviously risks your own site breaking if the linked source changes anything or goes away. That’s a serious risk which no reasonable web developer would knowingly accept.

Re: Wondering what to do (if anything) about hotlinking

#34

Post by MonkeyMalarky »

Macha wrote: post #32
MonkeyMalarky wrote: post #19

Earlier quoted context omitted.

I'm not an expert on GDPR at all so forgive me if these are dumb questions but how? I thought GDPR pertained to a user's personal info? Sending back info about the webpage the script is used on isn't the same. Also who would be in violation, the leachers or the OP? Does GDPR even apply if OP is just a random person on the internet and not a company operating in the EU?

The request would send back personally identifiable information (IP address), which if the OP stored (say in an access log), without establishing a legal basis, then it would be a GDPR violation. By OP, since the tracking is occuring on their server and not at the behest of some other data controller.

IP addresses in your http server log are a violation? Well then you may as well fine every hardware owner and ISP middleman between me and the user!

Re: Wondering what to do (if anything) about hotlinking

#35

Post by ericmcer »

Chernobog wrote: post #20

I would just add some console.log message explaining the issue you have with hotlinking the script. This will not disrupt users, but anyone who fires up their devtools will see that the site is getting shamed. And if their devs care just a little bit, I think they will find it embarrassing enough to host the script themselves. Correct me if I simply have missed it, but is there an official NPM package available? I ha…

Couldn’t you take it a step further and literally just do if(!location.pathname=== mysite) alert()

Re: Wondering what to do (if anything) about hotlinking

#36

Post by toast0 »

Probably the nicest way to handle this is to serve the JS slowly.

It doesn't break their page if you take ten seconds to serve the JS, but it makes their page slow, and nobody likes a slow page. And it's pretty obvious where the slowdown is coming from.

If it's easy, make it fast from your site and slow if the referer doesn't match or isn't present. Or just make it always slow, whatever.

Re: Wondering what to do (if anything) about hotlinking

#37

Post by toast0 »

tantalor wrote: post #18
MonkeyMalarky wrote: post #8

Instead of a nasty console message or popup, modify the script to ping back more detailed and useful information about where its being used. Then contact the developers. Edit: you don't even need to write anything dynamic to receive the ping back, just have the script load an image from yoursite.com/specialprefix/the useresencodedbrowserurl/anythingelseinteresting/1.png then look in your server logs for any 404 error…

And you are now in violation of GDPR

Isn't the site owner in charge of GDPR for the site? Aren't they already non-compliant by hotlinking a resource from someone where there's no agreement about personal data? Wouldn't it still be the site owner's responsibility not to let a 3rd party send even more personal data over?

Re: Wondering what to do (if anything) about hotlinking

#38

Post by chrismorgan »

> There are many CDNs, and using resources served from them is not a bad thing.

I disagree. Public CDNs (which is what I take the sentence to be referring to) can be convenient for prototyping, but should be completely avoided for production work. Due to HTTP/2+, cache partitioning, and the ease of private CDNs (which were difficult and expensive even ten years ago, whereas now it’s common for entire sites to be hosted on a private CDN), public CDNs no longer offer any benefit at all in most common/sensible scenarios, and negligible benefit in the near-worst-case scenario, but have performance costs (establishing an extra HTTPS connection) and introduce significant functionality and security risks.

For a good article with some more detail: https://httptoolkit.com/blog/public-cdn-risks/

Re: Wondering what to do (if anything) about hotlinking

#39

Post by nine_k »

toast0 wrote: post #36

Probably the nicest way to handle this is to serve the JS slowly. It doesn't break their page if you take ten seconds to serve the JS, but it makes their page slow, and nobody likes a slow page. And it's pretty obvious where the slowdown is coming from. If it's easy, make it fast from your site and slow if the referer doesn't match or isn't present. Or just make it always slow, whatever.

This also has the natural consequence of limiting the bandwidth spent serving third-party hotlinked downloads. But the expense of the bandwidth is the primary problem with hotlinking, AFAICT from the article.

I could imagine two network interfaces, or two LBs, one internal and unmetered, another external, which serves a particular amount of megabytes per day, and throttles connections accordingly. Maybe even add some HTTP header, like X-bandwidth-limit: "Dear hotlinkers, I'm not going to spend more than $5 / mo on serving you; host your own copy."

Re: Wondering what to do (if anything) about hotlinking

#40

Post by pessimizer »

tantalor wrote: post #18
MonkeyMalarky wrote: post #8

Instead of a nasty console message or popup, modify the script to ping back more detailed and useful information about where its being used. Then contact the developers. Edit: you don't even need to write anything dynamic to receive the ping back, just have the script load an image from yoursite.com/specialprefix/the useresencodedbrowserurl/anythingelseinteresting/1.png then look in your server logs for any 404 error…

And you are now in violation of GDPR

I might be missing something, but people who hotlink your scripts aren't your customers or users, and you shouldn't have any obligations towards them. Can people hacking your site sue for GDPR violations to get you to delete the logs of their hack?
Post reply on HN