Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You shouldn't hotlink someone else's JavaScript

beta.whatispolymath.com

Post reply on HN
Print view View original

41–50 of 102 posts

Re: You shouldn't hotlink someone else's JavaScript

#41

Post by UnoriginalGuy »

maaaats wrote: post #15
geuis wrote: post #5

Ok there is a better way to handle this than adding some html to a page to make a banner, posting to HN, and hoping for the best. Check for referal headers and throw a 301.

Well, I see it as a great reminder why one shouldn't trust scripts hosted elsewhere into one's site.

I use Google and I'm comfortable with that.

The nice part about using Google is first off it offers speed advantages (as most people will have Google's JQuery lib cached already), secondly I don't expect Google to get hacked, and lastly we have Google's permission to do exactly that.

Re: You shouldn't hotlink someone else's JavaScript

#44

Post by oneeyedpigeon »

TheAnimus wrote: post #33

>We noticed that you're using Internet Explorer. Polymath currently does not support this browser because compatibility issues prevent us from delivering an ideal experience. We're working on fixing these issues. People do realise that some company networks give you no control over which browser you can use right? I can't understand what feature they would need which is missing from IE10. Why not use feature detectio…

http://caniuse.com/#compare=ie+10,firefox+24,chrome+29

Re: You shouldn't hotlink someone else's JavaScript

#45

Post by marceldegraaf »

ivansavz wrote: post #2

The hotlinked js in question is: http://gsgd.co.uk/sandbox/jquery/easing/jquery.easing.1.3.js That is a neat way to communicate ;) Polymath sounds like a cool idea BTW, but probably difficult to monetize. Somebody must pay the tutors for producing/curating the content, but people have gotten so used to educational material being free...

Linking to the file from a popular HN thread will likely only worsen the bandwidth issues for the owner :-). Perhaps link to the Github version instead, which is here: https://github.com/gdsmith/jquery.easing

Re: You shouldn't hotlink someone else's JavaScript

#46

Post by grey-area »

ballard wrote: post #29
jacquesm wrote: post #12

And that's a pretty mild example of what could happen if you did. Hotlinking javascript is an excellent way to allow someone else to pull all kinds of tricks with your visitors and your image. For example, redirecting all your traffic to a shocksite. Every time you include some externally hosted javascript you open yourself and your visitors to a security risk. And on top of that, if you do it like this you're steali…

The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. That way, you can run them through the ol' asset pipeline too... minifiers and possibly serve them straight from gzips. Gotta always remind ppl of https://developers.google.com/speed/ ... the OP scores 47 (out of 100)

The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN.

For dependencies you can control, it's obviously best to keep a local or CDN copy. However this trend of embedding js from all over the web is encouraged by the pattern that most of the big sites allowing you to embed content use:

e.g. https://developers.google.com/+/web/badge/

Google, Twitter, FaceBook all want you to embed js hosted on their servers in your page in order to interact with their site, even if all that script does is then insert an iframe into the page. By including a button or widget like the one above you're trusting them not to take over your site in a manner similar to this example, track your users surreptitiously, or be compromised now or in the future.

Re: You shouldn't hotlink someone else's JavaScript

#47

Post by Trufa »

nevvvermind wrote: post #40
marshray wrote: post #35

Earlier quoted context omitted.

Everyone these days is so polite. OK, that was a bit of an exaggeration. But back in my day the web had a whole site high-bandwidth site specifically for educating careless webmasters about the dangers of hotlinking: g o a t s e . c x. It was used to great effect on things like auction sites where the original page html was not allowed to be changed after listing.

I once hotlinked an image posted on a forum, and they served the same link you provided. I never did a hotlink again.

There was a post on reddit to a site that had hotlinked an image for it's background who suddenly found itself with a pornographic background.

Re: You shouldn't hotlink someone else's JavaScript

#48

Post by Trufa »

geuis wrote: post #5

Ok there is a better way to handle this than adding some html to a page to make a banner, posting to HN, and hoping for the best. Check for referal headers and throw a 301.

I had this exact same thing happen last week in one of my wordpress site, I had just inserted that script when developing to try it out and forgot to change it for a local file or a CDN afterwards.

As someone affected by this, I learned my lesson, but I was very happy about how the hotlinking was handled, I was a clear impossible to miss warning, with a clear and easy solution, I though it was only fair.

Re: You shouldn't hotlink someone else's JavaScript

#49

Post by jacquesm »

grey-area wrote: post #46
ballard wrote: post #29

Earlier quoted context omitted.

The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. That way, you can run them through the ol' asset pipeline too... minifiers and possibly serve them straight from gzips. Gotta always remind ppl of https://developers.google.com/speed/ ... the OP scores 47 (out of 100)

The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. For dependencies you can control, it's obviously best to keep a local or CDN copy. However this trend of embedding js from all over the web is encouraged by the pattern that most of the big sites allowing you to embed content use: e.g. https://developers.google.com/+/web/badge/ Google, Twitter, FaceBook all…

One thing that will happen is that domains that get abandoned that used to host benign js will get taken over by the jerks. That's very hard to protect against, and with the rate at which start-ups encourage people to embed their tags I'm kind of surprised there hasn't been a significant incident like that.

Re: You shouldn't hotlink someone else's JavaScript

#50

Post by TheAnimus »

oneeyedpigeon wrote: post #44
TheAnimus wrote: post #33

>We noticed that you're using Internet Explorer. Polymath currently does not support this browser because compatibility issues prevent us from delivering an ideal experience. We're working on fixing these issues. People do realise that some company networks give you no control over which browser you can use right? I can't understand what feature they would need which is missing from IE10. Why not use feature detectio…

http://caniuse.com/#compare=ie+10,firefox+24,chrome+29

Sure, I don't mind if bits don't work, if I miss out on some WebGL stuff or similar.

But to just put up a big fuck you, to what is the second most popular or most popular browser as a whole isn't helpful. It reminds me of people using Java Applets for navigation in their frames webpage.... Actually I did that once, I was however 11, and this thing had a spinny thing.

Sure, do cool stuff that requires features which some browsers miss, use feature detection to flag that.

Post reply on HN