You shouldn't hotlink someone else's JavaScript
beta.whatispolymath.com
beta.whatispolymath.com
Every time you include some externally hosted javascript you open yourself and your visitors to a security risk. And on top of that, if you do it like this you're stealing bandwidth.
When including remotely hosted javascript make sure you have permission, make sure the other party is trustworthy and periodically review the linked script to make sure it does what is advertised (and that's imperfect, it could be you're seeing something else than other visitors).
That way, you can run them through the ol' asset pipeline too... minifiers and possibly serve them straight from gzips.
Gotta always remind ppl of https://developers.google.com/speed/ ... the OP scores 47 (out of 100)
Really great service by Google in general. I've managed to improve page loading times by 25%, cut number of connections in half (I merged all images into one unified file and then use CSS to display the relevant sub-sections), and reduce the total size of my page by over 10%.
For dependencies you can control, it's obviously best to keep a local or CDN copy. However this trend of embedding js from all over the web is encouraged by the pattern that most of the big sites allowing you to embed content use:
e.g. https://developers.google.com/+/web/badge/
Google, Twitter, FaceBook all want you to embed js hosted on their servers in your page in order to interact with their site, even if all that script does is then insert an iframe into the page. By including a button or widget like the one above you're trusting them not to take over your site in a manner similar to this example, track your users surreptitiously, or be compromised now or in the future.
To evade detection you can even have the hijacking code only included on pages that actually collect credit card info.
<script src="https://elsewhere.example.com" digest="<SHA-$foo>" />
Using anything from sources you don't trust is a bad idea, but even trustworthy partners can be exploited to attack your site as well.
It would mean coordinating updates of the digest to all referencing sites though, which might make it practically impossible.
You just put the version number in the name somewhere and make deployments immutable. Otherwise you have everything you need for that already, technically, though you might want to add a fallback to a local clone of the resource or something so it isn't just a failure.
It hit me that the submission was to a demonstration rather than an article, so I temporarily instructed Noscript to allow all domains used by the page. Sure enough, now the banner appeared.
But that speaks to another reason to not use too many scripts hosted by third-parties. It makes for a very cluttered list of domains for users of Noscript and similar to authorize. I just leave sites that have more than a small number. How many third-party analytics, tracking, tools, social sharing, voting, polling, comments, shopping, deals, and other tools do you really need to embed to make a web site these days?
I love when the list is just domain.foo and domain-static.foo and maybe google-analytics or another mainstream analytics domain.
Not that I mind webmasters running analytics tools, but I'm concerned with google having access to too much personal data/metadata, those privacy issues are bad.
Just use piwik or something.
The problem with Noscript is that it doesn't seem to differentiate between allowing a domain when it's actually a site you're visiting (say, facebook.com) and when it's a domain that a completely different site is trying to load content from. A straight whitelist is too "dumb" for today's web.
People do realise that some company networks give you no control over which browser you can use right? I can't understand what feature they would need which is missing from IE10. Why not use feature detection? We've moved on from browser detection...
But to just put up a big fuck you, to what is the second most popular or most popular browser as a whole isn't helpful. It reminds me of people using Java Applets for navigation in their frames webpage.... Actually I did that once, I was however 11, and this thing had a spinny thing.
Sure, do cool stuff that requires features which some browsers miss, use feature detection to flag that.
Having said that, the site in question is aimed at developers and designers, most of whom [1] will be using something other than IE. So this isn't the worst example out there.
[1] Yes, of course, this is pure conjecture, and I don't have any figures to back that up. Doesn't stop it being true, though.
To be fair, graceful degradation is still a ton of work. It's fine if you're using neat-o features for superficial things (round ALL the corners!). However when you decide to rely on newer tech for more core site features, it means you wind up having to code, and test, twice. Once for the real features in the preferred environment, and once for the degraded features in the non-preferred environment.
If you don't have the resources but you still want to use the stuff with limited support, I think it's polite to include a "hey, we don't test for your configuration so feel free to give us a try, but we apologize if things don't work correctly" banner. I think it's also polite to warn your users where you know things are just painfully broken. "The experience is bad here for users with your configuration."
I'm glad you said this. I think you're stepping out from a trend/trope, which is to make fun of IE, to recognize the more nuanced reality of the situation.
Over the last few months, I've encountered some surprises. One is that although Firefox seems to be a memory hog, it's very reliable at this point. I didn't set out to like Firefox, but now I trust it as much as the old Netscape.
Another is that while I like the idea of Opera and Chrome, each has failed me now in a number of situations where we're not looking at an isolated glitch, but major performance problems. In particular, complex scripts can lock these guys up like a flash freeze, and Chrome has periodic catastrophic crashes:
http://productforums.google.com/forum/#!topic/chrome/7WtG_xY...
This leaves me looking at Firefox and IE as the two real contenders. And while I've never wanted to be an IE fan, as only the unpopular kids on the schoolyard like IE, I think as an application, it's pretty stable. Its only real problem is security and if MS fixes that, I think it's going to be a great competitor for FF now that it's standards-based in the newest version.
- Detect referrer and return a script that has a warning
- Rotate your script filenames so those hotlinking will soon realise they will need to host it themselves
- Use a CDN yourself and don't encourage them to hotlink
- Slow down the request
For those hotlinking, consider:
- You can't trust the source of the code
- You can't trust that the code will always be there and it will load quickly
- You can't trust the contents of the code may change and break your application
If you want to be sinister to those hotlinking you could:
- Redirect the user (as others have noted)
- Display any message to the user
- Steal data from the user who is using the site hotlinking
- Inject your own adverts into the target web page
- Make the web page do the Harlem Shake
In http://jimkeener.com/posts/http I have two things which I think would be great additions to both HTTP and HTML.
The first are Content-Signature (signed with the TLS key perhaps)and Content-Hash (format: "hash-algo base64-hash-value") headers.
The second is allowing a hash and/or signature attributes on elements that have a src attribute. This would allow the UA to check if the file is already cached (across domains perhaps too, though I'm not sure how serious collision attacks would be) without having to check the server.
EDIT: I feel that these two features, in combo, would allow for a more secure method of using CDNs for things such as javascript libraries. They would also allow a better fallback method for loading local resources than what is used now.
<script src="//ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js"></script>
<script>
if (!window.jQuery) {
document.write('<script src="/path/to/your/jquery"> <\/script>');
}
</script>However, I felt that some of the points I brought up in what I'd like to see were relevant to this discussion, even if the entire blog post isn't. This is why I highlight the points that are relevant in my comment.
That is a neat way to communicate ;)
Polymath sounds like a cool idea BTW, but probably difficult to monetize. Somebody must pay the tutors for producing/curating the content, but people have gotten so used to educational material being free...
Check for referal headers and throw a 301.
if(/whatispolymath/.exec(location.href)) alert("...");OK, that was a bit of an exaggeration. But back in my day the web had a whole site high-bandwidth site specifically for educating careless webmasters about the dangers of hotlinking: g o a t s e . c x.
It was used to great effect on things like auction sites where the original page html was not allowed to be changed after listing.
I never did a hotlink again.
Some idiot at Company X decides that it's actually your fault, since its your script that did it. To save face, they get an expensive lawyer to sue you. Next thing you know, you're a registered sex offender.
Please learn the difference between civil and criminal law.
The nice part about using Google is first off it offers speed advantages (as most people will have Google's JQuery lib cached already), secondly I don't expect Google to get hacked, and lastly we have Google's permission to do exactly that.
Regardless of what your privacy policy states, the responsible thing to do is to at least give your users the option of opting out of such tracking by third-parties, all while still leaving your site usable.
Reddit do this. You can choose to load their js from their own servers rather than a CDN.
As someone affected by this, I learned my lesson, but I was very happy about how the hotlinking was handled, I was a clear impossible to miss warning, with a clear and easy solution, I though it was only fair.
We changed to pics of Male Enhancement devices and medication and shared with other car forums, we all watched for days and the guy was pretty clueless on what was going on and apparently didn’t check his ads as often as he should.
We even had a vote for what pic appears today poll.
Remember: The first rule of Changing hot linked photos club is to never talk about changing hot linked photos.
Fortunately, my company's IT department had enough of a clue that when I explained what had happened, they agreed it was possible; it was a tense week, though, while they investigated.
I'm not saying the sort of reaction in parent isn't always appropriate, but just be aware that people's lives can be ruined to save a few dollars. I think the OP's solution is ideal: it alerts people to the problem in a very professional way, and provides solutions for the most common cases.
In the case I mentioned, this was a well known bad actor in the auto circles known for ripping first time buyers off with shady tactics and misrepresenting facts.
http://blog.sucuri.net/2013/05/who-really-owns-your-website-...
thanks,
the classic: "it worked yesterday..."
so i checked the code and all js,css files where used from a git repo from some other guy. who moved all files away in other directories.
was easy to fix, but i have no idea how stupid his coder is to use github urls from other people repos!!
Actually, it's not a bug, pretty obvious he's "demonstrating a feature"... :)
There is actually a business proposition here. You could contact George Smith and ask him for a list of all HTTP referrers. Then contact each site in turn and ask them if they need any help.
Even if they have it sorted already, it might be a good intro into some of these small enterprises.
http://blog.sucuri.net/2013/05/who-really-owns-your-website-...
"The archive web, sponsored by..."
document.location = '...'
and route the page to a java drive-by which redirects back afterwards and most of their visitors would've been infected. They are incredibly lucky that the owner of that script was nice enough just to add a simple banner.
* Never link to someone else's files (JS, images, etc).
* Don't use S3 as a CDN. It's not a CDN. Latency can be bad. Use CloudFront.
* Minify and combine CSS and JS.
* Put your JS at the end of the page.
This just seems so obvious.
+1!