4 ms·

I can't help but think that it would make sense for Mr. Yau to either (a) Change the server setting to emit the X-Frame-Options: DENY header or (b) monetize vie

I can't help but think that it would make sense for Mr. Yau to either (a) Change the server setting to emit the X-Frame-Options: DENY header or (b) monetize views on his graphic. In general, you can't assume people won't deep-link your content, and that includes embedding. Taking steps to protect against or take advantage of traffic spikes is the responsibility of a content provider. This, of course, wouldn't protect against DM just straight yanking all his assets and hosting them itself, which should be clearly immoral (and possibly illegal, depending on jurisdiction). But "framers gonna frame" is a fair thing to assume about the nature of web content, along the lines of "<img> tags are cheap and if people see something funny on your site, they're gonna use 'em to share it."

untog 11y ago
> I can't help but think that it would make sense for Mr. Yau to either (a) Change the server setting to emit the X-Frame-Options: DENY header The article states that the Daily Mail scraped the files and uploaded them separately, to avoid his iframe detecting JS. And "just monetize it" feels like a... simplistic approach. Even if the Daily Mail did a normal iframe embed, how would the author monetize, exactly?
- fixermark 11y ago
  As noted in my original comment: yes. However, he's had issues with multiple sites iframing his content against his will, not just Daily Mail. DM just went the extra mile to straight-up rehost the content, which crosses a line that directing a user's browser to mash up content from multiple servers isn't generally considered to cross (and can be controlled by content providers via use of existing cross-domain headers).
- DanBC 11y ago
  > And "just monetize it" feels like a... simplistic approach. Even if the Daily Mail did a normal iframe embed, how would the author monetize, exactly? Send them an invoice for using his material, with an additional fee for not getting permission in advance. Then take it to small claims if DM doesn't pay.
  - icebraining 11y ago
    Could an US citizen living take them to small claims court from the US?
  - TheOtherHobbes 11y ago
    This is a viable approach. Small Claims is a simple process, you don't need a lawyer, and you can claim for a non-trivial sum plus damages and costs. The DM gets sued regularly, so it's not as if they're invincible.
- logfromblammo 11y ago
  As long as you're fiddling inside the HTTP server, why not just redirect requests from IP addresses known to belong to the serial offender sites to an infographic showing the number of times those blocked sites have copied valuable content without licensing it first? It wouldn't be more than an inconvenience to them, but some people deserve to get rude gestures when they come 'round to mooch.
Silhouette 11y ago
In general, you can't assume people won't deep-link your content, and that includes embedding. Technically, no, you can't with current protocols. However, this has been regarded as bad manners ("hot linking", "bandwidth theft", etc.) since forever. Taking steps to protect against or take advantage of traffic spikes is the responsibility of a content provider. The trouble is, with the increasing concentration of attention on the web in the hands of a few high profile traffic aggregators and social networking sites, this kind of argument holds less credibility than it used to. It's all very well saying if you put something on-line then you're responsible for supporting it, but the reality is that someone else suddenly diverting large amounts of traffic to your site is statistically indistinguishable from a denial of service attack. If it's qualified traffic and being directed to somewhere you welcome the extra visitors, you might appreciate it. If it's unqualified traffic and overloading your servers at your and/or your normal visitors' expense, you probably won't appreciate it. If it's not even being directed to your normal site but instead deliberately freeloading on your servers and bandwidth via hot-linking, I think you're at least well into a grey area in terms of both ethics and legality.
- fixermark 11y ago
  Perhaps more accurate to say "Taking steps to manage traffic is the responsibility of a content host." People make HTTP requests for all kinds of reasons. If you don't have someone managing your hosting, the responsibility defaults to you. That's one of the reasons there's an ecosystem of cloud providers now to shoulder the burden of this implementation detail that people don't want to know just to make content available online. But the core point stands: It's the Internet. You can't trust the clients to behave; assume the worst of user input. Calling out Daily Mail as terrible (which they are, and which people should do at every opportunity ;) ) doesn't solve the root problem that nothing about the protocols restricts using <iframe> to pull in cross-domain content.
  - Silhouette 11y ago
    If you don't have someone managing your hosting, the responsibility defaults to you. That's one of the reasons there's an ecosystem of cloud providers now to shoulder the burden of this implementation detail that people don't want to know just to make content available online. I think it is extremely dangerous to argue that anyone who wants to publish safely on the Internet should be required to do so via some huge cloud provider. We shouldn't conflate what is technically possible because our old protocols give too much trust with what we consider ethical or legal. You can't trust the clients to behave; assume the worst of user input. By the same argument, spammers and those PPI cold callers are OK, because we agreed to have e-mail accounts and phones. In reality, bad actors like this screw up the system for everyone, and dealing with people who screw things up for other people is why we have laws. Treating negligence or particularly actively hostile action as the victim's fault is usually a very bad idea.
city41 11y ago
Not sure why you're getting downvoted so heavily. X-Frame-Options would help. At the very least, it would have forced DM to steal his previous visualization instead of having him foot the hosting costs. It's basically his "poop" solution except properly done, and scales to all of his content instead of having to be a one-off.

untog 11y ago

> I can't help but think that it would make sense for Mr. Yau to either (a) Change the server setting to emit the X-Frame-Options: DENY header The article states that the Daily Mail scraped the files and uploaded them separately, to avoid his iframe detecting JS. And "just monetize it" feels like a... simplistic approach. Even if the Daily Mail did a normal iframe embed, how would the author monetize, exactly?

fixermark 11y ago
As noted in my original comment: yes. However, he's had issues with multiple sites iframing his content against his will, not just Daily Mail. DM just went the extra mile to straight-up rehost the content, which crosses a line that directing a user's browser to mash up content from multiple servers isn't generally considered to cross (and can be controlled by content providers via use of existing cross-domain headers).
DanBC 11y ago
> And "just monetize it" feels like a... simplistic approach. Even if the Daily Mail did a normal iframe embed, how would the author monetize, exactly? Send them an invoice for using his material, with an additional fee for not getting permission in advance. Then take it to small claims if DM doesn't pay.
- icebraining 11y ago
  Could an US citizen living take them to small claims court from the US?
- TheOtherHobbes 11y ago
  This is a viable approach. Small Claims is a simple process, you don't need a lawyer, and you can claim for a non-trivial sum plus damages and costs. The DM gets sued regularly, so it's not as if they're invincible.
logfromblammo 11y ago
As long as you're fiddling inside the HTTP server, why not just redirect requests from IP addresses known to belong to the serial offender sites to an infographic showing the number of times those blocked sites have copied valuable content without licensing it first? It wouldn't be more than an inconvenience to them, but some people deserve to get rude gestures when they come 'round to mooch.

Silhouette 11y ago

In general, you can't assume people won't deep-link your content, and that includes embedding. Technically, no, you can't with current protocols. However, this has been regarded as bad manners ("hot linking", "bandwidth theft", etc.) since forever. Taking steps to protect against or take advantage of traffic spikes is the responsibility of a content provider. The trouble is, with the increasing concentration of attention on the web in the hands of a few high profile traffic aggregators and social networking sites, this kind of argument holds less credibility than it used to. It's all very well saying if you put something on-line then you're responsible for supporting it, but the reality is that someone else suddenly diverting large amounts of traffic to your site is statistically indistinguishable from a denial of service attack. If it's qualified traffic and being directed to somewhere you welcome the extra visitors, you might appreciate it. If it's unqualified traffic and overloading your servers at your and/or your normal visitors' expense, you probably won't appreciate it. If it's not even being directed to your normal site but instead deliberately freeloading on your servers and bandwidth via hot-linking, I think you're at least well into a grey area in terms of both ethics and legality.

fixermark 11y ago
Perhaps more accurate to say "Taking steps to manage traffic is the responsibility of a content host." People make HTTP requests for all kinds of reasons. If you don't have someone managing your hosting, the responsibility defaults to you. That's one of the reasons there's an ecosystem of cloud providers now to shoulder the burden of this implementation detail that people don't want to know just to make content available online. But the core point stands: It's the Internet. You can't trust the clients to behave; assume the worst of user input. Calling out Daily Mail as terrible (which they are, and which people should do at every opportunity ;) ) doesn't solve the root problem that nothing about the protocols restricts using <iframe> to pull in cross-domain content.
- Silhouette 11y ago
  If you don't have someone managing your hosting, the responsibility defaults to you. That's one of the reasons there's an ecosystem of cloud providers now to shoulder the burden of this implementation detail that people don't want to know just to make content available online. I think it is extremely dangerous to argue that anyone who wants to publish safely on the Internet should be required to do so via some huge cloud provider. We shouldn't conflate what is technically possible because our old protocols give too much trust with what we consider ethical or legal. You can't trust the clients to behave; assume the worst of user input. By the same argument, spammers and those PPI cold callers are OK, because we agreed to have e-mail accounts and phones. In reality, bad actors like this screw up the system for everyone, and dealing with people who screw things up for other people is why we have laws. Treating negligence or particularly actively hostile action as the victim's fault is usually a very bad idea.

city41 11y ago

Not sure why you're getting downvoted so heavily. X-Frame-Options would help. At the very least, it would have forced DM to steal his previous visualization instead of having him foot the hosting costs. It's basically his "poop" solution except properly done, and scales to all of his content instead of having to be a one-off.