3 ms·

Maybe read/click count is hackable (bots?) and there is plenty of motivation to taint the system (new products would love to make it to the top of HN). Humans u

• dvdhnt 10y ago
  You're absolutely right. I was thinking about that while posting my original comment. I wonder if you can ensure that "read/click" is only incremented if the appropriate cookie is present. That, too, I'm assuming is hackable. Then again, up/down seems as hackable. I mean, the link click is just calling a handler: <a id="up_13164626" onclick="return vote(event, this, "up")" href="vote?id=13164626&amp;how=up&amp;auth=08cc6438787bda18f8904afcf50af38e31d34824&amp;goto=reply%3Fgoto%3Dthreads%3Fid%3Ddvdhnt%2313164626%26id%3D13164626#13164626"><div class="votearrow" title="upvote"></div></a> Perhaps the auth attribute is a random CSRF token, while the end of the href appears to be this comments URL. It seems like we could use the same idea, hijacking the navigation event on the link itself, applying a CSRF/auth token, and incrementing the read/click count. Seems like this would basically be the kind of granular auth allowed by service like Google Docs. Just spitballing.