4 ms·

Because this is disallowed by CORS/single origin policy

judge2020 8y ago
I think the OP stated a "what if", ie "What if CORS didn't exist?" I also think you could argue "What if outline loaded articles in an iframe?" (and at the same time "what if same-origin policy wasn't a thing?") If it was technologically possible, would it be infringing?
- thinkloop 8y ago
  > If it was technologically possible It's actually pretty easy, you can start chrome with --disable-web-security flag [1] > I also think you could argue "What if outline loaded articles in an iframe?" I'm sure this would be legal as it's equivalent to loading the site in a tab. The parent site wouldn't be able to manipulate any of the content/ads/paywalls/functionality, and the content site gets the full hit. [1] https://stackoverflow.com/questions/3102819/disable-same-origin-policy-in-chrome https://stackoverflow.com/questions/3102819/disable-same-ori...
  - dorgo 8y ago
    > The parent site wouldn't be able to manipulate any of the content/ads/paywalls/functionality What? What do we disable CORS for if not to allow Javascript from one domain manipulate content in an iframe of an other domain? Am I missing something?
    - thinkloop 8y ago
      Disabling CORS would allow you to make straight requests to foreign content from your site and manipulate the responses exactly as though they came from your own servers - no iframe needed. CORS does not disable iframe sandboxing.
realusername 8y ago
CORS is just a security feature, it does not imply anything about copyright or terms of use.
- icebraining 8y ago
  The DMCA ties the two by prohibiting users of copyrighted works from circumventing technological protection measures. It could be argued that bypassing CORS applies.
  - realusername 8y ago
    CORS isn't a technological protection like a DRM and isn't design as such, it's purely a security measure, by default you don't even specify it. Browsers are free to ignore them as they wish (but with increased security risks of course).
    - jrockway 8y ago
      I agree. CORS is something my user agent does to protect me. It has nothing to do with the upstream site; I could easily browse it with a user agent that doesn't support CORS and nothing would break. CORS is just some annotations that lets my user agent determine "hey these scripts might be up to something shady". It is not a copy-protection mechanism by any means.
- sam0x17 8y ago
  Yeah, but my point is what was being suggested is physically impossible with CORS in place, so it does imply something about what is in the realm of possibility.
KingMachiavelli 8y ago
CORS is really just a security for embeded pages and elements. It's not intended and cannot enforce usage restrictions/rights since it requires the client (browesr) to honor the setting. If I wget a page and strip the text from it, I'm not embeding the page in any manner so CORS is irrelevant. The current 'aggrement' for respecting copyright (wether it would hold up in court even with a TOS is beyond my knowledge) is robots.txt which, I'll admit is pretty dated and a very poor solution for dynamic pages and still requires client . The best solution for copyright/paywall enforcement is to roll your own. If the request doesn't have the required cookie to access the full article, don't respond with the full page. This works very well for dealing with sites such as outline.com . Sites like outline.com would be really interesting/usefull if they allowed you to upload your login cookies so that they could get paywalled articles and still strip the ads.
- thinkloop 8y ago
  > If the request doesn't have the required cookie to access the full article, don't respond with the full page The way outline.com works is by loading the article unsuspiciously once from their server, then serving it any number of times from their infrastructure. How would this stop that from happening?
deleted 8y ago
[deleted]

judge2020 8y ago

I think the OP stated a "what if", ie "What if CORS didn't exist?" I also think you could argue "What if outline loaded articles in an iframe?" (and at the same time "what if same-origin policy wasn't a thing?") If it was technologically possible, would it be infringing?

thinkloop 8y ago
> If it was technologically possible It's actually pretty easy, you can start chrome with --disable-web-security flag [1] > I also think you could argue "What if outline loaded articles in an iframe?" I'm sure this would be legal as it's equivalent to loading the site in a tab. The parent site wouldn't be able to manipulate any of the content/ads/paywalls/functionality, and the content site gets the full hit. [1] https://stackoverflow.com/questions/3102819/disable-same-origin-policy-in-chrome https://stackoverflow.com/questions/3102819/disable-same-ori...
- dorgo 8y ago
  > The parent site wouldn't be able to manipulate any of the content/ads/paywalls/functionality What? What do we disable CORS for if not to allow Javascript from one domain manipulate content in an iframe of an other domain? Am I missing something?
  - thinkloop 8y ago
    Disabling CORS would allow you to make straight requests to foreign content from your site and manipulate the responses exactly as though they came from your own servers - no iframe needed. CORS does not disable iframe sandboxing.

realusername 8y ago

CORS is just a security feature, it does not imply anything about copyright or terms of use.

icebraining 8y ago
The DMCA ties the two by prohibiting users of copyrighted works from circumventing technological protection measures. It could be argued that bypassing CORS applies.
- realusername 8y ago
  CORS isn't a technological protection like a DRM and isn't design as such, it's purely a security measure, by default you don't even specify it. Browsers are free to ignore them as they wish (but with increased security risks of course).
  - jrockway 8y ago
    I agree. CORS is something my user agent does to protect me. It has nothing to do with the upstream site; I could easily browse it with a user agent that doesn't support CORS and nothing would break. CORS is just some annotations that lets my user agent determine "hey these scripts might be up to something shady". It is not a copy-protection mechanism by any means.
sam0x17 8y ago
Yeah, but my point is what was being suggested is physically impossible with CORS in place, so it does imply something about what is in the realm of possibility.

KingMachiavelli 8y ago

CORS is really just a security for embeded pages and elements. It's not intended and cannot enforce usage restrictions/rights since it requires the client (browesr) to honor the setting. If I wget a page and strip the text from it, I'm not embeding the page in any manner so CORS is irrelevant. The current 'aggrement' for respecting copyright (wether it would hold up in court even with a TOS is beyond my knowledge) is robots.txt which, I'll admit is pretty dated and a very poor solution for dynamic pages and still requires client . The best solution for copyright/paywall enforcement is to roll your own. If the request doesn't have the required cookie to access the full article, don't respond with the full page. This works very well for dealing with sites such as outline.com . Sites like outline.com would be really interesting/usefull if they allowed you to upload your login cookies so that they could get paywalled articles and still strip the ads.

thinkloop 8y ago
> If the request doesn't have the required cookie to access the full article, don't respond with the full page The way outline.com works is by loading the article unsuspiciously once from their server, then serving it any number of times from their infrastructure. How would this stop that from happening?

deleted 8y ago

[deleted]