8 ms·
Hotlinking to jquery.com will be disabled on January 31, 2011
- cletus 16y agoFrankly I'm surprised jquery even allowed this to begin with. Now there will be sites that rely on this tha break, some of which won't be fixed for ages (if ever). I guess I shouldn't be but I'm still surprised people would even do this given that Google s offering the service for free. Hotlinking has always been antisocial.
- sudont 16y agoNever doubt the laziness of people, especially other developers. I'm actually more surprised that the site didn't either use Google's API to host the download, or provide a hotlink button right there.
- angrycoder 16y agoSome might be from laziness, but I would imagine most of the hotlinking is from ignorance.
- TorKlingberg 16y agoI guess it is both: Too lazy to find out the right way to do it.
- bigiain 16y agoAgreed. I'll bet a significant portion of it is coming from cut-n-pasted html where the users don't even realise they're using hotlinked javascript, and have probably never even heard of jquery (and, unfortunately, are spectacularly unlikely to hear about this change on jquery's hotlinking policy).
- deleted 16y ago[deleted]
- scorpion032 16y ago"Never attribute to malice that which is adequately explained by stupidity." Hanlon's Razor: http://en.wikipedia.org/wiki/Hanlons_razor http://en.wikipedia.org/wiki/Hanlons_razor
- jasoncartwright 16y agoPerhaps a little harsh. Is the problem bandwidth or connection quantity? If it's bandwidth then they should just 301 to the Google CDN.
- izak30 16y agoThey are not disabling their CDN. They are only disabling hotlinking against other sources. This was in the first sentence.
- jasoncartwright 16y agoI understand that. The question still stands - if it's a bandwidth problem on jquery.com, why not just 301 it somewhere else?
- zootm 16y agoBecause 301'ing provides little or no incentive for the offenders to do the right thing. Also it doesn't stop the excess traffic, it just reduces it.
- jeresig 16y agoStraight connection overloading. We're already redirecting the majority of the files - but somehow the hotlking continue to persist.
- jasoncartwright 16y agoMakes sense, good decision then.
- ronnier 16y agoHow are you preventing hotlinking while still allowing the files to function normally on jquery.com? Inspecting the referrer or checking to see if other resources were previously downloaded?
- DanHulton 16y agoI like the one comment about serving up evil.js to hotlinkers instead (https://github.com/kitgoncharov/evil.js/blob/gh-pages/evil.js https://github.com/kitgoncharov/evil.js/blob/gh-pages/evil.j...). How have I never heard about this hilarious script before?
- statictype 16y agoWow. That script is all kinds of awesome. Javascript is unconventional and unpredictable as it is, without intentionally hosing the entire runtime environment like this.
- yuhong 16y agoOne of the reasons JavaScript crypto is a bad idea in most cases.
- amackera 16y agoI lol'd @ 'PI': 3.2
- BCM43 16y agoFor those of us who do not know javascript (a rarity on HN, I know) could you explain what it does?
- jerf 16y agoIt does... many things. All sort calls are hardcoded to return [4, 8, 15, 16, 23, 42], regardless of input. It scrambles the log bases for the math logarithm commands, it hardcodes the output of the upper-casing string call to a constant, and what I've reported is just a sampler. It is very well-named. Could be improved a bit, though. Many of its entries lack subtlety. If you really want to be evil, make uppercase do something like uppercase all but one letter, or "uppercase" the digit 1 into exclamation marks, 2 into at signs, etc., convincing the poor developer that the JS upper case function is broken and affect digits. ("Must be unicode or something.")
- zbanks 16y agoCrockford used to prevent hotlinking to his JSON library (its now on github) in an interesting way: right at the top there was an alert() line that you had to remove before using. This would probably be the best way to transition. If they add an alert to their library and leave it up a week, most people should notice and fix it.
- orblivion 16y agoIf Crockford used it in production though, the alert() would be removed there, right? So someone could still in theory hotlink that.
- deleted 16y ago[deleted]
- Nycto 16y agoUnless jquery.com itself uses Google's CDN (which it already is for some of its javascript)
- jerf 16y agoif (location.host.search(/crockford.com$/i) != -1) { alert("Stop hotlinking me!") } I don't think you can fool that, but I'd love to hear about how I'm wrong.
- adamdecaf 16y agowindow.alert = function () {};
- tlrobinson 16y agoif (location.host.search(/crockford.com$/i) != -1) { throw "Stop hotlinking me!"; }
- simonsarris 16y ago
- dedward 16y agoAlways seemed to be to be a bad practice from a security point of view - you are putting the security of your site in the hands of whoever is hosting the .js This also applies when .js is dynamically included as a type of API call to embed widgets and whatnot - but in those cases there's a necessary reason - it's the only practical way - but for a simple .js, you should be managing your own .js library and publishing on your own (including all the speedup tricks you know you should be doing)
- wzdd 16y ago> Always seemed to be to be a bad practice from a security point of view This is why I can't understand people's recommendation to use Google's or Microsoft's CDN. Even if you assume they're not going to be malicious, you have to trust that they're secure. Not to mention that the CDN owner can derive accurate traffic stats from the number of requests for the JavaScript.
- jdminhbg 16y agoWhy would I be less sure that they're secure than my own personal hosting?
- dfranke 16y agoNo reason you would be. But you can be sure that your personal hosting is more secure than (your personal hosting ∪ Google). In the latter case if either breaks you're screwed.
- rhizome 16y agoYou know the components of, and the capacity to upgrade, your own stack. With hotlinking, you (and consequently your users/customers) have an external dependency to a mysterious system with who-knows-what going on.
- Encosia 16y agoAs long as the CDN is configured to transmit its files with a far-future expires header (which Google and Microsoft's CDNs are), the CDN owner can't accurately track usage at all. In a perfect world, the CDN would only handle one HTTP request per user per expires period (+1 year on Google and Microsoft's jQuery CDN). In reality, the file will be pushed out of or cleared from caches for various reasons, but they still persist long enough to make tracking end-usage of the CDN meaningless.
- mike-cardwell 16y agoIt should be trivial for them to scan their access logs for referrers, and then send a mailshot out to each domains webmaster address. To me, that seems like the polite thing to do.
- ergo98 16y agoThey are already going way above and beyond by extending their deadline to the end of January. They have the capacity to be much ruder about it. Hotlinking like this has been a well known web evil for well over a decade. That people still do it and just hope for the best is indicative of extraordinary laziness and selfishness.
- mike-cardwell 16y agoYou're attributing malice to something which could be attributed to ignorance. A common error. They could just break all those sites without giving them personalised warnings, yes. And they would also be completely entitled to yes. But for the small amount of effort needed, why not try to minimise the damage.
- ergo98 16y agoMalice? As quaint as that saying is, malice plays no part in this discussion. I'm attributing laziness, which is quite removed from malice. People using jquery should be evolved enough to know what CDNs are, and the dangers of hotlinking (which is as simple as "jQuery decided to reorganize their site, and now a thousand sites are broken").
- mike-cardwell 16y agoI guarantee that some people are using the wrong URLs because they received bad advice, or copied from code they shouldn't have, or were simply told by somebody that they could link to the version on jquery.com, so did. These people don't need punishing, they need educating. I find the whole "fuck em, it's their fault" attitude to be very childish.
- rorrr 16y agoJust for the record, here are the CDN versions: http://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js http://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js (always the latest version) http://code.jquery.com/jquery-1.4.4.min.js http://code.jquery.com/jquery-1.4.4.min.js http://ajax.microsoft.com/ajax/jQuery/jquery-1.4.4.min.js http://ajax.microsoft.com/ajax/jQuery/jquery-1.4.4.min.js
- Encosia 16y agoAvoid using the "latest version" reference. In order to ensure that it's serving the latest version, it serves the script with an extremely short expires header.
- scotth 16y agoNot to mention that referencing the latest version means that your code will be untested against anything but the library version you built against.
- slexaxton 16y agoYou forgot: http://cdn.thetaylornation.com/taylornation/resources/display/js/jquery/jquery-1.4.2.min.js http://cdn.thetaylornation.com/taylornation/resources/displa...
- alanh 16y agoKeep in mine that many sites use the Google version, so if you do to, some of your visitors will get it "free" (from their local cache). The caveat about not using the "latest version" stands. And for the gods' sake don't use the actual google Ajax loader API, it's an extra script to load. (Include the above URL directly, not by doing a .load() on something else.)
- ajpiano 16y agoWe did a lot of analysis of the sites that were actually hotlinking, and are planning to reach out to those that are above board and should know better. By and large, however, most of the sites that were hotlinking were porn/phishing/generally nefarious, which weighed heavily into our decision to pull the plug relatively soon. Serving people who need jQuery and jQuery UI documentation, etc., is a higher priority than not-pulling-the-rug-out-from-under networks of porn sites - people who have more than adequate access to their own hosting and distribution resources.
- ajpiano 16y agoOTOH, TaylorSwift.com was also hotlinking, which is pretty awesome.
- slexaxton 16y agoI am currently trying to talk to Taylor about sharing cdn resources. If anyone is not aware, one of the best CDNs out there for getting jQuery is the Taylor Swift "TaylorNation" cdn. http://cdn.thetaylornation.com/taylornation/resources/display/js/jquery/jquery-1.4.2.min.js http://cdn.thetaylornation.com/taylornation/resources/displa... I encourage everyone to use it.
- catshirt 16y agoslexaxton imma let you finish... but amazon has one of the best cdns of all time
- quinndupont 16y agoDamn shame. I used to hotlink during testing when I was too lazy to download the actual JS and host it. It was a nice way to build wicked fast little sites.
- ceejayoz 16y agoJust hotlink to Google's version.
- Fluxx 16y agoWhen the change is made, changing the results of the HTTP GET to some javascipt comments explaining what happened and pointing them to some CDNs which offer the same service would be a good idea.
- rbanffy 16y agoWays to solve the problem once and for all: - Listing the sites that hotlink it would be a nice idea. - Changing the script on the hotlinked files to pop-up a warning that the site is doing something improper and urging people to contact the owner. - When that doesn't work, break the sites.
- mark_h 16y agoNow is probably a good time for a reminder: http://scriptsrc.net/ http://scriptsrc.net/ (Up to date CDN links for a bunch of javascript libraries, including jquery)
- sdghrtrt 16y ago====== ( http://is.gd/iMmpn http://is.gd/iMmpn )==== ====== ( http://is.gd/iMmpn http://is.gd/iMmpn )==== ====== ( http://is.gd/iMmpn http://is.gd/iMmpn )==== ====== ( http://is.gd/iMmpn http://is.gd/iMmpn )==== Gold autumn, personality Mes clothing + Shoes, Travel bag that grabs an eye coat + Chao packet Free transport ====== ( http://is.gd/iMmpn http://is.gd/iMmpn )==== ====== ( http://is.gd/iMmpn http://is.gd/iMmpn )==== ====== ( http://is.gd/iMmpn http://is.gd/iMmpn )==== ====== ( http://is.gd/iMmpn http://is.gd/iMmpn )====
- sagerhreh 16y ago=== http://ta.gg/4wt http://ta.gg/4wt ==== === http://ta.gg/4wt http://ta.gg/4wt ==== === http://ta.gg/4wt http://ta.gg/4wt ==== === http://ta.gg/4wt http://ta.gg/4wt ==== === http://ta.gg/4wt http://ta.gg/4wt ==== === http://ta.gg/4wt http://ta.gg/4wt ==== New era cap $12; Air jordan(1-24)shoes $30; jordan air max oakland raiders $34a€“39; Ed Hardy AF JUICY POLO Bikini $25; Christan Audigier BIKINI JACKET $25; Tshirts (Polo ,ed hardy,lacoste) $15 coogi DG edhardy gucci t-shirts $18; gstar coogi evisu true jeans $35; coach chanel gucci LV handbags $36; === http://ta.gg/4wt http://ta.gg/4wt ==== === http://ta.gg/4wt http://ta.gg/4wt ==== === http://ta.gg/4wt http://ta.gg/4wt ==== === http://ta.gg/4wt http://ta.gg/4wt ==== === http://ta.gg/4wt http://ta.gg/4wt ==== === http://ta.gg/4wt http://ta.gg/4wt ====
- iwwr 16y agoThe jquery people are being incredibly generous. Others would have just tweaked the JS to produce some shock site or text to the effect "you are a bandwidth thief".