3 ms·

Please choose ONE of the following: 1. One or more developers working full-time on fixing bugs and working on new projects/features 2. One or more developers

by donohoe 16y ago

Please choose ONE of the following: 1. One or more developers working full-time on fixing bugs and working on new projects/features 2. One or more developers working full-time updating Class and ID names and staying on top of the latest Plugins and Greasemonkey Scripts... No, seriously - make a choice.

robryan 16y ago
Why not just make the check on the back end, if the article content never gets sent then this kind of stuff doesn't need to be an issue.
- wladimir 16y ago
  Can't upvote this enough. If you want to protect content, make the checks server-side. Security must be server-side first, no exceptions. Doing anything else is asking for tech savy people with debuggers (or "view source" in this case) working around it. You can get into a race with your users renaming javascript variables or changing CSS classes, or implementing the most advanced javascript obfuscator that exists today, but this is a waste of time.
Johngibb 16y ago
This is a lame false dichotomy. This is such an easy exploit that the developers must have known about it, and consciously decided to ship with a vulnerability. As others have suggested, they probably realized that those who break the paywall probably wouldn't have paid anyway.
- Johngibb 16y ago
  Looks like it was knowingly done: http://news.theage.com.au/breaking-news-technology/some-readers-will-get-around-paywall-ny-times-20110324-1c70j.html http://news.theage.com.au/breaking-news-technology/some-read...
- donohoe 16y ago
  You are right and I apologize. There are any number of ways to get around it. Thats a known, regardless of what you do. Rather than expend time and resources locking this up as much as possible its accepted that X number of people will do whatever they want. What is a little frustrating is people thinking they've totally hacked the NYT subscription model and subverted our cleverly crafted lock-down methods. However, its been stated publicly at several pay grades above me, that is there is an organized concerted effort to work-around the subscription then we have to act on that. Not just in a legal way, but also by developers working to lock-down the site more and more. As I said, I'd rather work on constructive projects instead of that. It is easy for anyone who knows how to View Source to get to the content. I just wish they'd stop thinking they're all l33t and subversive when its just a little sad (to me at least). I think I'd ultimately feel better if I just ignored this stuff.
  - MatthewPhillips 16y ago
    Come on, this has nothing to do with "expending time". It's about SEO. Otherwise they would take the minimal effort to serve a different page to people above the threshold.

by donohoe 16y ago

robryan 16y ago

Why not just make the check on the back end, if the article content never gets sent then this kind of stuff doesn't need to be an issue.

wladimir 16y ago
Can't upvote this enough. If you want to protect content, make the checks server-side. Security must be server-side first, no exceptions. Doing anything else is asking for tech savy people with debuggers (or "view source" in this case) working around it. You can get into a race with your users renaming javascript variables or changing CSS classes, or implementing the most advanced javascript obfuscator that exists today, but this is a waste of time.

Johngibb 16y ago

This is a lame false dichotomy. This is such an easy exploit that the developers must have known about it, and consciously decided to ship with a vulnerability. As others have suggested, they probably realized that those who break the paywall probably wouldn't have paid anyway.

Johngibb 16y ago
Looks like it was knowingly done: http://news.theage.com.au/breaking-news-technology/some-readers-will-get-around-paywall-ny-times-20110324-1c70j.html http://news.theage.com.au/breaking-news-technology/some-read...
donohoe 16y ago
You are right and I apologize. There are any number of ways to get around it. Thats a known, regardless of what you do. Rather than expend time and resources locking this up as much as possible its accepted that X number of people will do whatever they want. What is a little frustrating is people thinking they've totally hacked the NYT subscription model and subverted our cleverly crafted lock-down methods. However, its been stated publicly at several pay grades above me, that is there is an organized concerted effort to work-around the subscription then we have to act on that. Not just in a legal way, but also by developers working to lock-down the site more and more. As I said, I'd rather work on constructive projects instead of that. It is easy for anyone who knows how to View Source to get to the content. I just wish they'd stop thinking they're all l33t and subversive when its just a little sad (to me at least). I think I'd ultimately feel better if I just ignored this stuff.
- MatthewPhillips 16y ago
  Come on, this has nothing to do with "expending time". It's about SEO. Otherwise they would take the minimal effort to serve a different page to people above the threshold.