4 ms·
Whoa! Hotlinking Ghost CDN URLs in Substack production HTML. Yes this is a bad look for Substack. And it puts them - and their users - at Ghost's mercy.
by chrisweekly 4y ago
Whoa!
Hotlinking Ghost CDN URLs in Substack production HTML.
Yes this is a bad look for Substack. And it puts them - and their users - at Ghost's mercy.
- tiffanyh 4y agoIt's also incredibly easy for Ghost to prevent hot linking. It just 2-3 lines in your nginx/apache config file that blocks hot linking, and many people consider this a standard practice to do regardless.
- cptcobalt 4y agoTotally. I feel like Ghost has integrity and wouldn't resort to shenanigans, but this is a wildly poor security posture and really a faux pas to be forcing ghost to incur CDN costs on this.
- peter422 4y agoThey are not hotlinking ghost urls... JSdelivr is a giant JS CDN. Ghost is in the url because they developed the library so it's the GitHub path. You could use this library on your website right now... They open sourced it!
- jairajs89 4y agoHey, Substack CTO. That's exactly right. Thank you for this
- cxr 4y agoThere's more to it than that. There are two resources involved. One is using Ghost's (jsdelivr-backed) CDN. The other is just using jsdelivr's CDN for any and every NPM package that gets published in the clear. The asset that thefp.com is using is the one that gets loaded from the latter (the one served from the public CDN), and you can see that this was true even at the time that O'Nolan's screenshots were taken. For some reason, he mixed them up; the only evidence that we have of anyone here using the CDN that Ghost is (presumably) paying for is Ghost's own use of it themselves.
- deleted 4y ago[deleted]
- jairajs89 4y agoHey, Substack CTO here. We don't hotlink to Ghost at all and instead use jsdelivr to link to client-side open-source libraries. jsdelivr is awesome btw, works with any npm module, and is fast and reliable https://www.jsdelivr.com https://www.jsdelivr.com