21 ms·
Using Goatse to Stop App Theft
- deleted 3y ago[deleted]
- earthboundkid 3y agoThere’s an HTTP header you can add that prevents a page being in an iframe, but go off, king.
- deleted 3y ago[deleted]
- sudhirj 3y agoYup. The article mentions it was an “explicit” decision to use this approach instead. Seems much more effective than CSP headers.
- moolcool 3y ago> The mature and responsible thing to do would have been to add a content security policy to the page OP knows that
- mbakke 3y agoThey explicitly mention that in the famous article, but concede that they are not mature enough for that.
- deleted 3y ago[deleted]
- seanhunter 3y agoJust so anyone searching this thread is aware, "Content-Security-Policy:... frame-ancestors 'none';" is what you are (I think) referring to. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
- tetha 3y agoOh, TIL X-Frame-Options has been superseeded. That was the header I was thinking about.
- seanhunter 3y agoYeah I set them both just in case people have an ancient user agent but I think that's not required any more.
- spondylosaurus 3y agoRest assured that the article linked here does not include any images, goatse or otherwise.
- NickNaraghi 3y agoLuckily it's not rendered in an iFrame!
- iso8859-1 3y agoThis site allows anyone to inject content, you don't need an iframe. https://joshcsimmons.com/post/eJyVlD2PgzAMhvf8Cm8HlcD76dSlf8OSYUCMnA4GBqu%2F%2FRInBqetVDUD5ON944+H9uf3b7peYIYFRthghQl2eLsOM3w2oj4sgDqn6qRaod9ZwihlKl7kLVK9xrCZcugrizzNvvW5hXV41lQrqpNYw3QkIKUiTZwobXcdM5AJNMgU9iNnSgbuuvv9jHRPHikKDRL14XIWStw5uTcyHZ7ChDhbTMN9V0bPOrQcdcyRiBNTPkcEhviOz4Yb5ms+V0ckAqcldviWlC1AtmaDWqSwjESsQ6R3qINbtGvUoA7Oe5GItRQ115sq2hNCkw3acyNibWhSycVhBUVlrAnd16dErChKsVPXqBhyExpmPGPuygMKJbKMhtRYSNS%2FKjJy8JADScbBbGjQb2MUZh71V5iTFru0+rFI4fHiu7XMqbZI4eEc6CO8iCKZhzwatAlIXLrkbhTl4ZPC48hLXUjl4a+Ad47E48P%2FrH87iPTj https://joshcsimmons.com/post/eJyVlD2PgzAMhvf8Cm8HlcD76dSlf8... Created using wget "https://gist.githubusercontent.com/snipe/5512408/raw/db9f4051eeb1079de436ec5ae9ba9aff2a99549c/gistfile1.txt" python3 >>> base64.b64encode(zlib.compress(b"<pre>" + open('gistfile1.txt', 'rb').read())).replace(b'/',b'%2F')
- preciousoo 3y agoOn my phone right now, but how did you figure this out?
- 3guk 3y agoIt's explained on this page about how his blogging system works - https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQMQLbgFe%2BtjDytnXtZNF1EmSdAEEQIJTE3WE9GqozlGX56wuOZCMtiu7LXmbEc%2BEhdw9WCpxgcKjA9rEsiveiQA8UR3UcdrCCIbKSXdtKnE4A%2B4Yp1FS%2BHEuAFsMIKh3X6Q0o1S6Il914BHXvtY90BFcuclLGwDoeASmgL4viE9USavaGpo4SQcOpw4hKczlIBkt%2BBM8ta4L2ZwpLBXWcoBMOegQauULPqTXKScBhbBYDR2qAgwosW4pcY3imBWrq1RFsI7ZGQrYggeytHYFSwjGZvuxSyzunUBFgAA5B6l76NNGEimppydiGhMoS0IO6KP3OQUVW2RCogWq0yrXErk8ZTR1F6PrKcz0DlkVxZ6IqLzsTEmSAzd3y7np9vdmUcOcIKChHgk5SbmItQZFDlpnlfP60nrSN0gNGggdOrEYjyFDC0ntj8coQXj1DcAKcHKuloQZa5AAd7maXZowEnsO9yc7oCVZQe%2BQWsFcnMTnuQLYlfNhCLX1M9vT%2F8yWsnTkx9T9XL4tiGeYQWrsqgh0Fslg04ChSCV%2BlNwDfWCwDOKs8Sh9BhjA5l1n3iXJkBqqSZRVNZKTQUKQIvM0GRULvRxgwWH2V0mYj9V0n0QKH8b6RIZRFsdr33shM7fIjRPKEyWi2ln%2Fx5ssz1YnG509ry6KEElYTnOFM9xSSYjRQwujHLG1%2FnsmdUI5eb1wX6mjhRJqyKE5LuKNHhS37HNRnU20YlUIJn1Of9SDcztTz3SOo%2BikQk28qmq9F6iIlCjpnsUHFxVZii5rML6VHLYuzEm4MkBO8feKuo6Y4L%2BE3TPTrBThMuYV2MvFqsaFp5tAcWFCYQpU0mlsHSWzpDBLvM0a%2BdFhclLCZLnQea2oAt0oRfpjE4x8WFgu2bOFPSa5O3LYSUllLWxR7e3DDobFnP%2BZcDqwOriya1CyWL%2BEsiuu8xrJrOSKrl4a8tPU%2FEg2eHyjBvC6%2BRRGdQmubhpW%2BHzjVLr05Pv43t8OXxtsgRsJMEv%2FBwOEDTag2EwoDew9e5B4839O843BH5SxOttCH%2B2Ct%2FYllroLwreE01YrPfFWyBvtoZb4fHGdL312k1XJ%2BvT67OV%2Ff%2FnX59HFz%2BmX1xK%2FPbt5vvrxbba4e1182u4eRh25Tn979cRtW65uvMl5d9id0ezU%2F%2B%2Frs5vL35dvIdH7i7bfDMjdlbVs7b8RUFNY9T2GnroRbfMzdnL5bb69clDYn7Ozk8hxqhxFrpZhgAWcnv1zMaTAnU1%2BpHWZFjeRVhaGBKL3mf6ZGwr6COQQU8hbGSnoFJwPU0lriE9tizwlUmcYsqRWxO9nxFrt8ZhOwmHnaDLFCImrzWWXLLQPYXyRCchJ1WuRl8TcAAAD%2F%2FwMA1onjg2UHAAA%3D https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQ...
- carterparks 3y agoYour website has the worst permalinks ever.
- natefox 3y agoAgreed. Went to share the link and it was such a wall of text I deleted it.
- i_am_jl 3y agoApparently the post data is encoded in the URL. I'm not saying you're wrong. You're right, but at least it's for an interesting reason.
- NGRhodes 3y ago> This blog is now STATELESS. The entire post is contained in the URL that you are visiting now. All my "blog" is now is a hard-coded main page that contains links to posts I claim authorship of. Of course the entire post is contained in each of these links. https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQMQLbgFe%2BtjDytnXtZNF1EmSdAEEQIJTE3WE9GqozlGX56wuOZCMtiu7LXmbEc%2BEhdw9WCpxgcKjA9rEsiveiQA8UR3UcdrCCIbKSXdtKnE4A%2B4Yp1FS%2BHEuAFsMIKh3X6Q0o1S6Il914BHXvtY90BFcuclLGwDoeASmgL4viE9USavaGpo4SQcOpw4hKczlIBkt%2BBM8ta4L2ZwpLBXWcoBMOegQauULPqTXKScBhbBYDR2qAgwosW4pcY3imBWrq1RFsI7ZGQrYggeytHYFSwjGZvuxSyzunUBFgAA5B6l76NNGEimppydiGhMoS0IO6KP3OQUVW2RCogWq0yrXErk8ZTR1F6PrKcz0DlkVxZ6IqLzsTEmSAzd3y7np9vdmUcOcIKChHgk5SbmItQZFDlpnlfP60nrSN0gNGggdOrEYjyFDC0ntj8coQXj1DcAKcHKuloQZa5AAd7maXZowEnsO9yc7oCVZQe%2BQWsFcnMTnuQLYlfNhCLX1M9vT%2F8yWsnTkx9T9XL4tiGeYQWrsqgh0Fslg04ChSCV%2BlNwDfWCwDOKs8Sh9BhjA5l1n3iXJkBqqSZRVNZKTQUKQIvM0GRULvRxgwWH2V0mYj9V0n0QKH8b6RIZRFsdr33shM7fIjRPKEyWi2ln%2Fx5ssz1YnG509ry6KEElYTnOFM9xSSYjRQwujHLG1%2FnsmdUI5eb1wX6mjhRJqyKE5LuKNHhS37HNRnU20YlUIJn1Of9SDcztTz3SOo%2BikQk28qmq9F6iIlCjpnsUHFxVZii5rML6VHLYuzEm4MkBO8feKuo6Y4L%2BE3TPTrBThMuYV2MvFqsaFp5tAcWFCYQpU0mlsHSWzpDBLvM0a%2BdFhclLCZLnQea2oAt0oRfpjE4x8WFgu2bOFPSa5O3LYSUllLWxR7e3DDobFnP%2BZcDqwOriya1CyWL%2BEsiuu8xrJrOSKrl4a8tPU%2FEg2eHyjBvC6%2BRRGdQmubhpW%2BHzjVLr05Pv43t8OXxtsgRsJMEv%2FBwOEDTag2EwoDew9e5B4839O843BH5SxOttCH%2B2Ct%2FYllroLwreE01YrPfFWyBvtoZb4fHGdL312k1XJ%2BvT67OV%2Ff%2FnX59HFz%2BmX1xK%2FPbt5vvrxbba4e1182u4eRh25Tn979cRtW65uvMl5d9id0ezU%2F%2B%2Frs5vL35dvIdH7i7bfDMjdlbVs7b8RUFNY9T2GnroRbfMzdnL5bb69clDYn7Ozk8hxqhxFrpZhgAWcnv1zMaTAnU1%2BpHWZFjeRVhaGBKL3mf6ZGwr6COQQU8hbGSnoFJwPU0lriE9tizwlUmcYsqRWxO9nxFrt8ZhOwmHnaDLFCImrzWWXLLQPYXyRCchJ1WuRl8TcAAAD%2F%2FwMA1onjg2UHAAA%3D https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQ...
- Condition1952 3y agoThis is reckless and irresponsible. Think of the children. They don’t deserve to see such a picture
- technics256 3y agoI saw it the first time as a kid. My friends and I tried to trick each other to see it too. I'm fine. We're fine.
- lucideer 3y agoAre we really though...
- RIMR 3y agoThat's right, this is a pro-showing-buttholes-to-children community.
- throwewerewr2 3y ago[flagged]
- andybak 3y agoStrictly speaking it's anti-not-showing-buttholes-to-children community but that's a distinction to debate at the next Libertarian conference.
- Anonbrit 3y agoIsn't it the anti-anti-showing-buttholes-to-children community? Nobody wants to force you to show buttholes to children, but you should feel free to if desired
- michaelt 3y agoGoatse, like Michelangelo's David, should be an exception to normal rules of censorship, due to its status as part of our shared cultural heritage. /s
- willcipriano 3y agoI'd be worried about the risk of a misfire. Like if someone had a weird browser plug in or something.
- jjgreen 3y agoA "plug in" eh?
- reneberlin 3y agopun
- sschueller 3y agoAh, like the good old days when people "hot-linked" your images and you would replace them :)
- joshcsimmons 3y agoWhen the internet was still fun and creative.
- adraenwan 3y agomaybe OP tried it's exploit in internet explorer 5.0, but I doubt it'll work in any recent (read: less than 5 years old) browser.
- beardog 3y agoI would argue showing nonconsentual explicit imagery is worse than iframing someomes app. Just show a non nsfw troll meme or block it outright.
- anononaut 3y agoHow would you argue that, exactly?
- beardog 3y agoImagine you were distributing my work without permission and in retaliation I emailed you gross-out sexually explicit imagery. That would both be a crime and be unethical by current standards. OP is not emailing people, but it is the same thing: revenge using explicit imagery. Except not only might the people behind the sites see the image but their visitors which probably include minors will too.
- datadrivenangel 3y agoBetter example is if someone is automatically forwarding your email newsletter and claiming it as their own. If you email them explicit imagery and they automatically forward it, that's on them. Not a crime, but a little crass in a funny way.
- ghastmaster 3y agoAdditionally, the image is I presume, used without permission from the creator.
- bobsmooth 3y agoKirk is an exhibitionist, he wouldn't mind.
- squidbeak 3y agoThe parasitic website is displaying the image. No iframe, no image.
- mortallywounded 3y ago[flagged]
- at_a_remove 3y agoI see you are a man of refinement and taste. We should meet at the next Lemon Party and discuss.
- graypegg 3y agoMortallywounded was a good username choice. I too am a causality of the 00s internet heh
- prepend 3y agoAin’t no party like a lemon party.
- jodrellblank 3y agoAnd if you think that meme didn’t make it into popular culture… https://youtube.com/watch?v=v-bvHlb2Fe8 https://youtube.com/watch?v=v-bvHlb2Fe8
- reconvene 3y agoI don't know why I checked but uhh yup. It's working. There are at least 6 sites on the first page of Google results that now render goatse. Thankfully, the first link is the original one for me.
- John23832 3y agoCuriosity kills the cat. Can confirm.
- thedaly 3y agoThis just made my day
- smcl 3y agoCame here to say the same thing. Unless you're one of today's "lucky 10,000"[0] who haven't ever encountered goatse before, there's no need to verify this :D [0] - https://xkcd.com/1053/ https://xkcd.com/1053/ edit: folks the xkcd lucky 10k reference was a joke, settle down
- thedaly 3y agoVery much NSFW lol https://wordlewebsite.com/sqword https://wordlewebsite.com/sqword
- gregsadetsky 3y agoit doesn't work in an incognito window (first thing I tried) but does in a regular window. @joshcsimmons it seems like sqword is reading local storage on this line: this.localStorage = n.localStorage || globalThis.localStorage, which leads to the following error: "Uncaught DOMException: Failed to read the 'localStorage' property from 'Window': Access is denied for this document." you should do it in a try/catch.
- Dylan16807 3y agoI'll note that this is a side effect of incognito blocking third party cookies, and I wouldn't bother changing it for that purpose. But I guess it can happen on the original site if the user turns off cookies entirely.
- reneberlin 3y agoI saw it and i can confirm that this is true! ^^
- Huffers2 3y agoThis is hilarious, but I think the most mature thing to do would have been to detect if the site is inside an iframe and if so add a polite link saying "click here to go to sqword.com and play this game ad free".
- prepend 3y agoThe author said he’s not mature. His approach is much awesomer than the nature thing.
- hk__2 3y agoHis approach is "funny" if you want, but it doesn’t help real users finding the real domain.
- jjulius 3y agoI get the sense that that isn't really his goal. He makes clear it's just a fun passion project, and this sounds like an equally fun (to him) way of retaliating against those taking advantage of it.
- anononaut 3y agoIn a roundabout way, it likely would halt users unable to find the real domain from accessing the thieves' websites again. That narrows down the search for the real domain by one!
- alwa 3y agoHe mentioned that he found the imposters when a coworker happened across them on a search result page. Does Google apply penalties to the imposter sites’ search rankings when they serve shock content rather than what was being searched for? It seems like that might reduce real users’ confusion as they try to find the real “sqword” puzzle.
- prepend 3y agoI don’t think it’s meant to help users. I think it’s meant to punish iframers.
- ceeam 3y agoIs the whole goatse.jpg b64-encoded in that URL?
- iso8859-1 3y agoNo, just the blog post itself. But you could put a goatse jpg there and it would get hosted. For example, use base64.b64encode(zlib.compress(b"<pre>" + open('gistfile1.txt', 'rb').read())).replace(b'/',b'%2F') To get gistfile1.txt shown in the page.
- HeckFeck 3y agoAh, I had a similar idea. There were too many bots or vulnerability scanners hitting /wp-admin.php on my blog. It was flooding my access logs with 404s because I don't rock wordpress. Irksome stuff. So I threw up a little 'surprise' for the ahem penetration testers ahem, if you feel brave: https://www.thran.uk/wp-login.php https://www.thran.uk/wp-login.php
- pugworthy 3y agoEven in the source as a comment :)
- mock-possum 3y agoWell that’s fun
- rabbits_2002 3y agoSafari offered to save the password lmao
- joshmanders 3y agoThis is absolutely amazing. More people should do this.
- viraptor 3y agoThese attempts are almost entirely automated, so almost nobody will see it. But if you want to help, tarpitting any IP which requests that page will slow down the scanner with minimum resource usage on your side.
- michaelcampbell 3y agoyeah, a quick failtoban rule is (as a server operator) every bit as satisfying.
- dym_sh 3y agodoes it respond with 42.zip upon submitting admin-admin?
- nonrandomstring 3y agoOnce, out of the kindness of my foolish heart, I ran a server with a lot of great sound effects for all and sundry to download. Eventually the bandwidth was getting hammered by a huge number of leechers seemingly from some apps that had simply hard-linked to the resources. After replacing said resources [0] they soon ceased but not without a slew of abusive and entitled emails demanding I restore the SFX. Oh fun times! [0] https://fukpig.bandcamp.com/track/all-of-you-are-cunts-and-i-hope-you-fucking-die https://fukpig.bandcamp.com/track/all-of-you-are-cunts-and-i...
- VHRanger 3y agoYou're selflessly trying to get people to appreciate new music styles and get in touch with their anger and they respond with contempt. What an entitled bunch
- duxup 3y agoIn the days of P2P file sharing I used to share files with file names and metadata indicating they were rare Metallica live recordings of Metallica songs and other metal band's songs.... but instead https://www.youtube.com/watch?v=hwK_WOXjfc0 https://www.youtube.com/watch?v=hwK_WOXjfc0 So many downloads.
- mrinterweb 3y ago> "One day instead of looking into an iFrame, you might be looking at an entirely different kind of portal." LOL
- amelius 3y agoWhat if some elementary school used sqword inside an iframe? :(
- slantedview 3y agoI agree. This is a really gross and wreckless way of dealing with the situation.
- Vicinity9635 3y ago[dead]
- m3kw9 3y agoi don't want to relive the shock the first time i wondered into goatse
- ryanisnan 3y agoThis is perhaps the most novel usage of a supply chain attack I've yet seen.
- bityard 3y agoNah, this technique has been used to "pwn" other sites ever since dynamic web serving has been around. So very nearly from the beginning. Traditionally by looking at the referer header.
- willio58 3y agoI absolutely love this.
- furyofantares 3y agoI run three word games, this stuff happens for all of them. It sucks but I would never do what they did, it's abusive to the people who just googled your game and ended up on the wrong site. I've had teachers and students reach out to me to say they play my game in class every day together. And parents who play with their kids every day, and adult who text their results to each other every day. It sucks if they end up doing it on an ad-ridden site when I built an experience that asks nothing of them. But it would suck even more to goatse them.
- gregsadetsky 3y agoagreed - it for sure would have been easier/cleaner/safer to just show a message that said "please play the official game on whatever.com"
- axelthegerman 3y agoThis!!
- amatecha 3y agoYeah this is actually basically what YouTube does when you embed a video and their settings don't allow embedding for that particular video. "Video unavailable - Watch on YouTube"
- extraduder_ire 3y agoThank you. I've been wondering why that feature exists for years now.
- amatecha 3y agoYeah I think basically the reason is they want to show you the various ads before/after/during the video and they won't work in the embed view (just guessing)
- s3p 3y ago
- rc_mob 3y agoNever thought is say it but uhm... the world needs more goatse apparently OP you should follow this up by reporting all the said websites to google.
- callalex 3y agoGoogle won’t fix this, they actively profit from the theft sites because Google is the one selling the ads on those pages. Break them up.
- spondylosaurus 3y agoGoogle may or may not be the ad network on the ripoff pages. If the pages are really that shady I'm gonna err on the side of not.
- supriyo-biswas 3y agoAs I mentioned elsewhere in this thread, filing DMCA notices with Google does take care of it.
- hexsprite 3y agoJust keep in mind some kids might be playing these games. So while it might be satisfying to stick it to the sites that are stealing your code, you might traumatize a child.
- packetslave 3y ago"won't someone think of the children!?!?!" is a meme for a reason.
- bityard 3y agoBut it's usually used ironically in situations where there is obviously no actual harm to children present. This is not one of those situations.
- eep_social 3y agoKids are exposed to all sorts of things when they go to school, church, public playgrounds, or any other situation where groups are lightly supervised. I probably learned the word “fuck” in the fourth grade but my parents still haven’t heard me say it. Equating a shocking image with harm strikes me as naive at best.
- noarchy 3y ago>"won't someone think of the children!?!?!" is a meme for a reason. Indeed, and it is well-represented here. In fact, I assumed we'd see some of it here and went looking for it. I was not disappointed. It means plenty of people missed the point entirely.
- Vicinity9635 3y ago[dead]
- polski-g 3y agoNo one is traumatized by seeing goatse. It is a right of passage for children to become true internet denizens, in fact.
- ImAnAmateur 3y agoThis method primarily attacks innocent people. If someone is playing the author's game on another website then they likely don't know what the official website is. He has hurt his own players more than the people trying to make money off of his work.
- starstripe 3y agoI'm not sure everyone who sees the graphic image might fully understand what's going on. They might just think there's something wrong with sqword, not the site that's stealing it, and repelling potential players as a result.
- thomastjeffery 3y agoThe world we live in: people somehow feel more comfortable posting shock/traumatic images than regular consensual porn. This is one of the few parts of internet culture I hope to see the end of. We can be edgy and offensive without traumatizing each other.
- bobsmooth 3y agoWhat kind of edgy and offensive image would you use?
- thomastjeffery 3y agoAny consensual porn would do fine. The goal is to harm the website owner with something taboo/offensive/nsfw, not to harm the viewer with trauma.
- efreak 3y agoI'd go for https://web.archive.org/web/20110128084012/http://www.midgetgoatporn.com/ https://web.archive.org/web/20110128084012/http://www.midget... personally. It's offensive, but not graphic (unless you consider the font graphic)
- lotsofpulp 3y agoGoatse is consensual porn, as far as I know. Maybe not “regular”, but that seems to be an unnecessary constraint in this context.
- thomastjeffery 3y agoThat wasn't my point. Goatse is not pornography. Goatse is shock/trauma imagery. My point is that OP could have used porn (or something else) as an alternative to shock/trauma imagery, because their goal was to be offensive. There was no need for OP to traumatize their audience.
- wetpaws 3y ago[dead]
- schaefer 3y ago> The mature and responsible thing to do would have been... You were triggered, and so you lashed out with an attack aimed at bystanders. "mature and responsible" have nothing to do with it. The word is: immoral.
- disintegore 3y agoOver the years I've seen so many variations of this. "u mad", "triggered", "seethe", "rent free", etc. I don't know why the internet insists on deriding anyone that reacts strongly to anything. It's something you ought to grow out of after middle school.
- schaefer 3y agoGreat discussion point. I'm all for strong reactions. Heated debate, swift actions, deep self reflection. Yes, all welcome. For example, if OP had password protected his site I would applaud. But my personal views are: - strong reactions aren't "justification" to further escalate violence. - intentionally using that specific image to inflict harm on people is definitely violence. So, I'm going to take a moment to advocate for that perspective, Even though I may not sway anyone. After all, silence is acceptance.
- slater 3y agoThis just jogged my memory of a fun site from ca. 2006 that did something similar - stealing bandwidth from fake bank and lottery scam sites: http://web.archive.org/web/20060113021154/http://aa419.org/vampire/ladvampire.php http://web.archive.org/web/20060113021154/http://aa419.org/v... (SFW)
- jsf01 3y agoThis is pretty funny and reminded me of the first website I had ever made (probably sometime around 6th grade, back when <marquee> was cool). I’d found that most of the flash games I enjoyed had either embed codes or could just be embedded manually using an iframe. So I made a library of my favorite embedded games in a small folder of HTML files, which I FTP’d onto some server I had access to for some reason. If this goatse alternative to CSP had been used I am sure I would have gotten in a lot of trouble, which is funny to think about today.
- Fileformat 3y agoI had a similar problem with freeloaders, though my project was a backend service that didn't have a UI. My solution (safe for work, not harmful): https://wordstream.freeloader.wtf/ https://wordstream.freeloader.wtf/
- b800h 3y agoI am absolutely not a lawyer, but I wouldn't do something like this for fear of falling afoul of anti-obscenity laws. For instance, the UK has a cyberflashing law which allots a two year custodial sentence for sending a graphic image (by any means) with intent to cause distress.
- sh34r 3y agoI’m not a lawyer, but there are all kinds of extremely broad computer crime statutes on the books. No prosecutor would bring this case. This would flagrantly violate the spirit of the law, which was intended to stop unsolicited dick pics and other forms of targeted harassment. It would certainly not merit extradition to the UK, or the UAE for that matter. It’s not worth worrying about such extreme what-if cases. If the Feds were so determined to destroy an innocent person in a kangaroo court, there’s easier ways of doing so. They could plant CSAM on the server. They could coerce an informant to accuse you of SA (like they did to Assange). Realistically, the worst sanction this dev could reasonably expect, is to have their domain taken down. That’s what happened to the OG .cx domain, after all…
- ww520 3y agoAuthor is not the distributor of the image.
- b800h 3y agoThe UK law is a bit more subtle than that. Can't speak for other jurisdictions.
- kleiba 3y agoVery debatable.
- rovr138 3y agoI want to see this argument play out in court. He's the one specifically replacing one thing with another under some circumstance. Not the person embedding it or the one hosting the image.
- deleted 3y ago[deleted]
- kleiba 3y agoAlternatively, you could just make it so that people are taken to sqword.com instead: https://stackoverflow.com/questions/580669/redirect-parent-window-from-an-iframe-action https://stackoverflow.com/questions/580669/redirect-parent-w...
- paulpauper 3y agogonna pretend i don't know what this is lol same for hotlinking images, too
- throwaway_08932 3y agoThe iframers must be upset at being made the butt of this joke.
- magicmicah85 3y agoI don't know, I would just present a link that says "Play" and it opens a new tab direct to the game. Just me.
- driggs 3y agoI formerly worked for a small RealEstate aggregation/publication software company with large market adoption, and a well-known competitor started deep linking to the images within our custom-written resizing image cache server, and continued to do so after several polite requests to stop. Image traffic is the bulk of network traffic for RealEstate data, and their stollen traffic was very significant, cutting into our own available bandwidth and costs. We slyly added referrer-based logic which would, with 1/20 probability, serve the Goatse.cx image instead. Needless to say, within 48hrs we never received another deep link request from that competitor.
- callalex 3y agoIt’s really pathetic that Google is happy to profit off of these theft sites. They will never fix their search results because they are the ones selling the ads on behalf of the scammers. Break up the monopoly.
- immibis 3y agoIf you break the monopoly they'll all be like this anyway, but for their own ads, AND it will be legal because there's competition. Abolish capitalism, instead.
- andrelaszlo 3y agoCan you still break out of iframes (like https://stackoverflow.com/a/25871549 https://stackoverflow.com/a/25871549) and make the parent page redirect or do newer browsers prevent stuff like that?
- deleted 3y ago[deleted]
- avenido 3y ago"I don't like this game anymore"
- DonHopkins 3y agoI know somebody is going to buy up the expired domain of an NFT image hosting service and do this.
- attilakun 3y agoSomebody is doing something similar to my Chrome extension. They stole the (minified) code, slapped their own logo on top of it and started selling it. I filed a DMCA takedown request at Google and they removed the extension. Then the guy reuploaded the extension again with a slightly different UI. But I can still see that the underlying code is all mine!
- reneberlin 3y agoWhy not timebomb the minified code and reupload updates to the marketplace plus a grace period for late updaters? Ok, they could automate that, too. You'd need to checksum something from within. Where the problem arises: how to know the checksum before the code was fully minified. I think there are companies, that specialized on tamper-proofing js-code with a lot of crazy tech, i lost some bookmarks for this and couldn't find it right now.
- realharo 3y agoThere is a similar kind of anti-scraping technique, where you serve fake data that looks very realistic, but a part of it is modified in some way that renders it useless. Of course the challenge there is good bot detection to not accidentally serve fake data to a legitimate user.
- bitwize 3y agoI had a dream once, in about 2000 or so, that I was touring a "smart home" that featured display panels on the walls, cabinet faces, etc. that could be reconfigured to display whatever you wish: flowers in the spring, foliage in the fall... a complete change of décor at the touch of a button. While I was touring it, the smart home was hacked. And suddenly... goatse. In every room, on every surface, that same gaping orifice. I woke up sure of one thing: Smart homes... not even once.
- wepple 3y agoI wonder if there is a way to host known (ideally known-but-disabled) malware, and get the parent frame site on browser blocklists, without getting the sqword domain blocked? Probably not, but that would be even better than a goatse troll.. actually hit them where it hurts; their ad revenue.
- ryandrake 3y ago> This made me angrier than it should have - not because Sqword is a cash cow - we don't run ads on the site and don't make money from it, it's just for fun, but because it was a passion project with friends, something pure and intentionally free to play WITHOUT ads. If the site is for fun and doesn't make money, then how is what these aggregators are doing considered "theft"? Theft of credit for making the app, I guess? I dunno--I'm surprised the article OP is so bent out of shape if it's just a fun throwaway project. I wouldn't care but maybe that's just me.
- drcode 3y agoLikewise, there's no reason for the aggregators to get bent out of shape over the Goatse
- jahsome 3y agoBandwidth ain't free.
- immibis 3y agoLegally, putting a fence around something you didn't create and charging an admission fee isn't theft - it's landlording. Morally, landlording is theft.
- kvdveer 3y agoMonetary value is not the only kind of value that can be stolen. In this case the theft may be about reputation (e.g. resumé credits) or simply control.
- PhasmaFelis 3y agoWhat is going on with that URL? Does it encode the entire post? ...Yes, it does. What an odd decision. I'd link to the page where he explains it, but it also has a half-page URL.
- iso8859-1 3y agoURLs will be automatically abbreviated when rendered on Hacker News. The actual link destination is still intact, so you would be able to paste an URL like that without breaking the layout.
- epx 3y agoUsing goatse to punish hotlinkers is a classic.
- curtisblaine 3y agoAnother fun thing to do would be showing an infinite "loading..." indicator and fetch as many resources as possible from the parasitic website in a tight loop with a cachebreaker. That should inflate their bandwidth costs quite a bit.
- nephanth 3y agoWith the advantage of not showing shocking images to random innocent people
- curtisblaine 3y agoYeah, I don't think the scummy owners of the site will care about goatse too much. Paying money, on the other hand, could hurt them more. I imagine these sites are not very well monitored, so they might get a huge surprise at the end of the month. With enough users, they might even get DDOS'd.
- kaugesaar 3y agoI did a similar thing almost 20 years ago. The Swedish National Pensioners' Organisation was hotlinking an image from my server. I can't really remember exactly what it was, but it was something harmless, like a picture of a cat. Teenage me thought it was super fun to change this image to something more explicit.
- praveen9920 3y agoWouldn’t Google associate the word game name with goatse from now on because of page rank algo ?
- pcblues 3y agoWhen I lived in Melbourne, I found someone's car with GOATSE as the personalised licence plate and of course took a photo. This was only about 10 years ago. I've got the photo still. It was a fantastic rude word filter reach-around against the registration office, so to speak.
- PUSH_AX 3y agoImagine my shock, discovering that you are apparently a fully grown adult.
- sneak 3y agoIt’s a bit of a stretch to use the term “theft” in the headline (and “steal” in the image) to describe this situation, no? Neither unauthorized hotlinking nor iframe embedding are “theft” or “steal”ing.
- teaearlgraycold 3y agoAbsolute madman encoding the article in the URL like that.
- joshcsimmons 3y agoThanks dude.
- broken-kebab 3y agoOn my book it's fair, but I suspect in some countries it may lead to legal complications. So I recommend not to replicate the approach before making sure it won't backfire.
- oskapt 3y agoBack in the early 2000s my secondary DNS server was getting slammed with MX requests from some spammer. I set up a BIND view for just that requesting IP that returned the IP of the FBI mail server for every MX request. I then contacted the spammer’s ISP and told them what I had done. I’ve never seen an ISP take their customer down so quickly.
- sacnoradhq 3y agoAnd here I thought goatse was just for trolling and arp- and IP-spoofing http:// http:// on unprotected Wi-Fi. PS: NSFW in case the casual observer never encountered the horror that was goatse.cx: NSFW https://web.archive.org/web/20010518002205/http://www.goatse.cx/ https://web.archive.org/web/20010518002205/http://www.goatse... NSFW
- nephanth 3y agoNo comment on how instead of retaliating against the thieving website, he's retaliating against the –probably unknowing– users that just happened on those websites through Google? (Some among whom are probably children)
- rozap 3y agoIf I get served a goatse image, I never return to that website. The website wants users, so yes, they're retaliating against the website. But yes, won't somebody think of the children.
- shpx 3y agoYou wouldn't print out this picture, go up to a child you know and show it to them. I would hope. The internet lets you efficiently subject more children to indecent exposure because you don't see it actually happen. Just because people often say "think of the children" insincerely doesn't mean you should never think of them.
- nephanth 3y agoSo every time the image is served, the website is hurt in a marginal, indirect way (-1 user, a bit less revenue stream), while one unrelated user is hurt in a substantial way (somewhere from pretty disgusted to mildly traumatized) Does nobody see the obvious problem?
- dhosek 3y agoKind of reminds me of the guy who owned graphics.com who would get requests from people who wrote //graphics/foo.gif instead of /graphics/foo.gif (Netscape and/or IE would, in those days, transform graphics into graphics.com when it couldn’t find the domain graphics). He set it up so that he would serve up an image informing the consumer that they had a malformed link and would get angry emails from webmasters (remember that term?) claiming he had hacked their sites.
- klinquist 3y agoWhy not just "out" them and provide a link to the original domain? "To play Sqword, please visit <domain> directly. You are currently visiting a site that has put ads around the original game without the game creator's consent." By replacing it with goatse, a number of people will think, "I wanted to play Sqword but now it's pornographic" and never play again.
- jsf01 3y agoNot only this, but I imagine some of the less tech savvy end users (kids, grandparents) would be the ones who found the game from one of these parasitic sites inundated with ads. The goatse image doesn’t help those users. They probably won’t realize what that’s about and then just stop playing altogether.
- m3kw9 3y agoWho know goatse would be the saviour of the Internet?
- croes 3y agoSo someone who plays the game and who doesn't know it's embedded in an iframe and the site is actually stealing the game is shown a shock image? In my opinion that's wrong.
- deleted 3y ago[deleted]
- rsayers 3y agoIn 2003 or so, I was really amused by the ORLY owl memes, so I collected them and stuck them in a public directory on my webserver. I have no idea how it was found, but at some point my open directory got indexed by google. I found out because my host emailed me saying I had hit my bandwidth quota for the month... 2 days into said month. So digging through logs I found the biggest offenders, there were forums where people linked just about every image I had. A little htaccess magic later, any request that came from a non-allowist referer was instead served a rather crude message I quickly put together in MS paint. No one contacted me about it, but it was amusing watching these threads where people were getting upset when they thought they were going to see funny owl pics.
- jrflowers 3y ago> the early 2000s internet shock image Goatse The images of Kirk Johnson’s feat of butthole stretching started circulating in 1997. https://www.gawker.com/finding-goatse-the-mystery-man-behind-the-most-disturb-5899787 https://www.gawker.com/finding-goatse-the-mystery-man-behind...
- itslennysfault 3y agoWhat is with the crazy URL to this blog post? I was going to share it with some friends, but then I copy/pasted the link and I'm not sharing that monster with anyone.
- moviuro 3y agoSee the explanation on the blog itself [0] [0] https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQMQLbgFe%2BtjDytnXtZNF1EmSdAEEQIJTE3WE9GqozlGX56wuOZCMtiu7LXmbEc%2BEhdw9WCpxgcKjA9rEsiveiQA8UR3UcdrCCIbKSXdtKnE4A%2B4Yp1FS%2BHEuAFsMIKh3X6Q0o1S6Il914BHXvtY90BFcuclLGwDoeASmgL4viE9USavaGpo4SQcOpw4hKczlIBkt%2BBM8ta4L2ZwpLBXWcoBMOegQauULPqTXKScBhbBYDR2qAgwosW4pcY3imBWrq1RFsI7ZGQrYggeytHYFSwjGZvuxSyzunUBFgAA5B6l76NNGEimppydiGhMoS0IO6KP3OQUVW2RCogWq0yrXErk8ZTR1F6PrKcz0DlkVxZ6IqLzsTEmSAzd3y7np9vdmUcOcIKChHgk5SbmItQZFDlpnlfP60nrSN0gNGggdOrEYjyFDC0ntj8coQXj1DcAKcHKuloQZa5AAd7maXZowEnsO9yc7oCVZQe%2BQWsFcnMTnuQLYlfNhCLX1M9vT%2F8yWsnTkx9T9XL4tiGeYQWrsqgh0Fslg04ChSCV%2BlNwDfWCwDOKs8Sh9BhjA5l1n3iXJkBqqSZRVNZKTQUKQIvM0GRULvRxgwWH2V0mYj9V0n0QKH8b6RIZRFsdr33shM7fIjRPKEyWi2ln%2Fx5ssz1YnG509ry6KEElYTnOFM9xSSYjRQwujHLG1%2FnsmdUI5eb1wX6mjhRJqyKE5LuKNHhS37HNRnU20YlUIJn1Of9SDcztTz3SOo%2BikQk28qmq9F6iIlCjpnsUHFxVZii5rML6VHLYuzEm4MkBO8feKuo6Y4L%2BE3TPTrBThMuYV2MvFqsaFp5tAcWFCYQpU0mlsHSWzpDBLvM0a%2BdFhclLCZLnQea2oAt0oRfpjE4x8WFgu2bOFPSa5O3LYSUllLWxR7e3DDobFnP%2BZcDqwOriya1CyWL%2BEsiuu8xrJrOSKrl4a8tPU%2FEg2eHyjBvC6%2BRRGdQmubhpW%2BHzjVLr05Pv43t8OXxtsgRsJMEv%2FBwOEDTag2EwoDew9e5B4839O843BH5SxOttCH%2B2Ct%2FYllroLwreE01YrPfFWyBvtoZb4fHGdL312k1XJ%2BvT67OV%2Ff%2FnX59HFz%2BmX1xK%2FPbt5vvrxbba4e1182u4eRh25Tn979cRtW65uvMl5d9id0ezU%2F%2B%2Frs5vL35dvIdH7i7bfDMjdlbVs7b8RUFNY9T2GnroRbfMzdnL5bb69clDYn7Ozk8hxqhxFrpZhgAWcnv1zMaTAnU1%2BpHWZFjeRVhaGBKL3mf6ZGwr6COQQU8hbGSnoFJwPU0lriE9tizwlUmcYsqRWxO9nxFrt8ZhOwmHnaDLFCImrzWWXLLQPYXyRCchJ1WuRl8TcAAAD%2F%2FwMA1onjg2UHAAA%3D https://joshcsimmons.com/post/H4sIAAAAAAAA%2F3xV227cRgx911cQ...
- itslennysfault 3y agoWow... that is pretty janky.
- triniTY12Tree 3y ago[flagged]
- triniTY12Tree 3y ago[flagged]
- triniTY12Tree 3y ago[flagged]
- triniTY12Tree 3y ago[flagged]
- ckyngcybra 3y ago[dead]
- 0xDEAFBEAD 3y agoJust to play devil's advocate here: * The people you're hurting with the goatse image are mostly not the people wrapping your game in an iframe, but rather the people playing games on the game aggregator sites. Probably includes many teenagers and children. * The game aggregator sites are bringing your game to a wider audience. For gamers who don't know the name of a specific game they want to play, it's nice to be able to browse through a directory of games. The game aggregator sites aren't competing with you in terms of Google search results, they're adding your game to their collection and sharing their collection with everyone. Yes, they're supported by advertising, but I'd argue game aggregator sites are still generating a ton of consumer surplus. (For example, many users are blocking ads.) If you still want to hurt the game aggregator sites for some reason, just include a message on the game loading screen that says "play without ads at sqword.com". Easy.
- maccard 3y ago> The game aggregator sites are bringing your game to a wider audience. This is the equivalent of getting paid in exposure.
- 0xDEAFBEAD 3y agoThe OP seemed to be motivated by bringing joy to people who play his game. I'm saying the aggregator site can help him do that.
- ivanjermakov 3y agoCouldn't have you just used `X-Frame-Options` header to disallow usage of your game in another origins' <iframe>?
- jaylane 3y agoi support this strategy, I once did this but used meatspin.com