5 ms·
A Hacker News vote button
- TazeTSchnitzel 14y agoSo how does this work? Does hnbutton.appspot.com do some clever proxying, or something? Or does HN just have a very easily exploitable XSRF vulnerability?
- alter8 14y agoThey use the search API. https://github.com/igrigorik/hackernews-button/blob/master/hnbutton/hnbutton.go#L76 https://github.com/igrigorik/hackernews-button/blob/master/h...
- mixedbit 14y agoI also don't understand how it works. If you could up-vote just by following a link, you could easily gain a system. For example, you could submit a story that automatically up-votes itself when visited by logged-in user, without any button press (CSRF). I believe Facebook like button (and other similar gadgets) are iframes from Facebook. So Facebook controls how the button looks like and it is not possible to submit 'Like' requests from a third party domain.
- nightpool 14y agohttp://news.ycombinator.com/item?id=3742902 http://news.ycombinator.com/item?id=3742902 EDIT: This is a submission from a while ago that does, in fact, upvote itself.
- deleted 14y ago[deleted]
- cxhristian 14y agoFrom what I can understand, looking at one site that uses the button[0], it just displays current votes and links you to the submission. It doesn't do any voting from the site like a reddit button would do. [0] https://bountify.co/blog/host-your-own-hacker-news-button-server https://bountify.co/blog/host-your-own-hacker-news-button-se...
- alter8 14y agoMy answer to GP looks silly now. I see what he meant. The submission title should change to vote-counter button to avoid the confusion.
- bevan 14y agoThis button is great, but the button server at hnbutton.appspot.com (which queries the search API) is frequently over its quota, which means the button doesn't appear / work a lot of the time. It's easy to set up your own (free) button server though. Here's how: https://bountify.co/blog/host-your-own-hacker-news-button-server https://bountify.co/blog/host-your-own-hacker-news-button-se...
- jakerocheleau 14y agoGreat link thanks for sharing that.
- igrigorik 14y agoFixed - plenty of quota now! I honestly didn't realize how much traction it picked up over the past 6 months.. It was a (pleasant) surprise to login into my GAE console and realize that it was serving, on peak days, over 1M impressions. Interestingly enough, the "exceeded quota" was not for CPU resources! Instead, it was all egress bandwidth. On busy days, it would reach the free 1GB egress limit sometime between 6-12PM, and hence the error. I've upgraded the app, and it should be good for terabytes a day. ;-) P.S. I've also pushed an update to enable more aggressive HTTP caching on the assets.
- recuter 14y agoSo you turned on billing? ;-) Good to know it was getting so many impressions at the free tier, GAE is undervalued by the community me thinks.
- igrigorik 14y agoYep, flipped the billing bit. All I need is the extra bandwidth though.. The sole Go app instance is standing up like a champ!
- leoplct 14y agoDoesn't the vote get penalized if you vote directly, instead of searching the topic on the web page?
- krat0sprakhar 14y agoUpvote for shanky!
- fnaticshank 14y agothankyou :D
- p4bl0 14y agoI may be missing something, but I don't understand the point of the step 2 in the README: why not just say to add the <script> tag directly?
- josscrowcroft 14y agoLooks beautiful but any problems with the votes being discounted? Will it still work in future or is it an exploit that would get closed?
- igrigorik 14y agoThe instructions are for the async install, so even if the widget is broken or goes down (it shouldn't), your site rendering will not be blocked, or affected in any other way.
- kami8845 14y agois there a demo somewhere? I tried to do something similar but the ycombinator.com domain returns the "X-Frame-Options:deny" header which makes iframing impossible. Also in order to vote by simple GETting a url you have to include a CSRF token as a URL parameter.
- igrigorik 14y agoCheck one of the bgr.com articles, they have it installed in the sidebar.
- kami8845 14y agoIt doesn't seem to work. Check out any of the articles submitted to HN: http://www.hnsearch.com/search#request/all&q=bgr.com&sortby=points+desc http://www.hnsearch.com/search#request/all&q=bgr.com&... They all show "submit". I re-submitted one of the stories myself. Still shows "submit" as the HN button. EDIT: Ok apparently it does work after I submitted a story through it (cold cache?) But it's still pretty meh, really just a glorified <a><img></a>
- igrigorik 14y agoThere is a bit of lag for the hnsearch API to pickup the latest vote count.
- wildranter 14y agoGreat stuff. I'm gonna incorporate this on my upcoming blog. Thanks! On a side note. Could someone at YC fix the up vote arrows here? It's really hard to hit these tiny arrows without hitting everything around before, really messy. BTW, a larger textfield wouldn't hurt either. PS: Sorry for stealing your topic, I just felt the need to say these things which I think don't bother only me. ;)
- dhimes 14y agoThey don't only bother you, believe me. Most of us have simply given up asking for site changes. We hack the styles ourselves or simply deal with it.
- wildranter 14y agoGreat tip, thanks for that. But I was referring to touch devices which make somewhat difficult to apply custom styles. So we shouldn't give up on our "demands" for better UX.
- dhimes 14y agoI agree, touch devices are the problem. I think there may be some apps out there for HN and the like, but a mobile-designed site would suit me better.
- clarky07 14y agoWarning, shameless plug incoming. I made a HN app for iPhone and iPad to solve some of the issues of the site. Mainly going back and forth from comments to article. Haven't gotten to a better voting yet, but I may in the future. https://itunes.apple.com/us/app/hacker-news-reader!/id532402679?ls=1&mt=8 https://itunes.apple.com/us/app/hacker-news-reader!/id532402...
- dhimes 14y agoI have an app on my phone and a different one on my ipad. Checking to see if the one on my phone is yours- how can I tell?
- lucb1e 14y agoHow can we do custom styles on it? Right now it's not aligned with other share buttons. Screenshot: http://g2f.nl/0c4ajy1.png http://g2f.nl/0c4ajy1.png Edit: You can style ".hn-share-iframe". Then the next issue: it's much wider than it needs to be when the story has already been submitted (see the screenshot, there's a lot of blank space on the right). Is there any other solution besides just positioning it on the right of the share buttons list?
- igrigorik 14y agoUnfortunately, not that I've found.. Twitter and G+ also reserve the space and run into the same problem. The root issue is the lack of automagic iframe resizing.. which is what "seamless" attribute will solve, once it arrives and is supported by the browsers.
- lucb1e 14y agoOkay, thanks for the reply.
- EGreg 14y agoI have a question ... why can't a Hacker News button be done entirely in Javascript? If only HN would incorporate CORS file. Even if it doesn't, there could be a way to approximate it by checking if you are logged into HN, and if you are, doing a cross-domain POST via a form. "But how do you know if you're logged into HN?" Ah, that's the hack. for example: https://hacks.mozilla.org/2011/02/an-interesting-way-to-determine-if-you-are-logged-into-social-web-sites/ https://hacks.mozilla.org/2011/02/an-interesting-way-to-dete... more in depth: http://stackoverflow.com/questions/5233560/possible-to-find-out-whether-a-user-is-logged-into-facebook-over-javascript-api http://stackoverflow.com/questions/5233560/possible-to-find-... The question -- for all the hackers here -- is, what resource can we request via Javascript on HN that will return a different status code (200 or another one) depending on login state? For example, maybe posting a blank password to "change password" form will return a non-success status code when you aren't logged in, and be an innocuous post (since it results in an error). Of course, the trouble with these techniques is that the site can disable them at any time.