22 ms·

You shouldn't hotlink someone else's JavaScript

210 points by jsnk 13y ago

ivan_ah 13y ago
The hotlinked js in question is: http://gsgd.co.uk/sandbox/jquery/easing/jquery.easing.1.3.js http://gsgd.co.uk/sandbox/jquery/easing/jquery.easing.1.3.js That is a neat way to communicate ;) Polymath sounds like a cool idea BTW, but probably difficult to monetize. Somebody must pay the tutors for producing/curating the content, but people have gotten so used to educational material being free...
- marceldegraaf 13y ago
  Linking to the file from a popular HN thread will likely only worsen the bandwidth issues for the owner :-). Perhaps link to the Github version instead, which is here: https://github.com/gdsmith/jquery.easing https://github.com/gdsmith/jquery.easing
chewxy 13y ago
Screenshot for potential future confused HNers when Polymath realizes it and uses a real CDN: http://i.imgur.com/A8JzHtK.png http://i.imgur.com/A8JzHtK.png
- Chirael 13y ago
  Thank you chewxy! Was wondering what was going on :)
- bhauer 13y ago
  Thank you. At first, I didn't see anything of interest and briefly wondered why I was at a site that had nothing to do with the HN subject. It hit me that the submission was to a demonstration rather than an article, so I temporarily instructed Noscript to allow all domains used by the page. Sure enough, now the banner appeared. But that speaks to another reason to not use too many scripts hosted by third-parties. It makes for a very cluttered list of domains for users of Noscript and similar to authorize. I just leave sites that have more than a small number. How many third-party analytics, tracking, tools, social sharing, voting, polling, comments, shopping, deals, and other tools do you really need to embed to make a web site these days? I love when the list is just domain.foo and domain-static.foo and maybe google-analytics or another mainstream analytics domain.
  - ladyga 13y ago
    google analytics is a definitive no-no. permabanned here and one of the reasons I run noscript and its kind in my browsers. Not that I mind webmasters running analytics tools, but I'm concerned with google having access to too much personal data/metadata, those privacy issues are bad. Just use piwik or something.
  - Wingman4l7 13y ago
    Don't forget that sometimes you need to allow the site's CDN domain as well. The problem with Noscript is that it doesn't seem to differentiate between allowing a domain when it's actually a site you're visiting (say, facebook.com) and when it's a domain that a completely different site is trying to load content from. A straight whitelist is too "dumb" for today's web.
deleted 13y ago
[deleted]
geuis 13y ago
Ok there is a better way to handle this than adding some html to a page to make a banner, posting to HN, and hoping for the best. Check for referal headers and throw a 301.
- fosap 13y ago
  I hope referrals will be disabled anytime soon. Firefox has AFAIK disable referrals to other domains by default.
  - akx 13y ago
    In the case of Javascript hotlinking, that'll do approximately diddly squat though. if(/whatispolymath/.exec(location.href)) alert("...");
    - martin-adams 13y ago
      Or better yet, test if it's not your domain, then show a message.
    - fosap 13y ago
      That is a way better, IMO.
- andymcsherry 13y ago
  Or just send the owner an email: http://www.whois.com/whois/whatispolymath.com http://www.whois.com/whois/whatispolymath.com
  - bigiain 13y ago
    So why should it be the responsibility of some guy who's bandwidth is getting stolen to be nice about notifying the guy who's stealing it - why didn't the site owner feel any obligation to send the .js hosting site owner an email asking if it was OK first?
- jacquesm 13y ago
BadassFractal 13y ago
Lots of services out there like browser-update.org tell you to load snippets of js over http from some random location they control. It's pretty unsafe unless you really know who's running the show over there and how secure their system is. Them being compromise could make every user site vulnerable.
- mjpa 13y ago
  There is of course the maintenance issue... what happens when their script is updated and breaks how you use it?
  - Cthulhu_ 13y ago
    Usually, library scripts are versioned in their filename, so won't be updated after release.
artumi-richard 13y ago
whoops, not sure he wanted it here too. http://gsgd.co.uk/sandbox/jquery/easing/ http://gsgd.co.uk/sandbox/jquery/easing/
- herpyDerpy 13y ago
  Ha ha! Actually, it's not a bug, pretty obvious he's "demonstrating a feature"... :)
jacquesm 13y ago
And that's a pretty mild example of what could happen if you did. Hotlinking javascript is an excellent way to allow someone else to pull all kinds of tricks with your visitors and your image. For example, redirecting all your traffic to a shocksite. Every time you include some externally hosted javascript you open yourself and your visitors to a security risk. And on top of that, if you do it like this you're stealing bandwidth. When including remotely hosted javascript make sure you have permission, make sure the other party is trustworthy and periodically review the linked script to make sure it does what is advertised (and that's imperfect, it could be you're seeing something else than other visitors).
- ballard 13y ago
  The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. That way, you can run them through the ol' asset pipeline too... minifiers and possibly serve them straight from gzips. Gotta always remind ppl of https://developers.google.com/speed/ https://developers.google.com/speed/ ... the OP scores 47 (out of 100)
  - UnoriginalGuy 13y ago
    Interesting, Google has added more stuff to the speed test. My site has gone DOWN by 4 points since I last tested it due to failing some new tests. Really great service by Google in general. I've managed to improve page loading times by 25%, cut number of connections in half (I merged all images into one unified file and then use CSS to display the relevant sub-sections), and reduce the total size of my page by over 10%.
  - grey-area 13y ago
    The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. For dependencies you can control, it's obviously best to keep a local or CDN copy. However this trend of embedding js from all over the web is encouraged by the pattern that most of the big sites allowing you to embed content use: e.g. https://developers.google.com/+/web/badge/ https://developers.google.com/+/web/badge/ Google, Twitter, FaceBook all want you to embed js hosted on their servers in your page in order to interact with their site, even if all that script does is then insert an iframe into the page. By including a button or widget like the one above you're trusting them not to take over your site in a manner similar to this example, track your users surreptitiously, or be compromised now or in the future.
thejosh 13y ago
Find more here: https://www.google.com.au/search?q=%22http%3A%2F%2Fgsgd.co.uk%2Fsandbox%2Fjquery%2Feasing%2Fjquery.easing.1.3.js%22&oq=%22http%3A%2F%2Fgsgd.co.uk%2Fsandbox%2Fjquery%2Feasing%2Fjquery.easing.1.3.js%22&aqs=chrome.0.69i57j5.856j0&sourceid=chrome&ie=UTF-8 https://www.google.com.au/search?q=%22http%3A%2F%2Fgsgd.co.u...
- m_ram 13y ago
  Even more interesting is all the people who don't know why they're getting this error message: https://encrypted.google.com/search?hl=en&q=%22Please%20stop%20hotlinking%20my%20easing%20script%22 https://encrypted.google.com/search?hl=en&q=%22Please%20stop...
  - junto 13y ago
    Yep, I thought that too. The vast majority of website owners have had external developers build their websites. Often those developers are long gone and the website owners left to their own devices (or CMS's). The site owners are now confused and think they have been hacked and don't know where to turn to. There is actually a business proposition here. You could contact George Smith and ask him for a list of all HTTP referrers. Then contact each site in turn and ask them if they need any help. Even if they have it sorted already, it might be a good intro into some of these small enterprises.
martin-adams 13y ago
There are few techniques you could use that don't affect the visitor experience of your own. - Detect referrer and return a script that has a warning - Rotate your script filenames so those hotlinking will soon realise they will need to host it themselves - Use a CDN yourself and don't encourage them to hotlink - Slow down the request For those hotlinking, consider: - You can't trust the source of the code - You can't trust that the code will always be there and it will load quickly - You can't trust the contents of the code may change and break your application If you want to be sinister to those hotlinking you could: - Redirect the user (as others have noted) - Display any message to the user - Steal data from the user who is using the site hotlinking - Inject your own adverts into the target web page - Make the web page do the Harlem Shake
andyhmltn 13y ago
Very very lucky. All they had to do was: document.location = '...' and route the page to a java drive-by which redirects back afterwards and most of their visitors would've been infected. They are incredibly lucky that the owner of that script was nice enough just to add a simple banner.
kbar13 13y ago
Good guy developer, goes above and beyond to help his users +1!
deleted 13y ago
[deleted]
- bulatb 13y ago
  They specifically ask people not to do that.
  - djm_ 13y ago
    Also, linking to something as possibly unstable as a master branch seems odd at best.
    - wmil 13y ago
      You'd think, but jQuery had to remove code.jquery.com/latest.js because people were linking to it from production sites and complaining when things broke.
oakaz 13y ago
just remove that file and force people to use CDN, do you really need to prove your abilities Mr. Einstein ?
marvwhere 13y ago
a friend asked me some days ago: can u help me with a little problem? my old coder has no time to fix it. the classic: "it worked yesterday..." so i checked the code and all js,css files where used from a git repo from some other guy. who moved all files away in other directories. was easy to fix, but i have no idea how stupid his coder is to use github urls from other people repos!!
TheAnimus 13y ago
>We noticed that you're using Internet Explorer. Polymath currently does not support this browser because compatibility issues prevent us from delivering an ideal experience. We're working on fixing these issues. People do realise that some company networks give you no control over which browser you can use right? I can't understand what feature they would need which is missing from IE10. Why not use feature detection? We've moved on from browser detection...
- kaonashi 13y ago
  I think that's just code for "we don't want to spend the time and effort to properly test and debug our application on IE at this time, and we really don't want to get barraged with IE support requests either".
- oneeyedpigeon 13y ago
  http://caniuse.com/#compare=ie+10,firefox+24,chrome+29 http://caniuse.com/#compare=ie+10,firefox+24,chrome+29
  - TheAnimus 13y ago
    Sure, I don't mind if bits don't work, if I miss out on some WebGL stuff or similar. But to just put up a big fuck you, to what is the second most popular or most popular browser as a whole isn't helpful. It reminds me of people using Java Applets for navigation in their frames webpage.... Actually I did that once, I was however 11, and this thing had a spinny thing. Sure, do cool stuff that requires features which some browsers miss, use feature detection to flag that.
    - oneeyedpigeon 13y ago
      Oh, I totally agree - the link was just to answer the "what doesn't IE10 support" question, which you didn't really ask ;) Having said that, the site in question is aimed at developers and designers, most of whom [1] will be using something other than IE. So this isn't the worst example out there. [1] Yes, of course, this is pure conjecture, and I don't have any figures to back that up. Doesn't stop it being true, though.
ronaldx 13y ago
I take this to be a proof-of-concept for ajax.googleapis.com in N years time. "The archive web, sponsored by..."
jimaek 13y ago
Also a good CDN alternative http://www.jsdelivr.com http://www.jsdelivr.com
joeblau 13y ago
That's interesting way to warn users of the err in their ways. I recommend the CDN route for anyone who is standing up a web application for performance more than anything. With a CDN the page load time on my site went from 1.5 second to under .5 seconds. You also get the added benefit of someone not injection code into your website.
daviddede 13y ago
This has being going on for a few months with other sites: http://blog.sucuri.net/2013/05/who-really-owns-your-website-please-stop-hotlinking-my-easing-script-use-a-real-cdn-instead.html http://blog.sucuri.net/2013/05/who-really-owns-your-website-... thanks,
cl8ton 13y ago
A car dealer was hot linking to pictures of our cars from a sports car forum I belong to and using them to sell his same models on eBay. We changed to pics of Male Enhancement devices and medication and shared with other car forums, we all watched for days and the guy was pretty clueless on what was going on and apparently didn’t check his ads as often as he should. We even had a vote for what pic appears today poll. Remember: The first rule of Changing hot linked photos club is to never talk about changing hot linked photos.
- eric_the_read 13y ago
  In the very early days of lolcats, I nearly got fired because an image macro I referenced in an email got replaced, several months later, with.... let's just say it was the sort of image that rivals goatse for disgusting. Fortunately, my company's IT department had enough of a clue that when I explained what had happened, they agreed it was possible; it was a tense week, though, while they investigated. I'm not saying the sort of reaction in parent isn't always appropriate, but just be aware that people's lives can be ruined to save a few dollars. I think the OP's solution is ideal: it alerts people to the problem in a very professional way, and provides solutions for the most common cases.
  - cl8ton 13y ago
    100% agree with you, always weight damage it may cause. In the case I mentioned, this was a well known bad actor in the auto circles known for ripping first time buyers off with shady tactics and misrepresenting facts.
- eric_the_read 13y ago
  In the very early days of lolcats, I nearly got fired because an image macro I referenced in an email got replaced, several months later, with.... let's just say it was the sort of image that rivals goatse for disgusting. Fortunately, my company's IT department had enough of a clue that when I explained what had happened, they agreed it was possible; it was a tense week, though, while they investigated. I'm not saying the sort of reaction in parent isn't always appropriate, but just be aware that people's lives can be ruined to save a few dollars. I think the OP's solution is ideal: it alerts people to the problem in a very professional way, and provides solutions for the most common cases.
deleted 13y ago
[deleted]
segfault1212 13y ago
atleast that site is listed as beta. Check out this real estate site that is making millions of dollars selling condos and town homes. http://www.fairwaytownecenter.com/ http://www.fairwaytownecenter.com/
jimktrains2 13y ago
This isn't a finished blog post yet, so bare with me. In http://jimkeener.com/posts/http http://jimkeener.com/posts/http I have two things which I think would be great additions to both HTTP and HTML. The first are Content-Signature (signed with the TLS key perhaps)and Content-Hash (format: "hash-algo base64-hash-value") headers. The second is allowing a hash and/or signature attributes on elements that have a src attribute. This would allow the UA to check if the file is already cached (across domains perhaps too, though I'm not sure how serious collision attacks would be) without having to check the server. EDIT: I feel that these two features, in combo, would allow for a more secure method of using CDNs for things such as javascript libraries. They would also allow a better fallback method for loading local resources than what is used now. <script src="//ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js"></script> <script> if (!window.jQuery) { document.write('<script src="/path/to/your/jquery"> <\/script>'); } </script>
- benjamincburns 13y ago
  Well it just so happens that the IETF is working on the http 2.0 spec now. See https://github.com/http2/http2-spec https://github.com/http2/http2-spec
  - jimktrains2 13y ago
    Yes, that is what my response was in response to. In fact I believe I link to it (not the github version but on the ietf site). However, I felt that some of the points I brought up in what I'd like to see were relevant to this discussion, even if the entire blog post isn't. This is why I highlight the points that are relevant in my comment.
    - benjamincburns 13y ago
      Sorry, what I meant was that if you think these are important features, the README.md in that git repo describes the process to get them added.
      - 13y ago
zenith2037 13y ago
I always thought this tip was common sense... Although my entry to the programming world wasn't through the normal means.
joshfraser 13y ago
It's always blown me away how willing people are to install remote JavaScript on their sites, including top sites that you would expect to be more cautious. A lot of internet retailers include dozens of third party JavaScript files on their pages for analytics, social widgets, retargeting, etc. The way they handle the risk is by using constant monitoring by security auditing firms to check for changes in any of the files (presumably from different locations, browsers, user-agents, etc).
rmdoss 13y ago
That page was like that for a while, since the author of that plugin has done that a few months ago: http://blog.sucuri.net/2013/05/who-really-owns-your-website-please-stop-hotlinking-my-easing-script-use-a-real-cdn-instead.html http://blog.sucuri.net/2013/05/who-really-owns-your-website-...
samelawrence 13y ago
How is this even a thing we're discussing? This just seems so obvious.
benhalllondon 13y ago
if (window.location.origin !== "http://beta.whatispolymath.com/") http://beta.whatispolymath.com/"){ window.location = "http://beta.whatispolymath.com/"; http://beta.whatispolymath.com/"; }
driverdan 13y ago
This site is full of bad practices. * Never link to someone else's files (JS, images, etc). * Don't use S3 as a CDN. It's not a CDN. Latency can be bad. Use CloudFront. * Minify and combine CSS and JS. * Put your JS at the end of the page.
Yhippa 13y ago
13 hours from the time this was posted and it's still being hotlinked.

210 points by jsnk 13y ago

The hotlinked js in question is: http://gsgd.co.uk/sandbox/jquery/easing/jquery.easing.1.3.js http://gsgd.co.uk/sandbox/jquery/easing/jquery.easing.1.3.js That is a neat way to communicate ;) Polymath sounds like a cool idea BTW, but probably difficult to monetize. Somebody must pay the tutors for producing/curating the content, but people have gotten so used to educational material being free...

marceldegraaf 13y ago
Linking to the file from a popular HN thread will likely only worsen the bandwidth issues for the owner :-). Perhaps link to the Github version instead, which is here: https://github.com/gdsmith/jquery.easing https://github.com/gdsmith/jquery.easing

chewxy 13y ago

Screenshot for potential future confused HNers when Polymath realizes it and uses a real CDN: http://i.imgur.com/A8JzHtK.png http://i.imgur.com/A8JzHtK.png

Chirael 13y ago
Thank you chewxy! Was wondering what was going on :)
bhauer 13y ago
Thank you. At first, I didn't see anything of interest and briefly wondered why I was at a site that had nothing to do with the HN subject. It hit me that the submission was to a demonstration rather than an article, so I temporarily instructed Noscript to allow all domains used by the page. Sure enough, now the banner appeared. But that speaks to another reason to not use too many scripts hosted by third-parties. It makes for a very cluttered list of domains for users of Noscript and similar to authorize. I just leave sites that have more than a small number. How many third-party analytics, tracking, tools, social sharing, voting, polling, comments, shopping, deals, and other tools do you really need to embed to make a web site these days? I love when the list is just domain.foo and domain-static.foo and maybe google-analytics or another mainstream analytics domain.
- ladyga 13y ago
  google analytics is a definitive no-no. permabanned here and one of the reasons I run noscript and its kind in my browsers. Not that I mind webmasters running analytics tools, but I'm concerned with google having access to too much personal data/metadata, those privacy issues are bad. Just use piwik or something.
- Wingman4l7 13y ago
  Don't forget that sometimes you need to allow the site's CDN domain as well. The problem with Noscript is that it doesn't seem to differentiate between allowing a domain when it's actually a site you're visiting (say, facebook.com) and when it's a domain that a completely different site is trying to load content from. A straight whitelist is too "dumb" for today's web.

deleted 13y ago

[deleted]

geuis 13y ago

Ok there is a better way to handle this than adding some html to a page to make a banner, posting to HN, and hoping for the best. Check for referal headers and throw a 301.

fosap 13y ago
I hope referrals will be disabled anytime soon. Firefox has AFAIK disable referrals to other domains by default.
- akx 13y ago
  In the case of Javascript hotlinking, that'll do approximately diddly squat though. if(/whatispolymath/.exec(location.href)) alert("...");
  - martin-adams 13y ago
    Or better yet, test if it's not your domain, then show a message.
  - fosap 13y ago
    That is a way better, IMO.
andymcsherry 13y ago
Or just send the owner an email: http://www.whois.com/whois/whatispolymath.com http://www.whois.com/whois/whatispolymath.com
- bigiain 13y ago
  So why should it be the responsibility of some guy who's bandwidth is getting stolen to be nice about notifying the guy who's stealing it - why didn't the site owner feel any obligation to send the .js hosting site owner an email asking if it was OK first?
jacquesm 13y ago

BadassFractal 13y ago

Lots of services out there like browser-update.org tell you to load snippets of js over http from some random location they control. It's pretty unsafe unless you really know who's running the show over there and how secure their system is. Them being compromise could make every user site vulnerable.

mjpa 13y ago
There is of course the maintenance issue... what happens when their script is updated and breaks how you use it?
- Cthulhu_ 13y ago
  Usually, library scripts are versioned in their filename, so won't be updated after release.

artumi-richard 13y ago

whoops, not sure he wanted it here too. http://gsgd.co.uk/sandbox/jquery/easing/ http://gsgd.co.uk/sandbox/jquery/easing/

herpyDerpy 13y ago
Ha ha! Actually, it's not a bug, pretty obvious he's "demonstrating a feature"... :)

jacquesm 13y ago

And that's a pretty mild example of what could happen if you did. Hotlinking javascript is an excellent way to allow someone else to pull all kinds of tricks with your visitors and your image. For example, redirecting all your traffic to a shocksite. Every time you include some externally hosted javascript you open yourself and your visitors to a security risk. And on top of that, if you do it like this you're stealing bandwidth. When including remotely hosted javascript make sure you have permission, make sure the other party is trustworthy and periodically review the linked script to make sure it does what is advertised (and that's imperfect, it could be you're seeing something else than other visitors).

ballard 13y ago
The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. That way, you can run them through the ol' asset pipeline too... minifiers and possibly serve them straight from gzips. Gotta always remind ppl of https://developers.google.com/speed/ https://developers.google.com/speed/ ... the OP scores 47 (out of 100)
- UnoriginalGuy 13y ago
  Interesting, Google has added more stuff to the speed test. My site has gone DOWN by 4 points since I last tested it due to failing some new tests. Really great service by Google in general. I've managed to improve page loading times by 25%, cut number of connections in half (I merged all images into one unified file and then use CSS to display the relevant sub-sections), and reduce the total size of my page by over 10%.
- grey-area 13y ago
  The standard pattern is never use external dependencies directly, but to keep copies and host them on your CDN. For dependencies you can control, it's obviously best to keep a local or CDN copy. However this trend of embedding js from all over the web is encouraged by the pattern that most of the big sites allowing you to embed content use: e.g. https://developers.google.com/+/web/badge/ https://developers.google.com/+/web/badge/ Google, Twitter, FaceBook all want you to embed js hosted on their servers in your page in order to interact with their site, even if all that script does is then insert an iframe into the page. By including a button or widget like the one above you're trusting them not to take over your site in a manner similar to this example, track your users surreptitiously, or be compromised now or in the future.

thejosh 13y ago

Find more here: https://www.google.com.au/search?q=%22http%3A%2F%2Fgsgd.co.uk%2Fsandbox%2Fjquery%2Feasing%2Fjquery.easing.1.3.js%22&oq=%22http%3A%2F%2Fgsgd.co.uk%2Fsandbox%2Fjquery%2Feasing%2Fjquery.easing.1.3.js%22&aqs=chrome.0.69i57j5.856j0&sourceid=chrome&ie=UTF-8 https://www.google.com.au/search?q=%22http%3A%2F%2Fgsgd.co.u...

m_ram 13y ago
Even more interesting is all the people who don't know why they're getting this error message: https://encrypted.google.com/search?hl=en&q=%22Please%20stop%20hotlinking%20my%20easing%20script%22 https://encrypted.google.com/search?hl=en&q=%22Please%20stop...
- junto 13y ago
  Yep, I thought that too. The vast majority of website owners have had external developers build their websites. Often those developers are long gone and the website owners left to their own devices (or CMS's). The site owners are now confused and think they have been hacked and don't know where to turn to. There is actually a business proposition here. You could contact George Smith and ask him for a list of all HTTP referrers. Then contact each site in turn and ask them if they need any help. Even if they have it sorted already, it might be a good intro into some of these small enterprises.

martin-adams 13y ago

There are few techniques you could use that don't affect the visitor experience of your own. - Detect referrer and return a script that has a warning - Rotate your script filenames so those hotlinking will soon realise they will need to host it themselves - Use a CDN yourself and don't encourage them to hotlink - Slow down the request For those hotlinking, consider: - You can't trust the source of the code - You can't trust that the code will always be there and it will load quickly - You can't trust the contents of the code may change and break your application If you want to be sinister to those hotlinking you could: - Redirect the user (as others have noted) - Display any message to the user - Steal data from the user who is using the site hotlinking - Inject your own adverts into the target web page - Make the web page do the Harlem Shake

andyhmltn 13y ago

Very very lucky. All they had to do was: document.location = '...' and route the page to a java drive-by which redirects back afterwards and most of their visitors would've been infected. They are incredibly lucky that the owner of that script was nice enough just to add a simple banner.

kbar13 13y ago

Good guy developer, goes above and beyond to help his users +1!

deleted 13y ago

[deleted]

bulatb 13y ago
They specifically ask people not to do that.
- djm_ 13y ago
  Also, linking to something as possibly unstable as a master branch seems odd at best.
  - wmil 13y ago
    You'd think, but jQuery had to remove code.jquery.com/latest.js because people were linking to it from production sites and complaining when things broke.

oakaz 13y ago

just remove that file and force people to use CDN, do you really need to prove your abilities Mr. Einstein ?

marvwhere 13y ago

a friend asked me some days ago: can u help me with a little problem? my old coder has no time to fix it. the classic: "it worked yesterday..." so i checked the code and all js,css files where used from a git repo from some other guy. who moved all files away in other directories. was easy to fix, but i have no idea how stupid his coder is to use github urls from other people repos!!

TheAnimus 13y ago

>We noticed that you're using Internet Explorer. Polymath currently does not support this browser because compatibility issues prevent us from delivering an ideal experience. We're working on fixing these issues. People do realise that some company networks give you no control over which browser you can use right? I can't understand what feature they would need which is missing from IE10. Why not use feature detection? We've moved on from browser detection...

kaonashi 13y ago
I think that's just code for "we don't want to spend the time and effort to properly test and debug our application on IE at this time, and we really don't want to get barraged with IE support requests either".
oneeyedpigeon 13y ago
http://caniuse.com/#compare=ie+10,firefox+24,chrome+29 http://caniuse.com/#compare=ie+10,firefox+24,chrome+29
- TheAnimus 13y ago
  Sure, I don't mind if bits don't work, if I miss out on some WebGL stuff or similar. But to just put up a big fuck you, to what is the second most popular or most popular browser as a whole isn't helpful. It reminds me of people using Java Applets for navigation in their frames webpage.... Actually I did that once, I was however 11, and this thing had a spinny thing. Sure, do cool stuff that requires features which some browsers miss, use feature detection to flag that.
  - oneeyedpigeon 13y ago
    Oh, I totally agree - the link was just to answer the "what doesn't IE10 support" question, which you didn't really ask ;) Having said that, the site in question is aimed at developers and designers, most of whom [1] will be using something other than IE. So this isn't the worst example out there. [1] Yes, of course, this is pure conjecture, and I don't have any figures to back that up. Doesn't stop it being true, though.

ronaldx 13y ago

I take this to be a proof-of-concept for ajax.googleapis.com in N years time. "The archive web, sponsored by..."

jimaek 13y ago

Also a good CDN alternative http://www.jsdelivr.com http://www.jsdelivr.com

joeblau 13y ago

That's interesting way to warn users of the err in their ways. I recommend the CDN route for anyone who is standing up a web application for performance more than anything. With a CDN the page load time on my site went from 1.5 second to under .5 seconds. You also get the added benefit of someone not injection code into your website.

daviddede 13y ago

This has being going on for a few months with other sites: http://blog.sucuri.net/2013/05/who-really-owns-your-website-please-stop-hotlinking-my-easing-script-use-a-real-cdn-instead.html http://blog.sucuri.net/2013/05/who-really-owns-your-website-... thanks,

cl8ton 13y ago

A car dealer was hot linking to pictures of our cars from a sports car forum I belong to and using them to sell his same models on eBay. We changed to pics of Male Enhancement devices and medication and shared with other car forums, we all watched for days and the guy was pretty clueless on what was going on and apparently didn’t check his ads as often as he should. We even had a vote for what pic appears today poll. Remember: The first rule of Changing hot linked photos club is to never talk about changing hot linked photos.

eric_the_read 13y ago
In the very early days of lolcats, I nearly got fired because an image macro I referenced in an email got replaced, several months later, with.... let's just say it was the sort of image that rivals goatse for disgusting. Fortunately, my company's IT department had enough of a clue that when I explained what had happened, they agreed it was possible; it was a tense week, though, while they investigated. I'm not saying the sort of reaction in parent isn't always appropriate, but just be aware that people's lives can be ruined to save a few dollars. I think the OP's solution is ideal: it alerts people to the problem in a very professional way, and provides solutions for the most common cases.
- cl8ton 13y ago
  100% agree with you, always weight damage it may cause. In the case I mentioned, this was a well known bad actor in the auto circles known for ripping first time buyers off with shady tactics and misrepresenting facts.
eric_the_read 13y ago
In the very early days of lolcats, I nearly got fired because an image macro I referenced in an email got replaced, several months later, with.... let's just say it was the sort of image that rivals goatse for disgusting. Fortunately, my company's IT department had enough of a clue that when I explained what had happened, they agreed it was possible; it was a tense week, though, while they investigated. I'm not saying the sort of reaction in parent isn't always appropriate, but just be aware that people's lives can be ruined to save a few dollars. I think the OP's solution is ideal: it alerts people to the problem in a very professional way, and provides solutions for the most common cases.

deleted 13y ago

[deleted]

segfault1212 13y ago

atleast that site is listed as beta. Check out this real estate site that is making millions of dollars selling condos and town homes. http://www.fairwaytownecenter.com/ http://www.fairwaytownecenter.com/

jimktrains2 13y ago

This isn't a finished blog post yet, so bare with me. In http://jimkeener.com/posts/http http://jimkeener.com/posts/http I have two things which I think would be great additions to both HTTP and HTML. The first are Content-Signature (signed with the TLS key perhaps)and Content-Hash (format: "hash-algo base64-hash-value") headers. The second is allowing a hash and/or signature attributes on elements that have a src attribute. This would allow the UA to check if the file is already cached (across domains perhaps too, though I'm not sure how serious collision attacks would be) without having to check the server. EDIT: I feel that these two features, in combo, would allow for a more secure method of using CDNs for things such as javascript libraries. They would also allow a better fallback method for loading local resources than what is used now. <script src="//ajax.googleapis.com/ajax/libs/jquery/1.2.6/jquery.min.js"></script> <script> if (!window.jQuery) { document.write('<script src="/path/to/your/jquery"> <\/script>'); } </script>

benjamincburns 13y ago
Well it just so happens that the IETF is working on the http 2.0 spec now. See https://github.com/http2/http2-spec https://github.com/http2/http2-spec
- jimktrains2 13y ago
  Yes, that is what my response was in response to. In fact I believe I link to it (not the github version but on the ietf site). However, I felt that some of the points I brought up in what I'd like to see were relevant to this discussion, even if the entire blog post isn't. This is why I highlight the points that are relevant in my comment.
  - benjamincburns 13y ago
    Sorry, what I meant was that if you think these are important features, the README.md in that git repo describes the process to get them added.
    - 13y ago

zenith2037 13y ago

I always thought this tip was common sense... Although my entry to the programming world wasn't through the normal means.

joshfraser 13y ago

It's always blown me away how willing people are to install remote JavaScript on their sites, including top sites that you would expect to be more cautious. A lot of internet retailers include dozens of third party JavaScript files on their pages for analytics, social widgets, retargeting, etc. The way they handle the risk is by using constant monitoring by security auditing firms to check for changes in any of the files (presumably from different locations, browsers, user-agents, etc).

rmdoss 13y ago

That page was like that for a while, since the author of that plugin has done that a few months ago: http://blog.sucuri.net/2013/05/who-really-owns-your-website-please-stop-hotlinking-my-easing-script-use-a-real-cdn-instead.html http://blog.sucuri.net/2013/05/who-really-owns-your-website-...

samelawrence 13y ago

How is this even a thing we're discussing? This just seems so obvious.

benhalllondon 13y ago

if (window.location.origin !== "http://beta.whatispolymath.com/") http://beta.whatispolymath.com/"){ window.location = "http://beta.whatispolymath.com/"; http://beta.whatispolymath.com/"; }

driverdan 13y ago

This site is full of bad practices. * Never link to someone else's files (JS, images, etc). * Don't use S3 as a CDN. It's not a CDN. Latency can be bad. Use CloudFront. * Minify and combine CSS and JS. * Put your JS at the end of the page.

Yhippa 13y ago

13 hours from the time this was posted and it's still being hotlinked.