Hotlinking to jquery.com will be disabled on January 31, 2011

http://blog.jquery.com/2010/12/30/hotlinking-to-be-disabled-on-jan-31-2011/

by Uncle_Sam • 16 years ago

150 97 16 years ago

blog.jquery.com

cletus• 16 years ago

Frankly I'm surprised jquery even allowed this to begin with. Now there will be sites that rely on this tha break, some of which won't be fixed for ages (if ever).

I guess I shouldn't be but I'm still surprised people would even do this given that Google s offering the service for free. Hotlinking has always been antisocial.

sudont• 16 years ago

Never doubt the laziness of people, especially other developers.

I'm actually more surprised that the site didn't either use Google's API to host the download, or provide a hotlink button right there.

angrycoder• 16 years ago

Some might be from laziness, but I would imagine most of the hotlinking is from ignorance.

jasoncartwright3• 16 years ago

Perhaps a little harsh. Is the problem bandwidth or connection quantity? If it's bandwidth then they should just 301 to the Google CDN.

izak30• 16 years ago

They are not disabling their CDN. They are only disabling hotlinking against other sources. This was in the first sentence.

jasoncartwright3• 16 years ago

I understand that. The question still stands - if it's a bandwidth problem on jquery.com, why not just 301 it somewhere else?

jeresig• 16 years ago

Straight connection overloading. We're already redirecting the majority of the files - but somehow the hotlking continue to persist.

jasoncartwright3• 16 years ago

Makes sense, good decision then.

ronnier• 16 years ago

How are you preventing hotlinking while still allowing the files to function normally on jquery.com? Inspecting the referrer or checking to see if other resources were previously downloaded?

DanHulton• 16 years ago

I like the one comment about serving up evil.js to hotlinkers instead (https://github.com/kitgoncharov/evil.js/blob/gh-pages/evil.j...).

How have I never heard about this hilarious script before?

statictype• 16 years ago

Wow. That script is all kinds of awesome. Javascript is unconventional and unpredictable as it is, without intentionally hosing the entire runtime environment like this.

yuhong• 16 years ago

One of the reasons JavaScript crypto is a bad idea in most cases.

amackera• 16 years ago

I lol'd @

    'PI': 3.2

BCM43• 16 years ago

For those of us who do not know javascript (a rarity on HN, I know) could you explain what it does?

jerf3• 16 years ago

It does... many things. All sort calls are hardcoded to return [4, 8, 15, 16, 23, 42], regardless of input. It scrambles the log bases for the math logarithm commands, it hardcodes the output of the upper-casing string call to a constant, and what I've reported is just a sampler. It is very well-named.

Could be improved a bit, though. Many of its entries lack subtlety. If you really want to be evil, make uppercase do something like uppercase all but one letter, or "uppercase" the digit 1 into exclamation marks, 2 into at signs, etc., convincing the poor developer that the JS upper case function is broken and affect digits. ("Must be unicode or something.")

johnfn• 16 years ago

It's actually fairly readable if you have a background in coding at all. Here are some clues:

1. Every built in in Javascript can be overwritten.

2. If you see something like ObjectName.prototype.fnName, then what you're doing is defining a new fnName function on ObjectName. The thing about Javascript is that you can add new functions to objects, and since everything can be overwritten, you can also replace old functions with new ones. So when you do something like Array.prototype.sort = function(){...} then you're overwriting the builtin sort method on Arrays. Most of the script is just defining builtins to have bogus results.

3. Javascript has a built in Math object, like a few other languages. The language also allows you to create objects on the fly with bracket notation: the layout is key: value. So the Math definition defines Math.PI to be 3.2.

4. There are a few other jokes in there too (like defining alert, which makes a message box, to be eval, which evaluates the string).

zbanks• 16 years ago

Crockford used to prevent hotlinking to his JSON library (its now on github) in an interesting way: right at the top there was an alert() line that you had to remove before using.

This would probably be the best way to transition. If they add an alert to their library and leave it up a week, most people should notice and fix it.

orblivion• 16 years ago

If Crockford used it in production though, the alert() would be removed there, right? So someone could still in theory hotlink that.

Nycto• 16 years ago

Unless jquery.com itself uses Google's CDN (which it already is for some of its javascript)

jerf3• 16 years ago

    if (location.host.search(/crockford.com$/i) != -1) {
        alert("Stop hotlinking me!")
    }

I don't think you can fool that, but I'd love to hear about how I'm wrong.

axod2• 16 years ago

  <script>
  var oldAlertFunction = window.alert;
  window.alert = function(){};
  </script>

  <script src="crockford.com/json.library.js"></script>

Arms race, but just sayin'

alex_c• 16 years ago

The point would be to give webmasters a heads-up and time to fix their sites before hotlinking is disabled, not so much to prevent them from using the file.

MBlume• 16 years ago

And if you want to avoid changing the rest of the page:

  <script src="crockford.com/json.library.js"></script>

nerfhammer• 16 years ago

Anyone smart enough to think of that would be smart enough not to hotlink

dedward• 16 years ago

Always seemed to be to be a bad practice from a security point of view - you are putting the security of your site in the hands of whoever is hosting the .js

This also applies when .js is dynamically included as a type of API call to embed widgets and whatnot - but in those cases there's a necessary reason - it's the only practical way - but for a simple .js, you should be managing your own .js library and publishing on your own (including all the speedup tricks you know you should be doing)

wzdd• 16 years ago

> Always seemed to be to be a bad practice from a security point of view

This is why I can't understand people's recommendation to use Google's or Microsoft's CDN. Even if you assume they're not going to be malicious, you have to trust that they're secure. Not to mention that the CDN owner can derive accurate traffic stats from the number of requests for the JavaScript.

jdminhbg• 16 years ago

Why would I be less sure that they're secure than my own personal hosting?

Encosia2• 16 years ago

As long as the CDN is configured to transmit its files with a far-future expires header (which Google and Microsoft's CDNs are), the CDN owner can't accurately track usage at all.

In a perfect world, the CDN would only handle one HTTP request per user per expires period (+1 year on Google and Microsoft's jQuery CDN). In reality, the file will be pushed out of or cleared from caches for various reasons, but they still persist long enough to make tracking end-usage of the CDN meaningless.

dminor• 16 years ago

Performance. Many of your visitors will already have it in their cache.

simonbrown• 16 years ago

Plenty of people use Google Analytics, which, of course, gives Google just as much access.

lwat• 16 years ago

I trust Google and Microsoft enough for the benefits I get in return (faster loading clients). Sure they can screw me over but not too badly. Worth the risk for some applications.

mike-cardwell10• 16 years ago

It should be trivial for them to scan their access logs for referrers, and then send a mailshot out to each domains webmaster address.

To me, that seems like the polite thing to do.

ergo984• 16 years ago

They are already going way above and beyond by extending their deadline to the end of January. They have the capacity to be much ruder about it.

Hotlinking like this has been a well known web evil for well over a decade. That people still do it and just hope for the best is indicative of extraordinary laziness and selfishness.

mike-cardwell10• 16 years ago

You're attributing malice to something which could be attributed to ignorance. A common error.

They could just break all those sites without giving them personalised warnings, yes. And they would also be completely entitled to yes. But for the small amount of effort needed, why not try to minimise the damage.

cabalamat• 16 years ago

> Hotlinking like this has been a well known web evil for well over a decade.

Except where the site expressly permits it.

mootothemax6• 16 years ago

It should be trivial for them to ... send a mailshot out to each ... webmaster address

Well indeed, but even if you ignore the time taken to do WHOIS lookups and presume that they'll go to the right person (e.g. blogs hosted on Wordpress.com) you're still ignoring the serious amount of computing power that it takes to send a significant number of emails.

mike-cardwell10• 16 years ago

I was suggesting webmaster@domain for each of the domains. Not 100% full proof, but no method is.

I'm assuming we're talking about thousands of emails here, not millions.

rhizome5• 16 years ago

Shouldn't need to do whois lookups, webmaster@ is required by RFC.

http://www.faqs.org/rfcs/rfc2068.html

rorrr• 16 years ago

Just for the record, here are the CDN versions:

http://ajax.googleapis.com/ajax/libs/jquery/1/jquery.min.js (always the latest version)

http://code.jquery.com/jquery-1.4.4.min.js

http://ajax.microsoft.com/ajax/jQuery/jquery-1.4.4.min.js

Encosia2• 16 years ago

Avoid using the "latest version" reference. In order to ensure that it's serving the latest version, it serves the script with an extremely short expires header.

scotth• 16 years ago

Not to mention that referencing the latest version means that your code will be untested against anything but the library version you built against.

slexaxton2• 16 years ago

You forgot: http://cdn.thetaylornation.com/taylornation/resources/displa...

alanh• 16 years ago

Keep in mine that many sites use the Google version, so if you do to, some of your visitors will get it "free" (from their local cache). The caveat about not using the "latest version" stands. And for the gods' sake don't use the actual google Ajax loader API, it's an extra script to load. (Include the above URL directly, not by doing a .load() on something else.)

ajpiano2• 16 years ago

We did a lot of analysis of the sites that were actually hotlinking, and are planning to reach out to those that are above board and should know better. By and large, however, most of the sites that were hotlinking were porn/phishing/generally nefarious, which weighed heavily into our decision to pull the plug relatively soon. Serving people who need jQuery and jQuery UI documentation, etc., is a higher priority than not-pulling-the-rug-out-from-under networks of porn sites - people who have more than adequate access to their own hosting and distribution resources.

ajpiano2• 16 years ago

OTOH, TaylorSwift.com was also hotlinking, which is pretty awesome.

slexaxton2• 16 years ago

I am currently trying to talk to Taylor about sharing cdn resources.

If anyone is not aware, one of the best CDNs out there for getting jQuery is the Taylor Swift "TaylorNation" cdn.

http://cdn.thetaylornation.com/taylornation/resources/displa...

I encourage everyone to use it.

quinndupont• 16 years ago

Damn shame. I used to hotlink during testing when I was too lazy to download the actual JS and host it. It was a nice way to build wicked fast little sites.

ceejayoz• 16 years ago

Just hotlink to Google's version.

Fluxx• 16 years ago

When the change is made, changing the results of the HTTP GET to some javascipt comments explaining what happened and pointing them to some CDNs which offer the same service would be a good idea.

rbanffy• 16 years ago

Ways to solve the problem once and for all:

- Listing the sites that hotlink it would be a nice idea.

- Changing the script on the hotlinked files to pop-up a warning that the site is doing something improper and urging people to contact the owner.

- When that doesn't work, break the sites.

mark_h• 16 years ago

Now is probably a good time for a reminder: http://scriptsrc.net/

(Up to date CDN links for a bunch of javascript libraries, including jquery)

iwwr• 16 years ago

The jquery people are being incredibly generous. Others would have just tweaked the JS to produce some shock site or text to the effect "you are a bandwidth thief".

Hotlinking to jquery.com will be disabled on January 31, 2011

Related Stories