A Hacker News vote button

https://github.com/igrigorik/hackernews-button

by fnaticshank • 14 years ago

124 36 14 years ago

So how does this work? Does hnbutton.appspot.com do some clever proxying, or something? Or does HN just have a very easily exploitable XSRF vulnerability?

alter82• 14 years ago

They use the search API. https://github.com/igrigorik/hackernews-button/blob/master/h...

mixedbit• 14 years ago

I also don't understand how it works. If you could up-vote just by following a link, you could easily gain a system. For example, you could submit a story that automatically up-votes itself when visited by logged-in user, without any button press (CSRF). I believe Facebook like button (and other similar gadgets) are iframes from Facebook. So Facebook controls how the button looks like and it is not possible to submit 'Like' requests from a third party domain.

nightpool• 14 years ago

http://news.ycombinator.com/item?id=3742902

EDIT: This is a submission from a while ago that does, in fact, upvote itself.

cxhristian• 14 years ago

From what I can understand, looking at one site that uses the button[0], it just displays current votes and links you to the submission. It doesn't do any voting from the site like a reddit button would do.

[0] https://bountify.co/blog/host-your-own-hacker-news-button-se...

alter82• 14 years ago

My answer to GP looks silly now. I see what he meant. The submission title should change to vote-counter button to avoid the confusion.

bevan• 14 years ago

This button is great, but the button server at hnbutton.appspot.com (which queries the search API) is frequently over its quota, which means the button doesn't appear / work a lot of the time.

It's easy to set up your own (free) button server though. Here's how: https://bountify.co/blog/host-your-own-hacker-news-button-se...

jakerocheleau• 14 years ago

Great link thanks for sharing that.

igrigorik6• 14 years ago

Fixed - plenty of quota now!

I honestly didn't realize how much traction it picked up over the past 6 months.. It was a (pleasant) surprise to login into my GAE console and realize that it was serving, on peak days, over 1M impressions.

Interestingly enough, the "exceeded quota" was not for CPU resources! Instead, it was all egress bandwidth. On busy days, it would reach the free 1GB egress limit sometime between 6-12PM, and hence the error. I've upgraded the app, and it should be good for terabytes a day. ;-)

P.S. I've also pushed an update to enable more aggressive HTTP caching on the assets.

recuter• 14 years ago

So you turned on billing? ;-) Good to know it was getting so many impressions at the free tier, GAE is undervalued by the community me thinks.

leoplct• 14 years ago

Doesn't the vote get penalized if you vote directly, instead of searching the topic on the web page?

krat0sprakhar• 14 years ago

Upvote for shanky!

fnaticshank• 14 years ago

thankyou :D

p4bl02• 14 years ago

I may be missing something, but I don't understand the point of the step 2 in the README: why not just say to add the <script> tag directly?

eknkc• 14 years ago

Then any browser will try to load the script synchronously. This ensures asynchronous loading and if there is a problem with button server, it stays there.

p4bl02• 14 years ago

Oh, okay. Thanks.

josscrowcroft• 14 years ago

Looks beautiful but any problems with the votes being discounted? Will it still work in future or is it an exploit that would get closed?

igrigorik6• 14 years ago

The instructions are for the async install, so even if the widget is broken or goes down (it shouldn't), your site rendering will not be blocked, or affected in any other way.

kami88452• 14 years ago

is there a demo somewhere? I tried to do something similar but the ycombinator.com domain returns the "X-Frame-Options:deny" header which makes iframing impossible. Also in order to vote by simple GETting a url you have to include a CSRF token as a URL parameter.

igrigorik6• 14 years ago

Check one of the bgr.com articles, they have it installed in the sidebar.

kami88452• 14 years ago

It doesn't seem to work. Check out any of the articles submitted to HN:

http://www.hnsearch.com/search#request/all&q=bgr.com&...

They all show "submit". I re-submitted one of the stories myself. Still shows "submit" as the HN button.

EDIT: Ok apparently it does work after I submitted a story through it (cold cache?) But it's still pretty meh, really just a glorified <a><img></a>

wildranter2• 14 years ago

Great stuff. I'm gonna incorporate this on my upcoming blog. Thanks!

On a side note. Could someone at YC fix the up vote arrows here? It's really hard to hit these tiny arrows without hitting everything around before, really messy. BTW, a larger textfield wouldn't hurt either.

PS: Sorry for stealing your topic, I just felt the need to say these things which I think don't bother only me. ;)

dhimes3• 14 years ago

They don't only bother you, believe me. Most of us have simply given up asking for site changes. We hack the styles ourselves or simply deal with it.

wildranter2• 14 years ago

Great tip, thanks for that. But I was referring to touch devices which make somewhat difficult to apply custom styles. So we shouldn't give up on our "demands" for better UX.

lucb1e2• 14 years ago

How can we do custom styles on it? Right now it's not aligned with other share buttons.

Screenshot: http://g2f.nl/0c4ajy1.png

Edit: You can style ".hn-share-iframe". Then the next issue: it's much wider than it needs to be when the story has already been submitted (see the screenshot, there's a lot of blank space on the right). Is there any other solution besides just positioning it on the right of the share buttons list?

igrigorik6• 14 years ago

Unfortunately, not that I've found.. Twitter and G+ also reserve the space and run into the same problem. The root issue is the lack of automagic iframe resizing.. which is what "seamless" attribute will solve, once it arrives and is supported by the browsers.

lucb1e2• 14 years ago

Okay, thanks for the reply.

EGreg2• 14 years ago

I have a question ... why can't a Hacker News button be done entirely in Javascript? If only HN would incorporate CORS file. Even if it doesn't, there could be a way to approximate it by checking if you are logged into HN, and if you are, doing a cross-domain POST via a form.

"But how do you know if you're logged into HN?" Ah, that's the hack.

for example: https://hacks.mozilla.org/2011/02/an-interesting-way-to-dete...

more in depth: http://stackoverflow.com/questions/5233560/possible-to-find-...

The question -- for all the hackers here -- is, what resource can we request via Javascript on HN that will return a different status code (200 or another one) depending on login state?

For example, maybe posting a blank password to "change password" form will return a non-success status code when you aren't logged in, and be an innocuous post (since it results in an error).

Of course, the trouble with these techniques is that the site can disable them at any time.

rcavezza• 14 years ago

RE: status code depending on login state - You could curl the homepage and see if the logout link exists

EGreg2• 14 years ago

true, but any way to determine it using only javascript in a browser?

A Hacker News vote button

Related Stories