Evil.js: A JavaScript library for thwarting hot-linkers

by surreal • 12 years ago

109 66 12 years ago

eli2• 12 years ago

Reminds me of a script I wrote when a site based in China cloned our entire domain and put it up at a new URL, complete with clumsily photoshopped logos. They left a single stray call to our ad server, though, and I was able to "hack in" and randomly flash a "This site is stolen!" message or insert an auto-playing Youtube clip of my choice.

Xophmeister• 12 years ago

YouTube is blocked in China...

eli2• 12 years ago

Fair point, though the audience for the pranks was more the people they were trying to sell advertising space to.

brianpgordon2• 12 years ago

He could link to Falun Dafa exercise videos and watch as their customers disappear one by one...

thebiglebrewski3• 12 years ago

Can we get a demo?

jamestanderson• 12 years ago

From the github page: http://kitcambridge.be/evil.js/

thebiglebrewski3• 12 years ago

Is something supposed to happen interaction-wise when I go to that page though?

welder• 12 years ago

combination and minification also prevent hot-linking

jdavis703• 12 years ago

I've had experience where someone doesn't just hotlink a resource, but they "clone" it, and replace our ads with their ads. Assuming evil.js works by detecting host names, this would help prevent that.

brianpgordon2• 12 years ago

It doesn't, as a cursory glance at the source would show.

matthuggins2• 12 years ago

The documentation is lacking.

kirkbackus• 12 years ago

The non-minified source is pretty self-explanatory. It modifies a lot of the standard javascript functions. My favorite is the document.write(element) is modified to surround the element with <marquee> and <blink> tags and then write that to the DOM.

Jgrubb• 12 years ago

I like Math.pow = function() { return "pow pow pow!"; }

matthuggins2• 12 years ago

To an extent, yes. I already looked at the source. But it just says to include evil.js on my site. How is that protecting my site from bandwidth thieves? Won't it also screw up my own site's functions?

jt21902• 12 years ago

Very cute. :-)

Now that we've all had a laugh, wouldn't it make more sense to have the server respond with a redirect to a shared copy of the script hosted somewhere that provides bandwidth for free? (Perhaps this is a sign that the script should be open-sourced as well.)

tibbon• 12 years ago

But bandwidth isn't free. Someone's gotta pay for it in some way or another, and if a major company lets say is using your hosted copy without asking, then perhaps they should host their own?

ithkuil• 12 years ago

there are cdns happy to host useful opensource scripts for free, assuming you want to release your script as open source.

arcatek• 12 years ago

This script is used by rawgithub.io. It allows to punish the 'abusers'. There isn't really a notion of open-source in it.

I think the idea is more that if someone is eating your bandwidth by hotlinking your jQuery.js, then you can serve them this instead.

orthecreedence3• 12 years ago

If someone hotlinked one of my scripts, I'd update the head of the script and use the opportunity for free marketing:

    if(!window.location.host.match(/(www\.)?myapp.com/)) window.location = 'http://www.myapp.com';

I bet they won't hotlink after that.

jt21902• 12 years ago

I like this. I'd think it'd be even better if instead of getting them to stop linking, you could turn them into a permanent source of referrals.

danielweber• 12 years ago

I know someone who had, of all people, Facebook hot-linking to his stuff. He redirected all visitors to his homepage. Then Facebook's legal department called his home number, his wife answered and got nervous, and it all ended there.

owenversteeg• 12 years ago

What if someone hotlinks evil.js?

JeanSebTr• 12 years ago

So we can check the hostname from our code and hot-link evil.js from http://kitcambridge.be/evil.js/evil.min.js :)

adamb_• 12 years ago

I did not realize until checking out this source that dividing by zero in JS outputs "Infinity".

https://github.com/kitcambridge/evil.js/blob/gh-pages/evil.j...

wyuenho• 12 years ago

Not always. 0/0 == NaN, but of course typing that into the console will yield false.

_mtr• 12 years ago

Because, of course, NaN != NaN

mbel• 12 years ago

This is happening because all numbers in JavaScript are IEEE 754 [0] double. +/-infinite may be returned for finite, non zero number divided by zero. This is also common behavior in many other languages with support for IEEE 754 floats, from the top of my head: JVM, .NET languages and Haskell do so too.

[0] http://en.wikipedia.org/wiki/IEEE_754

RKoutnik• 12 years ago

Longer answer on StackOverflow (including V8 source): http://stackoverflow.com/a/21893602/1216976

derefr3• 12 years ago

And, awfully-enough, even though Infinity is a required part of IEEE754, and happens all the time in Javascript, JSON doesn't recognize it.

hrjet2• 12 years ago

IIRC, JSON is a strict subset of JS and Python.

polemic4• 12 years ago

Why is that awful? JSON is not JavaScript. The string encoded value of the integer 1 is not a IEEE754 numeric either - it's just the character 1. In modern usage: JSON is to JavaScript as JavaScript is to Java.

mixedbit• 12 years ago

As a "bonus" you will make your site unusable for suffix proxy users.

tlrobinson2• 12 years ago

And the logical follow up, evil.css: https://github.com/tlrobinson/evil.css

dpweb• 12 years ago

To stop leechers - couldn't you just, in your script >

    (function(){
      if(document.domain != 'mydomain.com') return;
    // my script
    })();

varkson• 12 years ago

Where's the fun in that?

anvandare• 12 years ago

Why be nice? >:)

  (function () { if (document.domain !== "mydomain.com") { while (1); }})();

jasonkostempski• 12 years ago

Better not minify the library with JSMin.

wincent• 12 years ago

Not to be confused with evil.js: http://andjs.com/code/eviljs/

Evil.js: A JavaScript library for thwarting hot-linkers

Related Stories