Hacker News Reader

Really? We need advice on "Preventing Image Hot Linking with htaccess", and help with "Disabling Directory Browsing" — is everyone sure we don't need a tutorial on how to download and host Flash games and cool JS custom mouse cursor tricks while we're at it, too?

View on HN

The hotlinking code appears to be a copy paste from a defunct blog, the post in 2004, called Jotsheet. The specific "humiliatingimage.gif" and the ordering of the image extensions is pretty good as a marker.

This particular one appears in a few other places, http://www.google.co.uk/search?q=humiliatingimage.gif+[L,NC]... but in particular it turns up a couple of months ago in http://blog.seoland.co.uk/10-htaccess-hacks-every-seo-should... which appears to be where makeitrank copied it from?

It can also be trivially defeated by using an <iframe> with a <meta http-equiv="refresh" content="1;url=hxxp://hotlinked/image.gif" />

Removing the allow for the null-referrer ^$ fixes it for this, but breaks access for user agents that don't send Referer.

Reply on news.ycombinator.com