Hacker News Reader

Comment by orblivion | Hacker News Reader

If Crockford used it in production though, the alert() would be removed there, right? So someone could still in theory hotlink that.

View on HN

    if (location.host.search(/crockford.com$/i) != -1) {
        alert("Stop hotlinking me!")
    }

I don't think you can fool that, but I'd love to hear about how I'm wrong.

You can definitely fool that: http://www.adambarth.com/papers/2009/adida-barth-jackson.pdf

window.alert = function () {};

    if (location.host.search(/crockford.com$/i) != -1) {
        throw "Stop hotlinking me!";
    }

You code should read != 0 to have the desired effect.

And even then, this can bypass it:

  var temp = String.prototype.search;
  String.prototype.search = function() { return 0};

    if (location.host.search(/crockford.com$/i) != 0) {
        throw "Stop hotlinking me!";
    }

  String.prototype.search = temp;

Though that may cause other problems.

My point was that it's just a game of cat and mouse. I could come up with lots of workarounds for almost anything you throw at me. Example:

    var expectedHost = "crockford.com";
    if (expectedHost.length !== location.host)
        throw "Stop hotlinking me!";
    for (var i = 0; i < expectedHost.length; i++)
        if (location.host[i] === expectedHost[i])
            throw "Stop hotlinking me!";

(though it string[x] might not work in every browser)

So thanks for further demonstrating my point!

But really, just check the referrer header.

Point. I was unclear in my phrasing, I was more looking into just not accidentally bypassing it. Deliberately bypassing it probably can't be stopped but really at that point you've already lost. Given what I've seen in the world somebody grabbing an existing proxy script and regexing out the check and never once stopping to think this is way worse than hosting the file yourself wouldn't even make me blink.

Unless jquery.com itself uses Google's CDN (which it already is for some of its javascript)

Reply on news.ycombinator.com