Hacker News Reader

Comment by m463 | Hacker News Reader

The "traditional" way of fixing this would be a goatse.cx redirect of the image.

I'm sure there is a more enlightened fix.

...or sending that image[1] jwz sends back upon detecting HN in the referer. I bet they'll find the app in a matter of hours, or at least reduce the traffic drastically.

1. https://www.jwz.org NSFW!

Just learned that this person owns DNA Lounge (and pizza?), and is a founder (early contributor?) of Netscape and Mozilla.org. I've lived and worked in that particular area of SF for years and haven't known this.

One of my company's clients has a beautiful office right above DNA Lounge (well, across the street or just adjacent - it's been a while and I've only been there once). They told me they can hear sound checks from their rooftop patio.

Also, jwz is responsible for xscreensaver.

netscape used to display a spinning compass when you put about:jwz in the title bar

other good ones were about:1994 and about:mozilla

hey, about:mozilla still works in firefox

about:robots also works in Firefox, I know it's been there for a long time but I have no idea if it was ever in Netscape.

about:robots is from the early Firefox releases. Pretty sure it is from Firefox 3.0 development as you can find the same robot in images when searching for Firefox Gran Paridiso Robot.

https://www.google.com/search?q=firefox+gran+paradiso+robot&...

there used to be linux based public terminals in DNA lounge too, IIRC

This makes me wonder why the hell referer headers are still sent by major browsers, especially to third parties. I can’t think of a single reason that benefits the user.

Originally it probably just sounded like a cool feature to see what blog linked to you. Now its been around for so long that so much has been programmed to actually use it. If you turn it off you get every anti bot script blowing up on you.

I think browsers did drop the path from it at least.

For one thing, examining referer is a common way that a server determines a request is not a hotlink. Sure you can do something more complicated with cookies or whatever, but lots of sites are just using referer and they'll break if the client doesn't send it.

But for that it's enough to send it for same-origin requests. No need to send it cross-origin, except for tracking purposes.

That'd still break the distinction between hotlinking and the user using a bookmark or copy/paste to directly open the URL in question.

Letting the sites distinguish between the two does not seem to be in the interest of the user.

Well, it'd mean that any site blocking hotlinking would also automatically block direct bookmarks/URL entry, too, which isn't really in the "interest of the user" either, I'd say.

If Chrome suddenly stopped sending referrer headers, let's be real here, 99% of websites would be fixed within a couple of days at most.

if you are making any sort of content or running a website, it is really useful to know how people found you.

All I get is a scrolling hex editor looking thing. Maybe that redirect has been disabled?

You aren't sending a referrer header (a good thing).

Try from a new profile or incognito.

I saw the described image but after I visited the site directly I couldn't see it any more when redirectly via hacker news. Saw it again when I opened an incognito tab.

Yep, jwz has had a change of heart and sees today's HN as a born again breath of fresh air.

I’m seeing the nut sundae on iOS mobile so I wouldn’t get too happy yet...

For those reticent to click on their work computers but morbidly curious, can someone describe the image?

It's a motivational-poster-type image with a white egg holder in the foreground, but instead of an egg, it's holding one exquisitely detailed hairy, caucasian ball[1]. At the top, the title is "HACKER NEWS" and the bottom text is "A DDoS OF FINANCE-OBSESSED MAN-CHILDREN AND BROGRAMMERS"

1. Is there a collective biological term for scrotum and it's contents that is not general like "genitals" is?

I think he's the only one that uses that? Barely even worth mentioning in comparison.

A permanent redirect to a non-image page (owned by Wikimedia) may achieve the same thing. Either the calling system can't support a HTML response, or it's a webview in which case you could either report an error or provide a notice. Maybe even ask for donations :)

Or just downsample the image to a reasonable size and deal with it. Nothing inherently wrong with having a popular image.

Yes there is when you are hotlinking. Hotlinking in general is considered theft, you are using someone elses bandwidth and could even ddos the host if you are not caching the response.

> Hotlinking in general is considered theft

This is a pretty puzzling idea to me. How could linking something be theft?

To explore this, I shall try a metaphor. Imagine you're on a big social media website (lets call it Programmer Olds) which has an oddity in that 99% of its users use adblock. You then post a link to another small (ad supported) website on your Programmer Olds page, causing a large number of people to click through and download the page using large amounts of bandwidth (for no monetary gain to the site) and possible DDOSing the site.

Have you commited theft?

> This is a pretty puzzling idea to me.

That's because you're responding to an entirely different issue. "Hotlinking" isn't linking to something, it's including a resource that is hosted elsewhere. It's putting <img src="https://concordDance.whatever/images/big_image.jpg"> on my website without asking you. Now if my site ends up on the front page of HN, that could cause a lot of traffic to your site, potentially overwhelming your server or increasing your hosting bill. It's not nice, and rightfully frowned upon.

But from a loss and gain perspective it seems equivalent.

In both cases the site loses bandwidth for no gain due to your actions.

> causing a large number of people to click through and download the page using large amounts of bandwidth (for no monetary gain to the site)

The difference here is that while a lot of users use adblock, there are some that don't. These users can still see the ads. Additionally even though it's a small website, it may lead to new readers that stick around or the content itself may even be sponsored.

The equivilent to hot linking a picture would be like taking the content of a blog post without really linking to the source, because there's no chance of conversions there. If you're linking to the site itself then there's a reasonable chance that users can convert.

So I suggest that it's theft just because the chances of readers being converted is nil while you're using their bandwidth.

Let's say I own a restaurant. Someone comes in and wants a panini. I don't have a panini press, but the restaurant next door does.

If I tell the customer they can go next door to get a panini, I'm not stealing anything. Maybe that restaurant is packed right now and they'ed rather not have an extra customer, but there is a reasonable expectation that they would generally want customers or at least have a means of turning away unwanted customers otherwise.

On the other hand if I break into my neighbor's restaurant, make a panini, then bring it back to my restaurant to serve and make money off of, all without permission from the neighbor, I am most definitely stealing. Even if I doubt the neighbor will mind because he let me come over and make myself a panini once, I can't unilaterally act off that assumption.

Is adblock a form of theft?

No, it's not universally considered a theft. Wikimedia explicitly permits hotlinking[0]. So does xkcd, imgur and tons of other sites.

Of course when someone doesn't want us to hotlink to their assets then don't do it.

[0] https://commons.wikimedia.org/wiki/Commons:Reusing_content_o...

it's so easy to mitigate, though, that the fact that one doesn't sorta implies that one might want randos from the internet to use one's resources to view this image.

it's not theft if you leave it out for everyone to use.

My garden doesn't have a fence, doesn't mean you can host your picnic here.

No, but if I wander into your garden and "injure" myself, I can sue you for damages. You will be held negligent for not properly protecting yourself from preventing other people from injuring themself on your property.

Wikimedia has a User-Agent policy which is being violated here. Hence this is the property owner putting up a sign that says "risk of injury", so if you walk in and injure yourself, you only have to blame yourself for being negligent.

The policy is for how wikipedia will act when encountering clients with certain user-agent headers, not a rule for the clients.

It's a policy how wikimedia acts when clients lack a user agent header, it's therefore effectively a rule for clients as without a proper UA header, they may be blocked indefinitely.

Is this something real (in US, most probably)?

Yes, you can sue anyone for anything. Your suit probably won't prevail, unless you have access to very expensive lawyers and your opponent doesn't.

But you can totally sue anyone for anything, and that makes for entertaining headlines - even though if plaintiff lost promptly

The problem of course is that the "victim" has a lawyer operating on a contingency, whereas you have to pay your legal costs, and generally cannot recuperate them.

In France (at least), all swimming pools are protected by a fence. If you own a pool and don't put a fence around it, you can be held responsible for a child drowning into it.

It is possible this principle applies to other countries and other things than pools.

Here in Russia, if you leave poisonous chemicals like methanol, etc, unmarked or put a bear trap in your locked house behind a locked fence with a generic warning sign, and then someone dies or gets injured by these, chances are you will go to jail. Idk if this applies to accidental traps like pools or rakes in grass. Same for taking a knife out of an attackers hand and stabbing them back. (Yes, our laws protect criminals better than citizens, not joking.)

Interesting. So if I understand this correctly, if someone breaks into your house and gets injured, and they can make a good case for some kind of negligence on your part, then they can successfully sue you?

In Poland setting marked traps on your own, fenced property is illegal and their owner is responsible for any harm they cause, because there exist legal reasons to enter another person's property - for example to fight spreading fire.

However my favourite example is the law that allows any bee keeper to enter any private property if they are pursuing fleeing bee swarm.

Leaving a bear trap goes way beyond negligence, it's literally setting a trap. Similar with unmarked dangerous chemicals, they're required to be marked for good reason.

In Greece if a burglar dies while in your house you can be held responsible, even more so if you have set up traps.

If a judge or an expert is sure that you intended this outcome, and that someone is brave (or dead) enough to admit their own crime.

It's also illegal to set a trap in your own home in the US as well, decided when a property owner, tired of people breaking into his property while he was away, set up a shotgun booby trap that injured a burglar. https://youtu.be/bV9ppvY8Nx4

I wasn't sure if it is the same or similar principle in Russia or a different one that requires active care for a burglar. Unlabeled chemicals causing liability for a burglar seems extreme to me

This is an urban legend in Russia.

Only in your dreams and some dumb countries, not in the rest of the world.

You think this, but how much experience do you have with it? People know that homeowners have insurance. They sue to make the insurance pay out. It happened to my neighbor. So you can make all of the dumb countries comments you want, but it doesn't make it any less real.

I wonder if there's some way to have a frontend cache that or webserver shortcut that looks for that exact url and blurts out the image?

Or maybe wikipedia is already mostly static.

also, I wonder if HN is inadvertently ddos'ing the ticket system ?

This, perhaps disturbingly, was my first thought upon reading the issue.

Things were done very differently back in the day. This problem would have been fixed real quick.

To the people who didn't grow up with 4chan: do not search for this image, its pretty disgusting.

4chan didn't even exist yet when goatse emerged

It seems plausible to me that the, ahem, "spread" of the image was greatly increased through the efforts of 4chan.

** Kadmium changes topic to 'Our hearts are extended to the 18 victims of the recent internet fraud'

http://bash.org/?434593

Hey I'm on that website! IRC used to be so fun and weird back in the day. hanging out on slashnet took up most of my free time in junior high.

Back in School, goatse was extremely well known. That was several years before 4chan. I hadn’t even heard of goatse in a 4chan relation until now.

Maybe widespread but it was already pretty wide open before there was a gap for 4chan to even exist.

I think it was popularized back in the days of Slashdot.

it does not date to alt.tasteless on usenet? (edit: w/r/t goatse)

I was going to suggest Something Awful but you might win, though Wiki pegs it (heh) at 1999...

It's interesting that you equate goatse with 4chan! I'm old :-(

To the people who grew up before 4chan, pls don’t mention tubgirl

I missed the edit window and I’m disappointed in myself for mentioning it by name. Please just don’t Google this unless you’re prepared for an upsetting image, and even then maybe just skip it. You’re probably not as prepared as you think.

I was born after 4chan was created and I found that image on reddit. It's pretty mild; one can tell quickly that it is a doll.

Not having eyelids would certainly make it worse!

lmao

Fairly sure you’d get goatse’d more often on Efnet etc back in the day

goatse signifiantly pre-dates 4chan

s/4chan/slashdot/

what is it?

Big stretched open butthole. Not sure if you need the warning but I’m commenting in case anyone would prefer not to see it despite their curiosity.

Sorry to ruin the fun y’all but there’s images I won’t even mention that I can’t unsee and make me feel seriously ill when I do see them. I don’t want anyone else to feel that way without warning.

What are these images called so we know to avoid them?

Can't speak to the images themselves, but the sites are usually referred to as "shock sites":

https://en.wikipedia.org/wiki/Shock_site

They were known as a "shock site" ( https://en.wikipedia.org/wiki/Shock_site )

The Wikipedia page for https://en.wikipedia.org/wiki/Goatse.cx is text only and without any ascii art.

I'm amused that https://simple.wikipedia.org/wiki/Goatse.cx also exists.

Oh, Goatse is that site.

I remember when I was about 15, before pop-up blockers were really a thing, someone sent me a link to that and it would keep opening popups with that image and you couldn't close all of them :-/

Sometimes people look back to the internet of the 90s with too rose-coloured glasses IMO.

For some memories... http://www.bash.org/?search=goatse&sort=0&show=25

I am personally most amused by #38659

Hey at least if you were on a 90s Mac your computer was probably unresponsive and you could skip to the inevitable force reboot. And browsers didn’t save sessions so you were in the clear as soon as you got to tabula rasa.

I’m honestly not sure you’re asking in good faith so I’m not going to add more (and if you are asking in good faith you’ve got plenty in responses to go on). Also I never knew the name of the one that’s permanently burned into my brain and I’m so glad I don’t.

There were quite a few, lemonparty and meatspin spring to mind, and the various incarnations of "two x one y".

Like so?

http://ascii.textfiles.com/archives/1011

Brilliant.

If it's just used internally by an app to test connectivity as suggested in another subthread, this wouldn't solve the problem.

A red flower rather than a lavender one.

Why does it need to be fixed? The mission of wikimedia is to serve educational content.

Edit: this is a bit unfair, if its a specific app they should be convinced to cache just to avoid unfair resource usage, but hotlinking in general should not be seen as a problem

Presumably they are paying for the servers/bandwidth to support that, and that money is coming from donors.

It's a waste of donors money if someone is using this image as some kind of "is this thing on" test using hacked computers...

It's both a waste of donor money and a starvation of resources for people actually consulting images on wikimedia commons.

i'm sure the revenue model is robust enough to accommodate spikes in traffic.

Any for-profit entity hotlinking Commons is unfair. Heck, they have the right to redistribute freely the image as they see fit, instead of consuming resources that are a common good.

But this goes beyond that - it's some blind check of internet connectivity for the app, and doesn't get shown to the user. We're pretty sure of that, given that with the amount of noise that task generated, if there was an app featuring that image at least one of the ~ 90M daily "views" would've been someone reading these posts.

Now, given we want to be nice, we didn't just blindly block the traffic, although making requests without user-agent is against our UA policy https://meta.wikimedia.org/wiki/User-Agent_policy

This is exactly what I used to do about 17 years ago.

Reply on news.ycombinator.com