Blocking Image Bandwidth Theft with URL Rewriting

actually…I should have just not clicked the myspace link. Nothing good can ever come from that place

LOL

The other culprit (myspace is bad, yes) is ebay

And online forums. Some guy in the UK made that Q*bert image his forum avatar, so it showed up in every post he made… :stuck_out_tongue:

From now on I can see just WTF images in my own feedreader.

Ronny:

As long as your feedreader (I assume a Windows app?) is sending blank referers, it will work. I only disallow unkown referers, not blank or empty ones. There’s should be no “referer” for a Windows app to use, as it’s not coming from a website!

Right now the whitelist is:

If it is sending a referer, let me know what the URL is and I will happily add it to the whitelist for you.

That is a nice blocked image. I’ll be updating my httpd.ini file on my server to be:

RewriteRule .*.(?:gif|jpg|png) http://www.codinghorror.com/images/block.gif [I,O]

:slight_smile:

I cannot WAIT for IIS 7 to be released and adopted widespread!

All the hoops I have to jump through with Subtext to allow you to create a blog in a “virtual” subfolder WITHOUT setting up a virtual directory in IIS and without mapping * to aspnet_IIS.

This would allow you to create a URL like http://example.org/MyBlogFolder/ without having a physical (or even virtual) folder named “MyBlogFolder”.

In the end there’s no way to do it without either mapping * to aspnet_IIS or using a custom 404 page (which is the choice I made).

Ideally, I want my URLs to be really pretty. Like ponies.

I cannot WAIT for IIS 7 to be released and adopted widespread!

It’s gonna be a while. All versions of Vista come with IIS7 (as we found out at Mix), but those are all desktop operating systems. Are you gonna install Vista on your hosting services’ servers? That’s what I thought.

We can develop against it. But we’ll all be waiting for Longhorn server before we can use IIS 7 for real, production websites. I have no idea when that will be out!

mapping * to aspnet_IIS

I do not think you should ever map * to the ASP.NET handler. Stated another way: I think this is a really bad idea.

There’s no perfect solution right now, but that particular “solution” is gonna cause problems.

You should get a copy of ISAPI Rewrite and do this the right way. Obviously the subtext project can’t make this a requirement, though, but as a personal workaround engine, it’s nice.

Jon Galloway, stop thinking outside the box. Put yourself BACK in the box, man!

But seriously. I am a huge fan of Coral. I am not a huge fan of becoming dependent on another website for core functionality… eg, Feedburner (RSS feed), Flickr (images), etcetera.

Wow… how many RSS reading site owners are gonna be on your whitelist? I hope it doesn’t get too long to parse…

And yes, that’s a reversed invitation to put mine up aswell.

how many RSS reading site owners are gonna be on your whitelist

The use cases for web sites that tend to be aggregated is definitely different than a traditional website. I think either…

A) You’re a giant RSS aggregator, so you’ll be on a limited whitelist.

B) You’re a small RSS aggregator, so you need to write image retrieval code that passes in blank referers.

I’m not the only site that blocks unknown referers from retrieving images! As you know, all it takes is a few idiots to ruin it (free, unlimited remote image linking) for everyone.

It’s interesting to see that I’m not the only guy out there using ISAPI Rewrite. I’ve found it to be very, very useful. You can pull off some truly neat tricks with it. For example, http://www.practicelink.com/jobs/ This entire directory tree more or less just runs off of one .aspx page. I’ve got ISAPI Rewrite set up to map all requests that match /jobs/.+? over to my aspx page, while the user (or search engine, which is the real idea) is none the wiser.

I’ve also started getting into making it so I can add some virtual directories via ISAPI rewrite via some other aspx page. The page just generates the appropriate regexes and ISAPIRewrite code and uses filestreams to update the httpd.ini file. Since ISAPI Rewrite requires no IIS restart or anything like that after you update its httpd.ini for what you changed to take effect, this works like a charm.

Your image is too small for the teenyboppers on Myspace and the like to notice.

I would change your image to be much bigger, but use some sort of graphic format like gif that doesn’t increase the filesize much. If you make the image say 800*800px then it will be noticed and get removed.

Rick Scott: I do agree that the problem is probably very limited. And the fact that the image is the same every time (so far) does make it easier.

However, this is a site that focuses a lot on usability, with which I feel accessibility is pretty tightly connected, so I think it is relevant to consider that the solution, although widely used, isn’t anything near perfect.

It’s been a pet peeve of mine since I had to help a blind friend sign up for at site that used this technique. There has to be a better way of protecting against spam-bot, although I am not myself smart enough to find one.

You could add the Yahoo! mail beta RSS reader, too.

Moreover, you could just output some more innocuous placeholder, or maybe nothing and let the browser fall back on it’s broken image link. I wouldn’t mind clicking through to your site to see the images, so long as the replacement images isn’t painful to look at.

Thanks.

Bloglines isn’t working for me, I still get the wtf pics.

“I do not think you should ever map * to the ASP.NET handler. Stated another way: I think this is a really bad idea.”

Is there a particular reason for this? With ASP.NET 2.0 and IIS 6 the ASP.NET handler is designed to be usable in this way and can pass back requests to IIS (so, for example, you can use Forms Authentication to protect ALL resources on your website (such as images) and not just aspx/ascx/etc. files).

I don’t really know much about URL rewriting, but have been looking into it for a web app I’m working on and would appreciate any input. I was going to do a wildcard mapping to the ASP.NET handler, but will have another look if this is not a good idea.

re: bloglines, the issue is not having www. as Jeff’s rewrite (all of the) require www.bloglines.com. We’ll need to rewrite the rewrites. :slight_smile:

This kind of things works, BTW, re the www. or no www. thing. Fixed my bloglines and yahoo mail problems.

(www.)?netvibes.com

I think I’m going to go with (anything.)domain.com … for all the whitelisted domains. I just haven’t had a chance to update the rules yet. But I will!

I was going to do a wildcard mapping to the ASP.NET handler, but will have another look if this is not a good idea.

For one thing, this doesn’t work for folders, eg, http://mywebsite.com/myfolder/

It’s also unnecessary overhead for serving up basic files like CSS and images.

Hi! Is it possible to add livejournal.com to the whitelist? I have your blog syndicated with the RSS feed to my friends page…

Scott Hanselman: Oh! Finally I know what happened - at the beginning of April I though that somebody hacked your blog :slight_smile:

Um, so far when viewing from google reader, I still get WTFs.

I see that google.com is whitelisted, but as I am in canada, I use google.ca

Can you please whitelist that one as well? (And I guess for other international users you may have to google.co.uk, google.??)

-greg