Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Please choose ONE of the following:

1. One or more developers working full-time on fixing bugs and working on new projects/features

2. One or more developers working full-time updating Class and ID names and staying on top of the latest Plugins and Greasemonkey Scripts...

No, seriously - make a choice.



Why not just make the check on the back end, if the article content never gets sent then this kind of stuff doesn't need to be an issue.


Can't upvote this enough. If you want to protect content, make the checks server-side. Security must be server-side first, no exceptions. Doing anything else is asking for tech savy people with debuggers (or "view source" in this case) working around it.

You can get into a race with your users renaming javascript variables or changing CSS classes, or implementing the most advanced javascript obfuscator that exists today, but this is a waste of time.


This is a lame false dichotomy.

This is such an easy exploit that the developers must have known about it, and consciously decided to ship with a vulnerability.

As others have suggested, they probably realized that those who break the paywall probably wouldn't have paid anyway.


You are right and I apologize.

There are any number of ways to get around it. Thats a known, regardless of what you do.

Rather than expend time and resources locking this up as much as possible its accepted that X number of people will do whatever they want.

What is a little frustrating is people thinking they've totally hacked the NYT subscription model and subverted our cleverly crafted lock-down methods.

However, its been stated publicly at several pay grades above me, that is there is an organized concerted effort to work-around the subscription then we have to act on that. Not just in a legal way, but also by developers working to lock-down the site more and more.

As I said, I'd rather work on constructive projects instead of that.

It is easy for anyone who knows how to View Source to get to the content. I just wish they'd stop thinking they're all l33t and subversive when its just a little sad (to me at least).

I think I'd ultimately feel better if I just ignored this stuff.


Come on, this has nothing to do with "expending time". It's about SEO. Otherwise they would take the minimal effort to serve a different page to people above the threshold.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: