Framebreaking without JavaScript?

[Andrew Heenan]

Re: Framebreaking without JavaScript?

"Scott Bryce" <sbryce@scottbr yce.comwrote...

... I have had to deal with the same issue. I simply
used JavaScript to break out of the frame. That changes the "hostile"
site to a site that is providing a link to yours. And the user doesn't
have to get caught in the crossfire.
The user doesn't need to know about the other site framing your site.
... Otherwise you are punishing the user unnecessarily.

I agree.

While this was posted as a problem seeking a techie solution, the real
problem seems to have been copyright theft, for which there are various
effective non-technical remedies, none of which need concern your visitors.

I accept that 'preventing recurrence' might justify a technical discussion,
but the problem in the OP account was about copyright theft.

As a temporary solution the js one is ideal; while it may miss a few non-js
users (who ARE these people, and who decided they must always be pandered
to? Only asking!), it will more than compensate by bringing the
thief-site's visitors to YOUR site.

Be grateful ;o)


--

Andrew
seo2seo.com
sick-site-syndrome.com

UK Residents:
STOP THE "10p Tax Ripoff"
Sign the petition to stop the government stealing from the
very poorest tell your friends about this petition:

http://petitions.pm.gov.uk/10penceband/

[Dylan Parry]

Re: Framebreaking without JavaScript?

Stan Brown wrote:

Not only do you not know how to quote correctly, but you don't
understand percentages very well. 5% or more[1] can hardly be
described as "very, very few".
>
[1] http://www.w3schools.com/browsers/browsers_stats.asp

All that shows is that 5% of visitors to that site had Javascript
disabled. Do I need to remind you that close to 100%[1] of visitors were
probably attempting to make their own websites, therefore having some
technical abilities, and not being at all representative of the average
user?

____
[1] It won't be 100% as some visitors will have no doubt got there by
accident.

--
Dylan Parry
http://electricfreedom.org | http://webpageworkshop.co.uk

The opinions stated above are not necessarily representative of
those of my cats. All opinions expressed are entirely your own.

[Mark Goodge]

Re: Framebreaking without JavaScript?

[follow-ups set to the relevent newsgroups in the crosspost, since
this isn't an HTML issue]

On 03 Aug 2008 00:00:00 GMT, WebFoot put finger to keyboard and typed:

>
>
>GOAL:
>Break out of a hostile frame.
>
>IDEAL SOLUTION:
>My page loads unframed.
>
>OK SOLUTION:
>Framing site displays blank page
>or 404 error inside the frame
>
>NOT LOOKING FOR:
>JavaScript solution -- some visitors
>don't have JavaScript enabled
>
>NOT LOOKING FOR:
>Link with target="_top" solution -- it does not
>work unless someone clicks on that link.
>
>NOT LOOKING FOR:
>Meta refresh with target="_top" solution -- the
>refreshing screws up the back button for the user,
>and search engines don't like it.
>
>NOT LOOKING FOR:
>A way to ban specific sites that frame my page. I want
>to stop all sites from doing it rather than constantly
>checking logs and adding new bans.
>
>NOT LOOKING FOR:
>Any "answers" that totally ignore what I wrote above.

In that case, you are

NOT LOOKING FOR:

Any solution which is both reliable and simple to implement.

As John Bokma has already suggested, one technical solution which
meets all of your requirements would be to check the referrer of every
visitor to your site and fetch the referring page, parse it and then
refresh your page if it's in a frame in the referring page. But this
isn't a trivial programming task, and your approach to this question
so far suggests that it's probably beyond your current skillset. And
even this isn't 100% reliable, since some visiters will have referrer
logging disabled and hence you won't be able to check the referring
page (although this will be a considerably smaller proportion than
those without Javascript, so you might be happy to live with it).

Depending on how close to 100% reliability you want, and how willing
you are to compromise on some of your other criteria, there are a
variety of options which could be extremely successful. But a lot
depends on why you want a frame-breaker in the first place. There
aren't really all that many sites which use frames in an abusive way
(and I don't include search engines which frame pages in a preview
window, such as Google Image Search, as abusive - block them from
framing you and you probably block the traffic from them as well,
which isn't what you want).

So, rather than telling us what you want to acheive, it would probably
be more helpful if you explained *why* you want to acheive it - what
problems are framing sites causing you at the moment, and what do you
want to avoid by breaking out of the frames?

Mark

[Guy Macon]

Re: Framebreaking without JavaScript?




John Bokma wrote:

>
>"nully" <nully@nully.nu llywrote:
>

>"Guy Macon" <http://www.GuyMacon.co m/wrote...

>

>>There already exists a program that watches the
>>incoming requests and looks for web spiders that
>>ignore robots.txt and denies them access, all without
>>any human intervention.

>>
>There is?

Yes. http://danielwebb.us/software/bot-trap/

>It's not that hard to write such a program and blacklist their IP
>addresses. However, it will catch only some bad bots since it's also
>possible to make a bot that acts like a user.

Indeed it is. For example, Bot Trap places a tiny image link
on the page and has a robots.txt directive to avoid it. humans
won't see the link and thus will avoid it, good robots will obey
robots.txt and thus will avoid it, bad robots will follow the
link and get banned. Clearly a Bot-Trap-Aware bad robot would
avoid it as well.


--
Guy Macon
<http://www.GuyMacon.co m/>

[Mark Goodge]

Re: Framebreaking without JavaScript?

On Tue, 05 Aug 2008 04:50:57 +0000, Guy Macon
<http://www.GuyMacon.co m/put finger to keyboard and typed:

>
>
>
>John Bokma wrote:

>>
>>"nully" <nully@nully.nu llywrote:
>>

>>"Guy Macon" <http://www.GuyMacon.co m/wrote...

>>

>>>There already exists a program that watches the
>>>incoming requests and looks for web spiders that
>>>ignore robots.txt and denies them access, all without
>>>any human intervention.
>>>
>>There is?

>
>Yes. http://danielwebb.us/software/bot-trap/
>

>>It's not that hard to write such a program and blacklist their IP
>>addresses. However, it will catch only some bad bots since it's also
>>possible to make a bot that acts like a user.

>
>Indeed it is. For example, Bot Trap places a tiny image link
>on the page and has a robots.txt directive to avoid it. humans
>won't see the link and thus will avoid it, good robots will obey
>robots.txt and thus will avoid it, bad robots will follow the
>link and get banned. Clearly a Bot-Trap-Aware bad robot would
>avoid it as well.

The other thing that will ignore robots.txt and follow the link anyway
is any kind of pre-fetching web accelerator, since the point of these
is to pre-fetch anything linked from the page in case the human user
clicks on the link. It can't tell the difference between a link that
is intended to be followed and one that isn't.

I'm no great fan of pre-fetching caches, since they can have
unexpected behaviour and break things in unpredictable ways, but they
have their place and, since the majority of the negative side-effects
are at the user's end, it's up to the user to decide whether to put up
with them or not. Using a bot trap which blocks such users from
viewing your pages may not, therefore, be such a good idea.

Mark

[Rick Merrill]

Re: Framebreaking without JavaScript?

Andrew Heenan wrote:

"Scott Bryce" <sbryce@scottbr yce.comwrote...

>... I have had to deal with the same issue. I simply
>used JavaScript to break out of the frame. That changes the "hostile"
>site to a site that is providing a link to yours. And the user doesn't
>have to get caught in the crossfire.
>The user doesn't need to know about the other site framing your site.
>... Otherwise you are punishing the user unnecessarily.

>
I agree.
>
While this was posted as a problem seeking a techie solution, the real
problem seems to have been copyright theft, for which there are various
effective non-technical remedies, none of which need concern your visitors.
>
I accept that 'preventing recurrence' might justify a technical discussion,
but the problem in the OP account was about copyright theft.
>
As a temporary solution the js one is ideal; while it may miss a few non-js
users (who ARE these people, and who decided they must always be pandered
to? Only asking!), it will more than compensate by bringing the
thief-site's visitors to YOUR site.
>
Be grateful ;o)
>
>

First, what IS the technical solution? (I know javascript basics)

Second, non-tech remedies require constant monitoring, which can be time
consuming, and even then may require, gack!, lawyers.

[Harlan Messinger]

Re: Framebreaking without JavaScript?

Travis Newbury wrote:

On Aug 3, 8:07 pm, Scott Bryce <sbr...@scottbr yce.comwrote:

>>Why do you care? And what the hell is a hostile website?

>He's talking abut another site putting your site into a frame on their
>site to make it appear as though your content is their content.

>
I understood that. My point is that people have an over valued
opinion of the importance or uniqueness of their content.

Even if the framing website indiscriminatel y frames all browsing done by
a user who's gotten caught in its snare, the OP surely has an interest
in keeping the framing website from deriving any benefit (such as
revenue from ads placed in another frame) from his own. It's obviously
important enough that the framing website operator is bothering to do it.

[Michael Fesser]

Re: Framebreaking without JavaScript?

..oO(WebFoot)

>GOAL:
>Break out of a hostile frame.

Use JS.

>NOT LOOKING FOR:
>JavaScript solution -- some visitors
>don't have JavaScript enabled

Doesn't matter here. The site will still work for those without JS.

Micha

[Michael Fesser]

Re: Framebreaking without JavaScript?

..oO(Andrew Heenan)

>And you reckon 5% of folk disable js? Evidence?

On my sites it usually varies between 2% and 8%.

Micha