RE: The Hazard of using 'printer friendly' functions on commercial sites

From: Thierry De Leeuw (thierry.deleeuwat_private)
Date: Mon Apr 29 2002 - 14:34:26 PDT

  • Next message: Rodrigo Barbosa: "Re: Buffer overflow or overrun?"

    Hi,
    
    A possible workaround is to check the referrer. If it is not empty (link
    sent by mail,...) or does not come from your web, just link to the normal
    page (with the ads ;-) )
    
    Just my 2 cents ;-)
    
    Regards,
    
    Thierry De Leeuw
    
    -----Original Message-----
    From: Max Kennedy [mailto:mxkennedyat_private]
    Sent: lundi 29 avril 2002 19:27
    To: vuln-devat_private
    Subject: The Hazard of using 'printer friendly' functions on commercial
    sites
    
    
    There is a problem that commercial web sites, particularly ones that serve
    news feeds need to consider.  That other commercial web sites may use
    your 'printer-friendly' feature, intended for individuals to print out
    stories
    on their printers, as a method to link to your stories while removing your
    ads.
    
    I first noticed www.worldnetdaily.com and www.drudgereport.com doing this
    to yahoo news.
    
    Both of these sites are high volume sites that make their money by linking
    to
    stories.  By adding '&printer=1"  to links, about 90% of yahoo's ads are
    removed.  This means that yahoo serves the stories, but doesn't get paid.
    
    This seems very dishonest to me, especially considering that the other sites
    are also commercial, and make their money this way.
    
    The vendor yahoo has been contacted.
    
    Suggestions: Change your TOS to explicitly cover this type of malicious
    activity and damages you might seek.  Seek out high volume sites taking
    advantage of
    your sites and send them warning letters.  Reconsider if you really need a
    printer friendly function.
    
    Max Kennedy
    



    This archive was generated by hypermail 2b30 : Mon Apr 29 2002 - 16:51:25 PDT