Framebreaking without JavaScript?

Is there a reliable way for a webpage to either
break out or refuse to display when a hostile
website puts it in a frame?

I know about the JavaScript solution, but not
all visitors have JavaScript enabled.

I also know about the target="_top" solution,
but that only works if the visitor clicks on
a link.

I even know about the banning the hostile
website solution, but I was hoping for a
solution that handles all framing sites,
not just the ones I know about.

Is there some sort of php, htaccess, or
other magic that will do the trick?

Breaking out of the frame would be ideal,
but causing some sort of alternative content
-- or a 404 error -- to display in the
frame would be almost as good.


Thanks in advance.
~WebFoot

re: Framebreaking without JavaScript?

WebFoot wrote:If you know the ip address, you can use .htaccess (assuming you're using
Apache, of course).

More info in alt.apache.configuration.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

re: Framebreaking without JavaScript?

Jerry Stuckle <jstucklex@attglobal.netsez:Which part of
are you having trouble understanding?

~WebFoot

re: Framebreaking without JavaScript?

WebFoot wrote:Which part of my answer are you having trouble understanding?

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

re: Framebreaking without JavaScript?

Jerry Stuckle <jstucklex@attglobal.netsez:You are the one who seems to have comprehension
issues, not me.

I asked a question that specified "a solution that
handles all framing sites, not just the ones I know
about" (which means I *DON'T* know the ip address) and
your alleged answer started with "if you know the ip
address" (which means I *DO* know the ip address).
You ignored the question asked and gave an answer to an
entirely different question that I already said that
I have the answer to.

So, do you have an answer to the actual question asked?


GOAL:
Break out of a hostile frame.

IDEAL SOLUTION:
My page loads unframed.

OK SOLUTION:
Framing site displays blank page
or 404 error inside the frame

NOT LOOKING FOR:
JavaScript solution -- some visitors
don't have JavaScript enabled

NOT LOOKING FOR:
Link with target="_top" solution -- it does not
work unless someone clicks on that link.

NOT LOOKING FOR:
Meta refresh with target="_top" solution -- the
refreshing screws up the back button for the user,
and search engines don't like it.

NOT LOOKING FOR:
A way to ban specific sites that frame my page. I want
to stop all sites from doing it rather than constantly
checking logs and adding new bans.

NOT LOOKING FOR:
Any "answers" that totally ignore what I wrote above.

~WebFoot

re: Framebreaking without JavaScript?

On 02 Aug 2008, WebFoot <webfoot@.wrote:
There is "somewhat" of a solution using the php $_SERVER['HTTP_REFERER']
superglobal. While, as the manual states, some browsers ignore or manipulate
this, it is nevertheless statistically effective and certainly applicable to
the situation you describe. My workup doesn't satisfy your "ideal" solution
but I think it complies with your "ok" solution just fine. Using php
sessions may allow the goal to be even better satisfied, but I think sessions
have their own drawbacks.

The code should be obvious, but if it isn't, I will post my own flavor upon
request.

--
Neredbojias
http://www.neredbojias.net/
Great sights and sounds

re: Framebreaking without JavaScript?

On Aug 1, 8:00*pm, WebFoot <webfoot@.wrote:Why do you care? And what the hell is a hostile website?

--
Travis
Flash Crap: http://travisnewbury.blogspot.com

re: Framebreaking without JavaScript?

>>OK SOLUTION:Proportionately very, very few.
And a javascript solution will soon show the thief the stupidity of their
ways.

Of course, a no-technical solution - like contacting their host - will be
100% effective - with a bit of luck, the whole site will disappear.
--

Andrew
seo2seo.com
sick-site-syndrome.com

UK Residents:
STOP THE "10p Tax Ripoff"
Sign the petition to stop the government stealing from the
very poorest tell your friends about this petition:
http://petitions.pm.gov.uk/10penceband/

re: Framebreaking without JavaScript?

Travis Newbury wrote:He's talking abut another site putting your site into a frame on their
site to make it appear as though your content is their content.

Do you remember when about.com was the mining company? That is what he
is talking about.

The JavaScript solution is the best solution that I am aware of. Not
everybody has JavaScript enabled, but most do.

re: Framebreaking without JavaScript?

Sun, 3 Aug 2008 19:57:54 +0100 from Andrew Heenan <fire@will.com>:Not only do you not know how to quote correctly, but you don't
understand percentages very well. 5% or more[1] can hardly be
described as "very, very few".

[1] http://www.w3schools.com/browsers/browsers_stats.asp
Again, you seem to have trouble with percentages. "100% effective"
means a certainty, but it is by no means certain that a site will be
taken down on request.

--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA
http://OakRoadSystems.com/
HTML 4.01 spec: http://www.w3.org/TR/html401/
validator: http://validator.w3.org/
CSS 2.1 spec: http://www.w3.org/TR/CSS21/
validator: http://jigsaw.w3.org/css-validator/
Why We Won't Help You:
http://diveintomark.org/archives/200..._wont_help_you

re: Framebreaking without JavaScript?

WebFoot wrote:
I slapped together a test page for the various ways that
I found doing a web search (I will add the php method I
just read about in another post in the next few days).
None meet all of your requirements. Some of them suck
in various other ways.

Test page: http://www.guymacon.net/f0n.html

Being an engineer, I will now do what engineers do;
question the requirements. When you write "NOT
LOOKING FOR: A way to ban specific sites that frame
my page. I want to stop all sites from doing it
rather than constantly checking logs and adding new
bans." you are making the assumption that you have
to do the checking and adding. Not so. A computer
program could do it for you.

There already exists a program that watches the
incoming requests and looks for web spiders that
ignore robots.txt and denies them access, all without
any human intervention. I am pretty sure that
something like that could be done with framing sites.



--
Guy Macon
<http://www.GuyMacon.com/>

re: Framebreaking without JavaScript?

"Guy Macon" <http://www.GuyMacon.com/wrote in message
news:Y9idnZO1Z663BAvVRVn_vwA@giganews.com...There is?

re: Framebreaking without JavaScript?

"Stan Brown" <the_stan_brown@fastmail.fmwroteAnd you have trouble reading.
I didn't say that contacting a host would be a 100% effective, I said a
non-technical solution will be 100% effective.

Horses for courses; that may mean getting the host to act, it may mean going
to court ... but whereas technical solutions may be either flawed from the
start, or can be evaded at leisure, dealing with the problem non-technically
can solve it.

And you reckon 5% of folk disable js? Evidence?
--

Andrew
seo2seo.com
sick-site-syndrome.com

UK Residents:
STOP THE "10p Tax Ripoff"
Sign the petition to stop the government stealing from the
very poorest tell your friends about this petition:
http://petitions.pm.gov.uk/10penceband/

re: Framebreaking without JavaScript?

On Aug 3, 8:07*pm, Scott Bryce <sbr...@scottbryce.comwrote:I understood that. My point is that people have an over valued
opinion of the importance or uniqueness of their content. Look at how
many questions "how do I stop someone from stealing my image/code/
content/etc." show up here all the time. If your content is that
important or unique, add a byline or link to the page. The "hostile
site" will be advertising for you.
Better yet, if your javascript detects someone fraiming your page
redirect them to a page that explaines what the hostile site just
tried to do. Something of the effect

"The website you were at attempted to plagiarize information authored
by "yourwevbsite.com" Please click this link to take you to the
content's true author's website...."

THAT is a solution that will cost the hostile site users and they will
quickly stop.

--
Travis
Flash Crap: http://travisnewbury.blogspot.com

re: Framebreaking without JavaScript?

Travis Newbury wrote:I wouldn't do that. I have had to deal with the same issue. I simply
used JavaScript to break out of the frame. That changes the "hostile"
site to a site that is providing a link to yours. And the user doesn't
have to get caught in the crossfire.

The user doesn't need to know about the other site framing your site.
Just take your content back from the other site, and leave it at that. A
savvy user will figure out what is going on when he sees your site
redraw outside of the frame.

Just break out of the frame and leave it at that. Otherwise you are
punishing the user unnecessarily.

re: Framebreaking without JavaScript?

"Scott Bryce" <sbryce@scottbryce.comwrote...I agree.

While this was posted as a problem seeking a techie solution, the real
problem seems to have been copyright theft, for which there are various
effective non-technical remedies, none of which need concern your visitors.

I accept that 'preventing recurrence' might justify a technical discussion,
but the problem in the OP account was about copyright theft.

As a temporary solution the js one is ideal; while it may miss a few non-js
users (who ARE these people, and who decided they must always be pandered
to? Only asking!), it will more than compensate by bringing the
thief-site's visitors to YOUR site.

Be grateful ;o)


--

Andrew
seo2seo.com
sick-site-syndrome.com

UK Residents:
STOP THE "10p Tax Ripoff"
Sign the petition to stop the government stealing from the
very poorest tell your friends about this petition:
http://petitions.pm.gov.uk/10penceband/

re: Framebreaking without JavaScript?

Stan Brown wrote:
All that shows is that 5% of visitors to that site had Javascript
disabled. Do I need to remind you that close to 100%[1] of visitors were
probably attempting to make their own websites, therefore having some
technical abilities, and not being at all representative of the average
user?

____
[1] It won't be 100% as some visitors will have no doubt got there by
accident.

--
Dylan Parry
http://electricfreedom.org | http://webpageworkshop.co.uk

The opinions stated above are not necessarily representative of
those of my cats. All opinions expressed are entirely your own.

re: Framebreaking without JavaScript?

[follow-ups set to the relevent newsgroups in the crosspost, since
this isn't an HTML issue]

On 03 Aug 2008 00:00:00 GMT, WebFoot put finger to keyboard and typed:
In that case, you are

NOT LOOKING FOR:

Any solution which is both reliable and simple to implement.

As John Bokma has already suggested, one technical solution which
meets all of your requirements would be to check the referrer of every
visitor to your site and fetch the referring page, parse it and then
refresh your page if it's in a frame in the referring page. But this
isn't a trivial programming task, and your approach to this question
so far suggests that it's probably beyond your current skillset. And
even this isn't 100% reliable, since some visiters will have referrer
logging disabled and hence you won't be able to check the referring
page (although this will be a considerably smaller proportion than
those without Javascript, so you might be happy to live with it).

Depending on how close to 100% reliability you want, and how willing
you are to compromise on some of your other criteria, there are a
variety of options which could be extremely successful. But a lot
depends on why you want a frame-breaker in the first place. There
aren't really all that many sites which use frames in an abusive way
(and I don't include search engines which frame pages in a preview
window, such as Google Image Search, as abusive - block them from
framing you and you probably block the traffic from them as well,
which isn't what you want).

So, rather than telling us what you want to acheive, it would probably
be more helpful if you explained *why* you want to acheive it - what
problems are framing sites causing you at the moment, and what do you
want to avoid by breaking out of the frames?

Mark

re: Framebreaking without JavaScript?

John Bokma wrote:Yes. http://danielwebb.us/software/bot-trap/
Indeed it is. For example, Bot Trap places a tiny image link
on the page and has a robots.txt directive to avoid it. humans
won't see the link and thus will avoid it, good robots will obey
robots.txt and thus will avoid it, bad robots will follow the
link and get banned. Clearly a Bot-Trap-Aware bad robot would
avoid it as well.


--
Guy Macon
<http://www.GuyMacon.com/>

re: Framebreaking without JavaScript?

On Tue, 05 Aug 2008 04:50:57 +0000, Guy Macon
<http://www.GuyMacon.com/put finger to keyboard and typed:
The other thing that will ignore robots.txt and follow the link anyway
is any kind of pre-fetching web accelerator, since the point of these
is to pre-fetch anything linked from the page in case the human user
clicks on the link. It can't tell the difference between a link that
is intended to be followed and one that isn't.

I'm no great fan of pre-fetching caches, since they can have
unexpected behaviour and break things in unpredictable ways, but they
have their place and, since the majority of the negative side-effects
are at the user's end, it's up to the user to decide whether to put up
with them or not. Using a bot trap which blocks such users from
viewing your pages may not, therefore, be such a good idea.

Mark

re: Framebreaking without JavaScript?

Andrew Heenan wrote:
First, what IS the technical solution? (I know javascript basics)

Second, non-tech remedies require constant monitoring, which can be time
consuming, and even then may require, gack!, lawyers.

re: Framebreaking without JavaScript?

Travis Newbury wrote:Even if the framing website indiscriminately frames all browsing done by
a user who's gotten caught in its snare, the OP surely has an interest
in keeping the framing website from deriving any benefit (such as
revenue from ads placed in another frame) from his own. It's obviously
important enough that the framing website operator is bothering to do it.

re: Framebreaking without JavaScript?

..oO(WebFoot)
Use JS.
Doesn't matter here. The site will still work for those without JS.

Micha

re: Framebreaking without JavaScript?

..oO(Andrew Heenan)
On my sites it usually varies between 2% and 8%.

Micha