No Linking To Japanese Newspaper Without Permission 134
stovicek writes with this excerpt from Ars Technica about the Japanese newspaper Nihon Keizai Shimbun, or Nikkei (English language site, so far apparently unaffected): "Nikkei has taken efforts to preserve its paywall to absurd new levels: anyone wanting to link to the site must submit a formal application. [...] The New York Times, which reported on the new policy on Thursday, notes that the newspaper market in Japan is radically different from that in the US. Although some smaller outlets are experimenting with new ways of reaching readers, most papers require subscriptions to access online content, and the barriers have kept circulation of print editions quite high compared to the US. Nikkei management appears worried that links could provide secret passages to content that should be safely behind the paywall, and this fear has led to the new approval policy."
Re:The difference is quality (Score:2, Informative)
No, try explaining it to them without describing it as "retarded". See how many will say, "Yeah, that makes sense. Only paying users should have access."
If you explain it with a certain bias, you'll find them agreeing with you, whether they hold that opinion or not.
Re:Let's write out the pseudocode... (Score:5, Informative)
There's a bigger bug than that: you can't trust the referrer. It's completely controlled by the browser, not the page the link was on. Users can easily set the referrer to any string they wish, e.g. with the RefControl extension for Firefox, which will happily set it to the address of the current page—or the home page of the site—by default.
If you really want to know whether the user is authorized to view a page you need to track their session, either with (secure) cookies or (secure) URL parameters. Better yet, use standard Digest authentication and let the browser take care of the credentials. The referrer string has no place in a proper authentication protocol.
Re:Nature of the beast (Score:4, Informative)
You are free to hyprerlink to it, but the server itself is free to ignore or block your request. Their site, their rules.
This should be a non-existent story. Site wants users to pay for viewing it - site blocks unlogged users from viewing content. Why would anyone want to prevent linking to the site if it's behind a paywall already? Even crappy porn sites are confident enough in their protection system that they allow anyone to link to any part of the site. They just redirect you to the "Please pay" page and are happy you came over from a random link.
Re:Let's write out the pseudocode... (Score:3, Informative)
Better yet, use standard Digest authentication
There is one downside of Digest authentication compared to Basic authentication over SSL. Since Digest authentication generates a random salt which is hashed together with the password and sent to the server, the server must keep the password in plaintext in its user database. With Basic authentication, the password can be stored as a hash on the server, and with SSL the security issue with Basic authentication goes away.
Not about technology. (Score:5, Informative)
Nikkei has had many many failed internet ventures, and this is just another one of their bad ideas that passed through their over-aged internet-illiterate bureaucracy.
I suspect this is more about politics within the market and about them preparing to strong arm those they think can be strong armed... It isn't like they're going to put up a notice, and sue all the referrers.
In the old days, a ton of Japanese web sites would have "link free" or "links not permitted" notices on their sites. For some reason, many felt the web was linked with permission, and that they had a say. As if anyone could do anything about outside links, when I would tell them the internet was all about free linking, and that you wouldn't put pages up that you didn't want linked in the first place, people would seem to get the idea...
This Nikkei thing is not about individuals linking to news articles. There site is practically unlinkable because they keep deleting stuff anyway.
Re:Let's write out the pseudocode... (Score:3, Informative)
If (RefererURL is Authorized) then {show content} else { make your site look bad}.
There is simply no point in hardcoding a special exception rather than handling it all in "is Authorized".
Re:Let's write out the pseudocode... (Score:3, Informative)
Not quite. Digest is calculated using hash from concatenation of username realm & passwd.
request-digest = See below for the definitions for A1 and A2.
3.2.2.2 A1 If the "algorithm" directive's value is "MD5" or is unspecified, then A1 is:
A1 = unq(username-value) ":" unq(realm-value) ":" passwd
So you can store A1 hash and forget the username & password.
see RFC 2617 for details.