News for hackers. Stuff that matters.

A comment on Tell HN: Downvotes and Upvotes. Parent comment

Re:Tell HN: Downvotes and Upvotes by bikamonki on Tuesday December 13, 2016 @12:09AM (#13164626)
Maybe read/click count is hackable (bots?) and there is plenty of motivation to taint the system (new products would love to make it to the top of HN). Humans up/down voting seems fairer, no?
[ Parent | on HN ]
Re:Tell HN: Downvotes and Upvotes by dvdhnt on Tuesday December 13, 2016 @03:03PM (#13170398)
You're absolutely right. I was thinking about that while posting my original comment. I wonder if you can ensure that "read/click" is only incremented if the appropriate cookie is present.

That, too, I'm assuming is hackable. Then again, up/down seems as hackable. I mean, the link click is just calling a handler:

<a id="up_13164626" onclick="return vote(event, this, &quot;up&quot;)" href="vote?id=13164626&amp;how=up&amp;auth=08cc6438787bda18f8904afcf50af38e31d34824&amp;goto=reply%3Fgoto%3Dthreads%3Fid%3Ddvdhnt%2313164626%26id%3D13164626#13164626"><div class="votearrow" title="upvote"></div></a>

Perhaps the auth attribute is a random CSRF token, while the end of the href appears to be this comments URL. It seems like we could use the same idea, hijacking the navigation event on the link itself, applying a CSRF/auth token, and incrementing the read/click count. Seems like this would basically be the kind of granular auth allowed by service like Google Docs.

Just spitballing.

[ Parent | on HN ]