We had a call from a client the other day regarding the e-commerce site we’re developing for them. They had a query about the page that shows all the top levels of product categories, and the conversation went something like this —
Client: Are you going to put product thumbnails for each of the main categories on that top-level page?
Us: Er, yes, we did about two weeks ago…
Client: Well I can’t see them….
[We quickly fire up IE to check]
Us: They’re definitely there….
The client sent us a screenshot, and sure enough, no images. So after making sure it wasn’t a caching issue, we asked them to view source on the page. Instead of having a couple of dozen divs, each containing a heading and a thumbnail image, all they were getting were the divs and headings, with no sign of the HTML for the images. Weird.
Clearly something was blocking out those thumbnails at their end, but leaving all the other images in place. When we asked about their firewall, they told us they were using Norton Internet Security. It was the only possible explanation, but why was it filtering out those particular images? Neither the image markup nor the URLs they were linking to contained any suspicious words (e.g. banner, ad, cgi, popup etc.) or any javascript/Active X, and the thumbnails were all being loaded from a directory on the same server. What could it possibly object to?
After a quick Google I discovered the answer: Norton thought they were adverts, and blocked them automatically. Now being one of the largest security software companies, you’d think that Symantec/Norton would have developed some complex algorithm for recognising adverts. But no, this sophisticated software blocked images based purely on their dimensions. Because our product thumbnails were 180px high by 150px wide, Norton removed them from the markup altogether, without alerting the user that it had done so.
It turns out that with ad-blocking turned on (the default setting), Norton will block any images that match some dimensions commonly used by adverts. The blacklisted dimensions seem to be:
- 120 x 240
- 120 x 90
- 468 x 60
- 234 x 60
- 120 x 60
- 125 x 125
- 180 x 150
In the end I had two options to get round Norton’s idiocy — resize the existing thumbnails by a pixel or two and modify the CMS so that any images added by the client would be OK, or change the way the CMS output the HTML for the thumbnails. I opted for the latter:
<img src="foo.jpg" alt="bar" height="180" width="150" />
became:
<img src="foo.jpg" alt="bar" style="height: 180px width: 150px" />
Not particularly elegant, but as soon as I did it, the client was able to see the images again.
I don’t have anything against people blocking adverts (I’ve done so myself using the hosts file), but really I think it should be done at the request of the users, on a per-domain basis. If a piece of software is going to blanket ban any image that it thinks is an advert, then surely it should make that decision based on something more concrete than the its dimensions. I wouldn’t trust any program that stupid to look after my security.
Norton Internet Security quick capsule review: piece of shit.