No, it's not OK, unless you have permission to do so from the content owner and host. It wastes resources and if it's an image meant to be seen on a page, it wastes potential conversions (+ credit) that the other site should be getting.
Eventually you may start to see scary things that can terminate your hosting plan, such as naked people in place of the image you're expecting to receive from the site you're hotlinking. Think, most hosts don't allow porn, therefore it's an efficient way to curb hotlinkers, report them, and see the site go offline. And don't ever use someone else's scripts/CSS, else this may happen, causing a similar bad experience for your users, Googlebot, etc: evil.js. Bonus: MIME spoofing that script as image could be awesome, but I don't think its possible.
So anyways, let's say you are the owner of a site being hotlinked, what do you do? In my opinion it's not a good idea to whitelist sites allowed to use owners images, unless they really know all the good guys like Google images and the social network asset domains. Instead, use a blacklist to stack em up as they break the rules. Considering the issue too is bandwidth, using an external image service will benefit the owner in case the offender (scraper) does not take the image down. So with that being said, here is an example whitelist snippet for .htaccess
that uses an example rewrite image hosted on imgur. Put it below RewriteEngine On
somewhere. Just keep stacking up TLDs you find, the subdomain doesn't matter:
RewriteCond %{HTTP_REFERER} ^http(s)?://(.+\.)?sandieezivy\.* [NC,OR]
RewriteCond %{HTTP_REFERER} ^http(s)?://(.+\.)?lineair\.* [NC,OR]
RewriteCond %{HTTP_REFERER} ^http(s)?://(.+\.)?pinsuggest\.* [NC,OR]
RewriteCond %{HTTP_REFERER} ^http(s)?://(.+\.)?wx-wfgg\.* [NC,OR]
RewriteCond %{HTTP_REFERER} ^http(s)?://(.+\.)?blogspot\.* [NC]
RewriteRule .*\.(JPE?G|jpe?g|GIF|gif|BMP|bmp|PNG|png)$ http://i.imgur.com/3avdDY5.png [L]
As you can see this color is quite eye catching. The source image should be as huge as you can make it so it's very clear in popups and things. Just put your domain in the bottom.
