“True Love means never giving up” – many a stalker were born from this one innocent sounding phrase.

The truth is much less pretty than the actual picture.

[cue elevator music]

Ok, good, you’re back. If you followed some of the aftermath in the comments, on Twitter, and on various media outlets and celebrity blogs around the web (including Gawker and Wil Wheaton), you can tell that Jenny obviously has a large amount of supporters who were less than pleased at Jose Douche Canoe Martinez. The outcry got just loud enough that Brandlink Communications actually started to play the wounded bird card:

Apparently Jose Martinez felt so victimized from the whole experience, he actually decided that he needed to delete his entire Twitter account (or, of course, it could be that he was trying to do the internet equivalent of burning the evidence of his douchiness).

Quick side note: if a PR company’s first instinct when they come under fire is to duck and run, and get defensive, as opposed to owning up, making it right, and the moving on, then odds are that same PR company would not hesitate to throw a client under the bus if they felt it was necessary for their own self preservation. Anyone who is researching this company with the possibility of hiring them should probably keep that in mind.

Either way, I guess Jenny didn’t realize quite how much support she would receive, so she wound up actually asking her followers to put away the pitch forks:

UPDATED: I love you people. Really. Thank you for always having my back and for being so supportive during this weirdness. Jose has apologized, and I’ve been assured by the woman in charge of the company that they are aware and are handling it the best way they know how, so let’s give them some air and let them have the chance to do that. *deep breath* – Jenny Lawson, aka TheBloggess

Ok, so, maybe Jenny is right. Maybe some of her fans did get abusive towards Jose in the process of defending her (which, btw, I did not see myself, but I am guessing not everyone was polite) and it is time for us to let cooler heads prevail. However… I also don’t think this should fall just into internet obscurity, either. People who are looking to hire this PR firm should be able to find out who it is they are dealing with, and the first line of defense when doing research on a company is, of course, Google. Currently when you do a search for [brandlink communications], someone else’s post about Brandlink and TheBloggess is #1 (as a news story though, not as a regular listing), Brandlink Communications themselves show up next (which is actually the natural #1 listing, when no news stories show), and in the natural #10 spot is Jenny herself:

(Click to enlarge)

The news piece is of course only there for a short period of time, as all news pieces should be, and the rankings Jenny’s site has currently are probably also due to what Google refers to as QDF, or Query Deserves Freshness (where a particular search might warrant different results due to topic being “hot” at the moment). However, I think that Jenny’s site should be in the top 10 when searching on that company, even after the buzz dies down… possibly even #1. Therefore, here is what I suggest, if you happen to support Jenny in this issue:

1. Write a post showing your support for Jenny about the way she was treated. Don’t attack or “bully” anyone in the post, because despite them being in the wrong here Brandlink was right, bullying people is still wrong (although calling someone a douche canoe when they actually are one is just being descriptive imo)
2. In that post, link to Jenny’s blog post about the conversation, but use the phrase [brandlink communications] as the anchor text for the actual link.
3. If you link to the post more than once, make sure that link is the first link to the post.

For those of you wondering why, it is because links are still the number one factor Google uses when determining rankings. If you want more information on it, you can Google [santorum] and do some research… just don’t click on the first link.

Do I think this is too harsh? Perhaps if they weren’t a PR company boasting W Hotels and Chase as their clients I might be more inclined to go easy on them. However, even if they weren’t big shots treating those they regard as the “little people” like shit, there is also the fact that this behavior is not new for Jose, and there is evidence of him treating people like this all the way back to early 2006. The fact that the same guy is still VP Media Director 5 1/2 years later, still behaving the same way, makes the promises from the company that is “handling it the best way they know how” somewhat hollow. So yes, with that in mind I think that a response like this is quite fitting. Vote with your links, people, as Google intended you to.

Thanks to James Cook of the TOONrefugee Cartoon Blog for the cartoon of Jason as Nixon. The image is copyrighted and may not be reproduced in any format without his permission.

WordPress is a-ok. Go Daddy is rock solid. Neither were ‘hacked,’ as some have speculated.

After an extensive investigation, we can report there was a small group of customers negatively impacted. What happened? Those users had outdated versions of the popular blogging software, set up in a particular way. – Alicia from GoDaddy

From what I have read around the web customers were being told that it was not GoDaddy’s responsibility to fix the sites, that they only offered “limited support” in situations like this, leaving people with only the option of restoring from a backup (which would often not help even in outdated WordPress hack situations, since hacks can go undetected for months) or hiring outside help to clean things up.

You can see on the support page they have set up, What’s Up with Go Daddy, WordPress, PHP Exploits and Malware? that they still claim that outdated scripts are part of the problem. Going to that page and viewing the source reveals something almost unbelievable:

(click to enlarge)

That’s right, in a classic “do as I say, not as I do” twist it seems that GoDaddy is in fact running an older version of WordPress (WordPress MU, based on the version number, which has the same security holes as regular WordPress) for their community blog that they are using to tell people to upgrade their WordPress versions.

To be fair, simply having an older version of WordPress does not mean that it is automatically insecure… the security fixes in the more recent versions may be minor and the known vulnerabilities might have been manually patched. I can’t know without actually digging deeper and looking if in fact the installation was vulnerable.

Then again… neither can GoDaddy in the case of their customers.

While Google will ban smaller websites from their search results or from AdSense on a whim, usually it takes heavier coverage for bigger players to get hit. Like, for instance, when Google Blogoscoped outed BMW for spammy doorway pages. The story spread relatively fast, and Google wound up banning BMW for a short period of time. So when someone has a “special” relationship with Google, as Jason appears to have, and keeps getting second (and third, and fourth, and fifth…) chances to clean up their act, yet continues to snub their nose in Google’s general direction, it makes one wonder. Google has to be at least somewhat concerned that someone in the mainstream media will eventually notice and start to ask why someone like Jason would continually be allowed to get away with this stuff. Considering the unfairness and lack of impartiality of letting a site like Mahalo slide while punishing so many smaller sites for lesser offenses, my guess is that Google doesn’t actually want to discuss their reasons behind ignoring it. And so, each time Google does nothing, Jason decides to push things a little more.

This time it looks like Jason has decided to go ahead and violate the rules closest to Matt Cutts heart. While the layout I am showing here will change with time, since the header contains rotating articles, currently if you go to Mahalo at the top of every page (on the non-Answers side, anyways) you will see the following block of stories that Mahalo is highlighting (usually this area contains trending or hot news items):

(Click to enlarge)

While technically speaking just by looking at them there is nothing to distinguish one of those “featured stories” from another, the one that doesn’t actually belong is the third one in, with the caption “Best Pickup Line Ever?”. The reason that one is different from all the rest is simple… it’s not a Mahalo featured story at all, and has nothing to do with anything going on in the news. It’s an ad. It is a paid link that Mahalo.com sold, one that leads to a site built to market a wine company. There is nothing visual to distinguish or disclose that as an ad, and if we view the source of the page…

(Click to enlarge)

… we can see that there is nothing machine readable (ie. nofollow attribute) to distinguish it as an ad, either.

Matt Cutts has been very, very clear on his take on sites that sell links that pass PageRank, or ones that don’t disclose that they are in fact ads: they are spamming. No if, ands, or buts about it, they deserve to get punished. In fact, he has even gone to far to state that in his view undisclosed paid links violate FTC guidelines.

So, Matt, recently you put out a call for link spam reports, including “paid links that pass PageRank”. Really, though, is there any point in reporting Mahalo to you? Are you going to actually take action, or, like you have done with Jason’s spam in the past, will you continue to simply look the other way? Any other site would be faced with a penalize/ban first, make nice nice with Google later. Hell, with the BMW site you penalized them after they cleaned it up, just to make an example. I get the strangest feeling, though, that won’t happen with Mahalo…

Can you at least say something about this issue…?

Update: in response to a comment below and a question posed by Matt Cutts about what makes me believe that this is indeed a paid link:

The Mahalo Paid Link Evidence Trail.

Ok Jason, we get it, you’re desperate. But stealing content from Wikipedia in order to replace what you deleted? Come on!

I am flipping through Mahalo.com today, just seeing if you’re keeping your word or not, when all of a sudden I notice this huge amount of pages with odd names that somehow I missed before:

http://www.mahalo.com/cgs-20625
http://www.mahalo.com/cgs-9896
http://www.mahalo.com/cp-154-526
http://www.mahalo.com/daa-1097
http://www.mahalo.com/daa-1106

These are all nothing more than content stolen from Wikipedia. Your version:

Wikipedia’s version:

You even hyperlinked the same internal linking scheme to the same topics Wikipedia does, regardless of whether or not those pages exist on Mahalo.com. How the hell can you claim this is original content when it is nothing more than cut and paste? I mean, wtf, you just claimed that Wikipedia is nothing more than a free for all a little under 3 weeks ago… does the content somehow take on some magical value after you scrape it and host in on your servers, trying to pass it off as something one of your users wrote? THIS is the “our users build it” content that you were referring to?

News flash, Jason… your users and Wikipedia’s users are not the same people. You lumped Squidoo into the same category back then as well. If I look close enough, will I find content stolen from them too?

Now, to be fair, maybe this content existed all along but was much, much less noticeable when you had all of those other pages of fluff in there, but now that you have deleted 78% of that side of Mahalo, these scraped pages are practically impossible to miss. None of the pages I looked at were actually indexed in Google, but it looks like at least 27,900 of them currently are:

(Click to enlarge)

Considering that Google only has a portion of those indexed, and that at last count there were only 128,324 pages left on that side of your site, that means that at minimum over 21% (and in all likelihood 30% – 40%) of the remaining pages on Mahalo.com are these scraped ones. Is that really what you want on your “Human Powered Search Engine”…?

There are 2 major differences between the original content and your version. 1) The original content cites the sources directly there on the page, whereas Mahalo does not, and 2) Mahalo is using each and every one of these scraped pages to automatically create 2 (and sometimes 3) additional contentless pages under the guise of questions being asked anonymously, questions that no one ever actually asked, but that are there solely for the purpose of bolstering your indexed page count in Google. The first question asked of every drug is What are the side effects of {insert drug}?:

And the second is always Where can I get {insert drug}:

I also saw a “Who makes {insert drug}” question here and there as well. These are empty questions, asked by a bot, that for the most part will never get answered (or even looked at) and were never intended to. Three plus free pages (two of them completely devoid of content) for the price of one scraped page. Jason, seriously, do you really think you are slick doing this?

By the way, a huge number of those pages are less than 100 words in length, yet none of them have the noindex tag. Regardless of of what the length is, however, it’s not what you are claiming Mahalo.com is Jason, it’s more fluff. Wikipedia already gives us those articles. You add nothing to the interwebs by copying them. In all seriousness you should just go through and delete them all.

(Click to enlarge.)

For those who can’t read it, it’s from http://twitter.com/scientology, and states:

Sorry, the profile you were trying to view has been suspended due to strange activity.

Yeah, like that’s a surprise!

I also understand that sometimes people don’t want to use their real names when having discussions on the web. Most, in fact, go by some handle or another the majority of the time. When they do they usually use it pretty much everywhere, but if they like to switch it up for some reason or another here and there, or use another when commenting on this blog, well, that’s ok too.

Every once in a while there is someone who comes along who doesn’t even want their real IP known when commenting on this blog. Not sure why, since I am actually the only one who sees anyones IP address, but hey, to each his own paranoia… right?

Things on the web can get heated. It’s a fact. This blog is called Smackdown, and whatayaknow… they get heated here as well too. Occasionally people want to post things here that might have a somewhat angry tone. In general I am even ok with that, to an extent.

And, of course, not every comment on this blog is going to come from people with above average IQ’s or tons of experience. That’s just the nature of the web. People are people, and deserve a voice regardless of education or how closely their parents were related before getting married.

However…

If you’re going to post an abusive comment towards another commenter on this blog that is off topic, has to do with a fight that started somewhere other than here, use a fake name, a fake email, hide your IP through a proxy, and post shit that on top of all that makes you simply look like you have the IQ of a turnip, then of course I will not approve your idiotic ranting comment. I have no interest in people commenting here who are abusive, pussies, and fucking morons all at the same time, tyvm.

If you feel this was directed towards you, and it makes you irate, well, then… it probably was.

Peace out, y’all.

The sites in question will occasionally give out warnings or advice to their users about not entering in their passwords except when actually on their sites, which is of course what you are supposed to make sure you are doing. The problem, however, is that the warnings hardly ever go into detail about what they actually mean by that. Most of us in the IT field, or people who use the internet frequently and have been doing so for a long time, just assume that everyone we say that to knows exactly what we are talking about. However, multiple conversations I have had with friends on the phone in the past, where I was trying to walk them through installing anti-virus (for Windows users I recommend Avast, by the way) clued me in to the fact that for many people simply saying “Make sure you are on the site you think you are” won’t be enough:

Me: Ok, type this into the address box: a – v – a – s – t – dot com. Then hit Enter.
Friend Ok, done.
Me: Good. Do you see the download link…?
Friend: No. I see… (at this point they start reciting what sounds suspiciously like search results)
Me: Wait… are you in Google? Did you type what I said into the search box?
Friend: Yeah, isn’t that what you said?
Me: No, I need you to type it into the address box, so that you don’t accidentilly click on an ad for a different product.
Friend: Oh, ok. (pause)
Friend: Where is that?

After this happening more than once I decided that a visual tutorial on how not to get hacked on Facebook might be needed.

It’s only a Facebook account, why should I care about security?

Glad you asked. While it is true that sites like Myspace and Facebook are more for entertainment and socializing than for business, and you usually aren’t doing anything extremely sensitive (like banking or dealing with medical records) on them, there are still some very solid reasons to keep your information secure:

1. Stolen Passwords mean stolen identity

While it is true that most scammers who steal your password do so in order to send out spam, there really is nothing stopping them from using it for more devious reasons instead. True, you usually don’t store your credit card info on your Facebook account, but disguising themselves as you could still be used to scam people who trust you (Your favorite grandson sent you a message on Facebook: “Grandma? I’m stuck in Houston and my phone is dead. Can you wire me some money please?”).

2. Many people re-use their passwords everywhere

This is not a good idea, but it is a reality. Most of these sites use your email address as your login. If you happen to use the same password for your email as you do for your social media accounts, then this gives the hackers access to all other accounts that you happen to have used that email for, even if you used a different password, since all they have to do is hit the Lost Password link and then log in to your email to get the new one. As a side note, the password generator I built can help with this, since it is generates easy to remember passwords, making it easier to maintain different passwords for different accounts. At the very least your email password should be unique and hard to guess, since that is in essence a master password for all of your other accounts.

3. More personal information is collected every day than many people realize

Recently there has been a fuss about the new Facebook privacy settings, and what you can and cannot make private. It is the belief that their information is private that lured many people into giving away more info than they probably had intended. If someone gains your password then it of course won’t matter what your privacy settings are, they can just browse your account (and private messages) at their leisure.

Here are some visual cues to let you know whether or not the link you clicked on is really what it seemed to be.

Look at the actual address bar to see what website you are really on.

An easy way to know where to look when looking at a web page address is to remember that the address bar is not located on the actual webpage. It is part of the browser window (Internet Explorer, Firefox, Safari, Chrome, etc.) itself. It’s located at the top, in the section that has the exact same layout and look and feel regardless of which webpage you are visiting. It is usually above any toolbars you might have installed. It is also distinct from any search boxes that a toolbar or browser may have:

(click to enlarge)

In Internet Explorer 8 the address bar looks like this:

Look at the address again… closely.

A url (or webpage address) is composed of multiple parts. The first section of the url is known as the “domain”. This section is always located between the “http://” at the beginning, and the very next forward slash (“/”) that you see. For instance, the domain you want to be on when logging into Facebook is “www.facebook.com”. The “www” portion may change, but if you see anything between the “.com” (or “.net” or “.org”, etc.) and the next slash, then the site is not what it is pretending to be:

Some other quick visual cues that might help:

Does the message really sound like your friend?

In most cases when an automated message is sent from a hacked account it is either the same message sent to everyone, or it is a small set of short messages pulled from a library. The most common are probably messages asking “is this you?” and referencing a picture or video that has supposedly been posted to the internet. In a setup like Facebook’s, where you not only see what messages are sent to you but can also view your friends other publicly posted messages, you can often tell that someone’s account has been hacked because they will start sending a series of odd or repeated messages, all containing links:

If the link was in an email from the website, does the sender’s address look right?

Not all phishing attempts are going to come from people on your friends list. Sometimes scammers will send out mass emails pretending to be from the social websites themselves. While the actual From field in an email can be faked, often times in these cases they are not forged properly. Any emails from Facebook, for instance, should actually have “@facebook.com” in the email address, and not random characters or be from Hotmail:

Are there any mistakes on the login page?

It is of course possible to make an exact perfect copy of a login page for any given site, but not all hackers bother to do so. Take a quick glance at the page before logging in. For instance, you might see an extra less-than sign, like in this fake Twitter login page, which is usually a sign of broken html somewhere:

And major social media websites are never hosted on free hosting accounts, which usually add in their own text or ads to every webpage:

And lastly, one of the biggest clues that a login page is fake…

Were you logged in before you clicked on the link?

Except in households where more than one person has an account on a particular social medial site, or in cases where you are logging in from a public (or work) computer, most people simply never bother logging out of the site. If you are reading a message someone sent you on Facebook itself, then you have to be logged into Facebook in order to read it. If the message asks you to click on a link, and the page it takes you to asks you to log into Facebook again, then something is wrong.

Hopefully these simple tips will help some of you from giving away your accounts, even temporarily, to people you would rather not give them to.