14

This might not be a big problem, but say the following URL is a good Stack Overflow question:

https://stackoverflow.com/questions/78756/what-do-you-use-to-keep-notes-as-a-developer

Try this. Open a search engine, say Bing (I will explain later why I'm choosing Bing) and search for:

what do you use to keep notes as a developer

The Bing result will have a URL of:

http://www.bing.com/search?q=what+do+you+use+to+keep+notes+as+a+developer&go=&form=QBLH&qs=n&sk=&adlt=strict

The first link on the results page is that question from Stack Overflow.

Now, try searching for:

ben miller likes bananas

The Bing result URL will be:

http://www.bing.com/search?q=ben+miller+likes+bananas&go=&form=QBRE&qs=n&sk=&adlt=strict

Ben is a friend of mine who actually hates bananas.

And look what the first result is: a link to the same question on Stack Overflow.

As you can see, you can basically use Stack Overflow to manipulate URLs to get your keywords in the first results of search engines. You might wonder what the point is in that.

Say I own a commercial product. I find a relevant question on SO and create a URL with my product's name in it. I feed that URL to search engines, and post it in an answer to the question, to boost interest in my product. I guess that's not a good example, but I hope you get my point.

Another scenario: there's a good SO question about IDE x at stackoverflow.com/questions/1234567/how-to-do-something-in-ide-x. I'm a developer for IDE y. I could post links all over the Internet to stackoverflow.com/questions/1234567/cheap-viagra to hurt my competitor.

I think the site shouldn't return HTTP status 200 (OK) if a URL is incorrect. Of course, the meaning of "incorrect" can be interpreted differently in different cases.

UPDATE
I forgot to say why my example used Bing.
Google is better at dealing with these types of links. But I managed to keep the bananas URL in Google for a couple of weeks, too.
Yahoo! seems to be as vulnerable as Bing to these types of "attacks."

UPDATE

One more thought: What will happen when Google and other SE will see millions of links to SO that will contain uncensored words and bestiality?

19
  • google.de/… Oct 12, 2010 at 14:46
  • I think it's the "Feed it to the search engines..." bit that I don't get. What did you do there? Oct 12, 2010 at 14:48
  • @Bill you can give Google, Bing, Yahoo links to index, nobody guarantees you that they will index these links, but you can do that. There is a form for that. Also by "feeding" I mean post the "malicious" links on forums, guestbooks (if these still exist) and other type of sites that accept links. And the search engines will index those links and check them and see that they are valid. Oct 12, 2010 at 15:02
  • @Alex That's what I'm missing, I don't see how you can make up an SO link and have it be ranked highly just because it's on SO, the link to /123456/fake-title should have a terrible page rank versus /123456/real-title Oct 12, 2010 at 15:06
  • @Michael it works more on Bing and Yahoo. If you do type those words in these 2 search engines first results will be from SO. I agree in Google is not that easy to do that. Are you saying we shouldn't care about Bing and Yahoo? Oct 12, 2010 at 15:12
  • @Alex ...no, I said nothing even remotely like that. I said I don't understand how this is even possible. Why is that search term even finding that link? Because you mentioned it once on a personal site? What stops you from linking to google.com/whatever-text-you-want and having it get indexed really high because it's on google's site? Just the fact that that link is broken, that's the only thing that stops that from working? Oct 12, 2010 at 15:16
  • @Michael to my knowledge no search engine will index a broken link (at least at the time of indexing). So, google.com/whatever-text-you-want will not get indexed because it's a 404. However, SO.com/questions/1234567/SOMETHING_WRONG will get indexed because it returns HTTP OK. Now if the link would be SO.com/questions?id=1234567&title=SOME_TITLE - I don't think SOME_TITLE will get indexed since it's a parameter, and not part of the path. And I am not suggesting doing that :) Oct 12, 2010 at 15:20
  • @Alex It sounds really broken that search engines find one link to stackoverflow.com/questions/123456/fake-title and rank it #1 in searches for "fake title" because it happens to be on SO, but if that's how it is then I at least understand how this is possible now. I'm still not sure how you could use this to do anything malicious though, if I get a random SO post ranked number 1 in searches for "XYZ is the worst thing ever", what does that actually accomplish? Oct 12, 2010 at 15:22
  • @Michael from what I know Google and other SE like when a site is domain specific. For instance SO is about programming. If all of a sudden the SO team decides to switch to candy Q&A their ranks on programming questions might go down. This is just from my limited knowledge on SEO. So in this example it could hurt SO, if all of a sudden Google, Bing and Yahoo will index links to SO that have candy links. Another example would be having tons of links that contain uncensored words or bestiality. Oct 12, 2010 at 15:28
  • 1
    And look what the first result is: a link to the same question on Stack Overflow. I don't see that...
    – Arjan
    Oct 12, 2010 at 18:09
  • @Arjan what is the first link you get in resuts? Oct 12, 2010 at 18:28
  • 1
    I'm getting links to Facebook, blogs, more Facebook, but taking a better look: there's indeed that modified Stack Overflow link halfway on the 2nd page, referring to http://stackoverflow.com/questions/78756/ben-miller-is-a-developer-that-likes-bananas-and-notes. (So, maybe add that explanation in your question? Keeps folks from guessing what you tried here...)
    – Arjan
    Oct 12, 2010 at 19:35
  • @Arjan, interesting, I do see it as the first result. Have you customised Bing in some way?
    – Pops
    Oct 12, 2010 at 19:44
  • 1
    @Arjan - looks like Bing definitely has country-specific indexes. interesting. The SO question is not even in the results in Bing for me when I click the link in the OP (here in Australia) - I checked to about page 10. BUT, if I click on "Go to Bing in the United States", it is indeed 1st result.
    – Jon
    Oct 13, 2010 at 0:27
  • 1
    The irony of it all: searching 'ben miller likes bananas' on Google or Bing takes you to this page now.
    – nneonneo
    Mar 10, 2013 at 15:12

4 Answers 4

22

This is already handled through the canonical link in the header.

<link rel="canonical" href="http://meta.stackexchange.com/questions/67383/could-stack-overflow-be-damaged-by-url-poisoning">

So even if you link it as

http://meta.stackexchange.com/questions/67383/welbog-loves-justin-bieber

the HTML itself tells you what the canonical form is.

Edit: we now 301 redirect to the canonical form of both user pages and question pages.

9
  • 13
    +1 for welbog-loves-justin-bieber Oct 12, 2010 at 21:44
  • 2
    Who's Justin Bieber?
    – user138231
    Oct 12, 2010 at 22:27
  • 4
    @BalusC a girl from america with a high squeaky voice disguised as a teenage boy with no testicles... youtube.com/watch?v=kffacxfA7G4&ob=av3e Oct 12, 2010 at 23:35
  • @Jeff I assume Google is the only one looking at this tag? Oct 13, 2010 at 2:13
  • 7
    @Crazy: that's one of the moments I think I'm happy to be deaf.
    – user138231
    Oct 13, 2010 at 2:42
  • Really, who doesn't love Justin Bieber?
    – Welbog
    Oct 16, 2010 at 12:31
  • Why the change? Why redirect? Your initial answer stated as if nothing needs to be change since it's taken care of already. Mar 15, 2011 at 17:53
  • If the 301 redirect wasn't enabled, some would just complain for it to be done. So, it's a proactive change @ale
    – random
    Mar 16, 2011 at 21:39
  • 3
    @random we had suspicion that some of the scrapers were INTENTIONALLY backlinking to different forms of our URLs to diffuse pagerank. So now we force them all to point the same place.. Mar 16, 2011 at 22:27
7

I'm not really following your example of how people could use this to do anything remotely useful, but we definitely don't want to reject URLs with a valid question ID but the wrong title, because now editing the title of a question breaks all links to it, and renaming questions happens all the time

6
  • 1
    I don't understand why the title is included in the URL anyway, we got [linkification](after.all) Oct 12, 2010 at 14:48
  • As I said the example isn't the best. What if I generate 1 billion links that contain the word Viagra and other nasty things related to SO? Don't you think search engines will lower the rank? Oct 12, 2010 at 14:48
  • 3
    @Alex: No-one cares, if Bing lowers the rank. Oct 12, 2010 at 14:51
  • 2
    @Alex, so you're afraid of, say, an IDE maker seeing SO.com/questions/12345/this-is-about-my-competitor and posting links on his website to SO.com/questions/12345/cheap-viagra?
    – Pops
    Oct 12, 2010 at 14:54
  • @Ladybug Killer I understand, and so far this hasn't been a problem, I agree. But, you can get Google to index these types of links if you really want. With many many links linking to these ones. Oct 12, 2010 at 14:55
  • @Popular Yes, sort of. It's a bad example, but bad people can come up with ingenious ideas how to exploit this. Oct 12, 2010 at 15:03
4

Like Michael Mrozek, I don't see how this is an issue... but if we're concerned, maybe the solution is an automatic 301 Moved Permanently redirect if the URL's SEO keywords don't match the current title? That way inbound links are not broken when the title changes, and incorrect links like the ones above will be purged from existence...

TO clarify what I'm thinking is some logic in the SO engine which, after extracting the question ID from the URL and pulling up the question details from the database, recalculates the URL SEO title portion (what-do-you-use-to-keep-notes-as-a-developer in the above example) and compares to the actual URL being requested, and issues a HTTP/1.1 301 Moved Permanently header if they don't match.

4
  • This could be something for discussion. I was thinking of something more drastically like return 404, but as somebody mentioned the title of the question changes and I guess and 301 would be better. Oct 12, 2010 at 15:48
  • +1 This seems to be the right approach.
    – user150068
    Oct 12, 2010 at 17:02
  • @Alexandru: But it's not "not found". It is found, just the URL isn't right. So a 404 is definitely incorrect. Oct 12, 2010 at 19:30
  • Slightly related: it is doing some redirects when the question id is actually the id of an answer. Like here, where I've replace the id of the question with the id of this very answer: meta.stackexchange.com/questions/67395/… Sounds like this solution fits in very well!
    – Arjan
    Oct 12, 2010 at 20:57
1

I don't know when this was introduced (surely before January 9th 2011), but since quite some time a slug matching redirect is done if needed, to fix the URL. I guess that fixes this?

(As an aside: this also tells people who cannot access some URL what the title of a page is, as one first gets a 301 Moved, followed by a 404 Not Found.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .