What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 133 Stack Exchange communities.

This might not be a big problem, but say the following URL is a good Stack Overflow question:

http://stackoverflow.com/questions/78756/what-do-you-use-to-keep-notes-as-a-developer

Try this. Open a search engine, say Bing (I will explain later why I'm choosing Bing) and search for:

what do you use to keep notes as a developer

The Bing result will have a URL of:

http://www.bing.com/search?q=what+do+you+use+to+keep+notes+as+a+developer&go=&form=QBLH&qs=n&sk=&adlt=strict

The first link on the results page is that question from Stack Overflow.

Now, try searching for:

ben miller likes bananas

The Bing result URL will be:

http://www.bing.com/search?q=ben+miller+likes+bananas&go=&form=QBRE&qs=n&sk=&adlt=strict

Ben is a friend of mine who actually hates bananas.

And look what the first result is: a link to the same question on Stack Overflow.

As you can see, you can basically use Stack Overflow to manipulate URLs to get your keywords in the first results of search engines. You might wonder what the point is in that.

Say I own a commercial product. I find a relevant question on SO and create a URL with my product's name in it. I feed that URL to search engines, and post it in an answer to the question, to boost interest in my product. I guess that's not a good example, but I hope you get my point.

Another scenario: there's a good SO question about IDE x at stackoverflow.com/questions/1234567/how-to-do-something-in-ide-x. I'm a developer for IDE y. I could post links all over the Internet to stackoverflow.com/questions/1234567/cheap-viagra to hurt my competitor.

I think the site shouldn't return HTTP status 200 (OK) if a URL is incorrect. Of course, the meaning of "incorrect" can be interpreted differently in different cases.

UPDATE
I forgot to say why my example used Bing.
Google is better at dealing with these types of links. But I managed to keep the bananas URL in Google for a couple of weeks, too.
Yahoo! seems to be as vulnerable as Bing to these types of "attacks."

UPDATE

One more thought: What will happen when Google and other SE will see millions of links to SO that will contain uncensored words and bestiality?

share|improve this question
    
google.de/… –  Ladybug Killer Oct 12 '10 at 14:46
    
I think it's the "Feed it to the search engines..." bit that I don't get. What did you do there? –  Bill the Lizard Oct 12 '10 at 14:48
    
@Bill you can give Google, Bing, Yahoo links to index, nobody guarantees you that they will index these links, but you can do that. There is a form for that. Also by "feeding" I mean post the "malicious" links on forums, guestbooks (if these still exist) and other type of sites that accept links. And the search engines will index those links and check them and see that they are valid. –  Alexandru Luchian Oct 12 '10 at 15:02
    
@Alex That's what I'm missing, I don't see how you can make up an SO link and have it be ranked highly just because it's on SO, the link to /123456/fake-title should have a terrible page rank versus /123456/real-title –  Michael Mrozek Oct 12 '10 at 15:06
    
@Michael it works more on Bing and Yahoo. If you do type those words in these 2 search engines first results will be from SO. I agree in Google is not that easy to do that. Are you saying we shouldn't care about Bing and Yahoo? –  Alexandru Luchian Oct 12 '10 at 15:12
    
@Alex ...no, I said nothing even remotely like that. I said I don't understand how this is even possible. Why is that search term even finding that link? Because you mentioned it once on a personal site? What stops you from linking to google.com/whatever-text-you-want and having it get indexed really high because it's on google's site? Just the fact that that link is broken, that's the only thing that stops that from working? –  Michael Mrozek Oct 12 '10 at 15:16
    
@Michael to my knowledge no search engine will index a broken link (at least at the time of indexing). So, google.com/whatever-text-you-want will not get indexed because it's a 404. However, SO.com/questions/1234567/SOMETHING_WRONG will get indexed because it returns HTTP OK. Now if the link would be SO.com/questions?id=1234567&title=SOME_TITLE - I don't think SOME_TITLE will get indexed since it's a parameter, and not part of the path. And I am not suggesting doing that :) –  Alexandru Luchian Oct 12 '10 at 15:20
    
@Alex It sounds really broken that search engines find one link to stackoverflow.com/questions/123456/fake-title and rank it #1 in searches for "fake title" because it happens to be on SO, but if that's how it is then I at least understand how this is possible now. I'm still not sure how you could use this to do anything malicious though, if I get a random SO post ranked number 1 in searches for "XYZ is the worst thing ever", what does that actually accomplish? –  Michael Mrozek Oct 12 '10 at 15:22
    
@Michael from what I know Google and other SE like when a site is domain specific. For instance SO is about programming. If all of a sudden the SO team decides to switch to candy Q&A their ranks on programming questions might go down. This is just from my limited knowledge on SEO. So in this example it could hurt SO, if all of a sudden Google, Bing and Yahoo will index links to SO that have candy links. Another example would be having tons of links that contain uncensored words or bestiality. –  Alexandru Luchian Oct 12 '10 at 15:28
1  
And look what the first result is: a link to the same question on Stack Overflow. I don't see that... –  Arjan Oct 12 '10 at 18:09
    
@Arjan what is the first link you get in resuts? –  Alexandru Luchian Oct 12 '10 at 18:28
1  
I'm getting links to Facebook, blogs, more Facebook, but taking a better look: there's indeed that modified Stack Overflow link halfway on the 2nd page, referring to http://stackoverflow.com/questions/78756/ben-miller-is-a-developer-that-likes-b‌​ananas-and-notes. (So, maybe add that explanation in your question? Keeps folks from guessing what you tried here...) –  Arjan Oct 12 '10 at 19:35
    
@Arjan, interesting, I do see it as the first result. Have you customised Bing in some way? –  Pops Oct 12 '10 at 19:44
1  
@Arjan - looks like Bing definitely has country-specific indexes. interesting. The SO question is not even in the results in Bing for me when I click the link in the OP (here in Australia) - I checked to about page 10. BUT, if I click on "Go to Bing in the United States", it is indeed 1st result. –  Jon Oct 13 '10 at 0:27
1  
The irony of it all: searching 'ben miller likes bananas' on Google or Bing takes you to this page now. –  nneonneo Mar 10 '13 at 15:12

4 Answers 4

This is already handled through the canonical link in the header.

<link rel="canonical" href="http://meta.stackexchange.com/questions/67383/could-stack-overflow-be-damaged-by-url-poisoning">

So even if you link it as

http://meta.stackexchange.com/questions/67383/welbog-loves-justin-bieber

the HTML itself tells you what the canonical form is.

Edit: we now 301 redirect to the canonical form of both user pages and question pages.

share|improve this answer
12  
+1 for welbog-loves-justin-bieber –  The Unhandled Exception Oct 12 '10 at 21:44
1  
Who's Justin Bieber? –  BalusC Oct 12 '10 at 22:27
4  
@BalusC a girl from america with a high squeaky voice disguised as a teenage boy with no testicles... youtube.com/watch?v=kffacxfA7G4&ob=av3e –  Gordon Gustafson Oct 12 '10 at 23:35
    
@Jeff I assume Google is the only one looking at this tag? –  Alexandru Luchian Oct 13 '10 at 2:13
7  
@Crazy: that's one of the moments I think I'm happy to be deaf. –  BalusC Oct 13 '10 at 2:42
    
Really, who doesn't love Justin Bieber? –  XMLbog Oct 16 '10 at 12:31
    
Why the change? Why redirect? Your initial answer stated as if nothing needs to be change since it's taken care of already. –  Alexandru Luchian Mar 15 '11 at 17:53
    
If the 301 redirect wasn't enabled, some would just complain for it to be done. So, it's a proactive change @ale –  random Mar 16 '11 at 21:39
3  
@random we had suspicion that some of the scrapers were INTENTIONALLY backlinking to different forms of our URLs to diffuse pagerank. So now we force them all to point the same place.. –  Jeff Atwood Mar 16 '11 at 22:27

I'm not really following your example of how people could use this to do anything remotely useful, but we definitely don't want to reject URLs with a valid question ID but the wrong title, because now editing the title of a question breaks all links to it, and renaming questions happens all the time

share|improve this answer
1  
I don't understand why the title is included in the URL anyway, we got [linkification](after.all) –  Tobias Kienzler Oct 12 '10 at 14:48
    
As I said the example isn't the best. What if I generate 1 billion links that contain the word Viagra and other nasty things related to SO? Don't you think search engines will lower the rank? –  Alexandru Luchian Oct 12 '10 at 14:48
3  
@Alex: No-one cares, if Bing lowers the rank. –  Ladybug Killer Oct 12 '10 at 14:51
2  
@Alex, so you're afraid of, say, an IDE maker seeing SO.com/questions/12345/this-is-about-my-competitor and posting links on his website to SO.com/questions/12345/cheap-viagra? –  Pops Oct 12 '10 at 14:54
    
@Ladybug Killer I understand, and so far this hasn't been a problem, I agree. But, you can get Google to index these types of links if you really want. With many many links linking to these ones. –  Alexandru Luchian Oct 12 '10 at 14:55
    
@Popular Yes, sort of. It's a bad example, but bad people can come up with ingenious ideas how to exploit this. –  Alexandru Luchian Oct 12 '10 at 15:03

Like Michael Mrozek, I don't see how this is an issue... but if we're concerned, maybe the solution is an automatic 301 Moved Permanently redirect if the URL's SEO keywords don't match the current title? That way inbound links are not broken when the title changes, and incorrect links like the ones above will be purged from existence...

TO clarify what I'm thinking is some logic in the SO engine which, after extracting the question ID from the URL and pulling up the question details from the database, recalculates the URL SEO title portion (what-do-you-use-to-keep-notes-as-a-developer in the above example) and compares to the actual URL being requested, and issues a HTTP/1.1 301 Moved Permanently header if they don't match.

share|improve this answer
    
This could be something for discussion. I was thinking of something more drastically like return 404, but as somebody mentioned the title of the question changes and I guess and 301 would be better. –  Alexandru Luchian Oct 12 '10 at 15:48
    
+1 This seems to be the right approach. –  user150068 Oct 12 '10 at 17:02
    
@Alexandru: But it's not "not found". It is found, just the URL isn't right. So a 404 is definitely incorrect. –  The Unhandled Exception Oct 12 '10 at 19:30
    
Slightly related: it is doing some redirects when the question id is actually the id of an answer. Like here, where I've replace the id of the question with the id of this very answer: meta.stackexchange.com/questions/67395/… Sounds like this solution fits in very well! –  Arjan Oct 12 '10 at 20:57

I don't know when this was introduced (surely before January 9th 2011), but since quite some time a slug matching redirect is done if needed, to fix the URL. I guess that fixes this?

(As an aside: this also tells people who cannot access some URL what the title of a page is, as one first gets a 301 Moved, followed by a 404 Not Found.)

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .