Skittish Eclipse (

foxfirefey) wrote in

no_lj_ads,
2010-03-04 14:32:00

Hijacking affiliate links

I've been given a heads up that has done some excellent sleuthing and investigation into hijacked LJ affiliate links:

What is LJ doing to my links?
What is LJ doing to my links? Part 2
What is LJ doing to my links? Part 3

Expect this post to be update through the day as I find out more and come up with a good summary.

ETA: No good summary, but I feel like I should say code got taken down, etc etc, business as usual.

Tags: ad creep, ad implementation, affiliate links, business deals

Post a new comment
Error

Anonymous comments are disabled in this journal
We will log you in after post

We will log you in after post

We will log you in after post

We will log you in after post

We will log you in after post

Anonymously

switch

LiveJournal

Facebook

Twitter

OpenId

Google

MailRu

VKontakte

Anonymously

Insert Bold

Insert Italic

Insert Underline

Insert Strikethrough

Insert Link

Insert LJ User

Insert Photo

Insert Video

Your reply will be screened

Your IP address will be recorded
Help
108 comments

March 4 2010, 22:40:06 UTC 2 years ago

Several things that were *not* intended behaviors of this script have been brought to our attention. We'll be removing it, but I'm not sure when (it requires a code push, so that timing is still being worked out).

March 4 2010, 22:44:18 UTC 2 years ago

How long has it been running? This person's post suggests quite some time--around a month.

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

phaetonschariot

2 years ago

link
Collapse
Expand
New comment

elisa_rolle

2 years ago

link
Collapse
Expand
New comment

shatterstripes

2 years ago

link
Collapse
Expand
New comment

elisa_rolle

2 years ago

link
Collapse
Expand
New comment

March 4 2010, 22:51:06 UTC 2 years ago

Can you elaborate on what things weren't intended behaviors? Specifically, was the overwriting of a user's affiliate code with LJ's (even for paid and permanent users) part of the goal?

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

shatterstripes

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

shatterstripes

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

shatterstripes

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

eriscontrol

2 years ago

link
Collapse
Expand
New comment

...and 13 more comments... from

celestineangel,

flwyd… Expand

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

raccoonteur

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

...and 5 more comments... from

eruditeviking,

jenk,

foxfirefey… Expand

elisa_rolle

March 5 2010, 13:56:16 UTC 2 years ago

Can you please at least answer to this comment:

http://community.livejournal.com/no_lj_ads/87066.html?thread=2111258#t2111258

since you are not still answering to my support request that apparently was the first to make you aware of the problem?

Thank you, Elisa Rolle

2 years ago

link
Collapse
Expand
New comment

March 4 2010, 23:21:21 UTC 2 years ago

This just blows my mind. Why in the world would they think that is okay? Definitely wondering what the original intention of the script would be.

pseudomonas

March 5 2010, 12:17:17 UTC 2 years ago

Is there a copy of the script as-was that the collective geek hive-mind can pull apart?

2 years ago

link
Collapse
Expand
New comment

pseudomonas

2 years ago

link
Collapse
Expand
New comment

March 5 2010, 00:10:01 UTC 2 years ago

Have I mentioned lately how much I love Dreamwidth :)

March 5 2010, 00:22:04 UTC 2 years ago

So, what do we need to enter into Adblock Plus to kill this thing?

March 5 2010, 00:27:12 UTC 2 years ago

http://l-stat.livejournal.com/js/pagestats/dRev.js

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

phaetonschariot

2 years ago

link
Collapse
Expand
New comment

eriscontrol

March 5 2010, 03:13:54 UTC 2 years ago

Might want to make it */dRev.js instead. Other sites serve up this tripe too.

March 5 2010, 01:45:15 UTC 2 years ago

I wonder what the Livejournal Advisory Board said about this. Does it still exist?

March 5 2010, 01:48:57 UTC 2 years ago Edited: March 5 2010, 01:49:30 UTC

A rep posted about it recently:

http://kylecassidy.livejournal.com/585577.html?format=light

And yeah, apparently the script has been gutted of all code.

Deleted comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

Deleted comment

2 years ago

link
Collapse
Expand
New comment

Deleted comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

March 5 2010, 10:35:52 UTC 2 years ago

Growl

Just when I was considering sticking the occasional blog post up here again...

As far as I understand it, there's sites that'll give you cookies if you refer people to them. (Like, "I just bought this great book at WeSellBooks.com" and this is the link...) and if you stick a number in, then WeSellBooks.com will know it's you and hand you a cookie.

LiveJournal wants a cookie, too.

So they remove your number and substitute their own. Hence, they get a cookie and you don't. So their script stole your cookie. The intended behaviour was to add their number to the list of cookie-worthy people, presumably so you wouldn't mail WeSellBooks.com going "Where's my cookie, bitch?"

They screwed up.

As I understand it, their Javascript changes the behaviour of your browser from "Follow this link", to "Follow this other link instead, modify the original slightly, then follow it." Words cannot express my loathing of this technique. For them to modify links in situ while even faking the link indicator in your browser when you hover over it, is pure and undiluted evil. Malware sites do this. Attack sites do this. And now LJ does it. Just what piece of excrement in LJ management decided this was a good idea, we'll never know.

Now all I was intending to post here was a few links to my fun and entertaining WoWfic (no link - it's up at wow_ladies if you want it). Which uses no affiliate links and is as static as HTML gets. No ads, no nothing. Terribly uncool URL with a ~ in, but that's a small price to pay for not having your stuff interfered with.

I probably still will go ahead and post weekly links, but I'll be watching them like a hawk and if I see anything strange happen, like, oh, Javascript appearing in my web pages where no Javascript should be... I'm out of here. Again. Damn it.

March 5 2010, 15:20:29 UTC 2 years ago

Re: Growl

"As far as I understand it, there's sites that'll give you cookies if you refer people to them."

"Cookie" may not be the best term for this because it has a very different technical meaning in the context of the Web. What these sites generally give you is money.

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

2 years ago

link
Collapse
Expand
New comment

March 6 2010, 05:13:39 UTC 2 years ago

Re: Growl

This.

This really nails why I don't like i. Adding something that changes the behavior of the browser WHILE covering tracks... No. That goes beyond advertising and that's not a policy that any company should be employing. Not if they expect people to trust their site enough to use it and click links provided on it.

elisa_rolle

March 5 2010, 16:50:15 UTC 2 years ago

I have a theory (and considering what happened, maybe it's neither so strange): mine was the first support request to LiveJournal

http://www.livejournal.com/support/see_request.bml?id=1046745

they were so good in making me believe that it was a spyware problem from my side (!), and maybe helped in this by a bad past experience with Amazon, that I wrote to the support center for the Amazon Associate.

I gave to them (Amazon), my Associate ID and the Associate ID "5336432744-20" of who was stealing my referral fees. Now I have no way to know the name behind "5336432744-20" and neither I have a way to see how many referral fees he is doing, but Amazon can, and he knows who "5336432744-20" is... so what if Amazon, after my request, and maybe other similar requests, noticed that suddenly "5336432744-20" was making a lot of money? and what if Amazon maybe wrote to "5336432744-20" asking why suddenly all the links of a lot of Associates were redirecting to him?

For once I don't believe that LiveJournal changed its code since we asked him to do that, I think they changed the code since, for mistake or with intention, they realized that what they were doing was not legal.

Now, I'd like from LiveJournal that they declared how many money they did in the last month (with Amazon they can know that, it's one of the report Amazon gives to the Associate) and use that money to refund the people they damaged. They know who they are, I suppose there are a lot of open support request.

March 5 2010, 22:28:16 UTC 2 years ago

Syndicated feed accounts

I read a number of bookbloggers. Many of them post affiliate links. Other bloggers post charity affiliate codes &c.

Being skint, haven't personally bought anything recently, but I'm guessing others have.

It's not just LJ users that have lost out, it's bookbloggers who's feeds are syndicated here. Some of these people won't even know of the existence of the syndication.

Explaining to some bloggers that an LJ feed is just like a Google Reader pickup is hard enough as it is, this pretty much tips it over the edge.

I cannot believe they did this without testing it to make sure it worked as advertised.

March 5 2010, 22:31:27 UTC 2 years ago

Re: Syndicated feed accounts

You're right, I didn't even think about that!

2 years ago

link
Collapse
Expand
New comment

trixieleitz

March 6 2010, 23:56:25 UTC 2 years ago

Some of the commentary I've seen has wondered if the opt-out was deliberately included as part of the present code, and therefore indicates something more sinister about it. I've finally managed to track down this and related pages, which indicate that the opt-out was there long ago.

Also, I (and probably many others) had set the opt-out way back when and forgotten about it. So those munged links would have looked fine to Support volunteers looking at the relevant requests, if they had also set and forgotten the opt-out. That would have hampered the investigation as well, especially if no-one involved knew about the hinky code.

None of which excuses the whole stinking mess, but it might go some way to clarifying a couple of details :)

March 7 2010, 00:19:39 UTC 2 years ago

Yeah, that sounds like a good explanation. I don't the Support volunteers got notified about this change to the code base, either, and it didn't show up in

changelog or anything.

March 28 2010, 18:01:47 UTC 2 years ago

I don't have the time to investigate more, but I've just noticed something new which screams "shady" to me.

I use Opera, have a permanent account. And yet, some entries that I've opened today (in paid journals) execute a script that makes the browser go through a wd.sharethis.com link (it appears in the browser's back button history) via a googleadservices.com link. (The latter appears in my browser's history.)

I've never used the "Share this!" javascript link that has replaced "tell a friend". I don't think it's right that I should be made to visit googleadservices.

I don't know if this is another case of a script doing what it wasn't supposed to, an Opera bug or what. I was hoping to enlist specialised web detectives like you for this. ;)

One possibility is that I came to those paid journals via a plus community, but now that I've blocked those sites I see this page trying to reload too (and failing because of blockages), and I can't imagine something less "plus" than this community.

March 28 2010, 20:59:17 UTC 2 years ago

I think the Share This javascript interacts badly with Opera--I've seen support requests come up about it before. I think you should report to Support, so they know what's going on at least--they haven't been able to replicate it, but you are not the only person it is happening to:

http://news.livejournal.com/123520.html?thread=81843328&format=light#t81843328

April 30 2010, 07:55:27 UTC 2 years ago

For people who are tired of LJ stunts like this

Please feel free to contact me for an Inksome journal creation code.

April 30 2010, 08:52:06 UTC 2 years ago

Re: For people who are tired of LJ stunts like this

Although prospective Inksome members should read this beforehand.

Post a new comment
108 comments

Username:		Create an Account Forgot your login or password? OpenID Google Mail.Ru VKontakte
Password:
	Remember Me
	English • Español • Deutsch • Русский…