5 ms·

Honestly, it doesn't shock me in the slightest that someone who markets themselves as an SEO expert would not only do something as unethical as this, but also b

Honestly, it doesn't shock me in the slightest that someone who markets themselves as an SEO expert would not only do something as unethical as this, but also brag about it, as though they think they've done something they should be proud of.

cyrusshepard 8y ago
FWIW, Dan (the author) has an outstanding reputation for professionalism and integrity in the marketing world. If he says he did something for ethical reasons, to those who know him, he's earned the benefit to be believed. (If you don't know him, you'd be forgiven for being suspicious) And credit should be given to him for educating everyone on this exploit.
- dejanseo 8y ago
  Thank you Cyrus. I thought it would be obvious that this isn't a practical tactic a reputable brand could risk doing.
  - jimbauwens 8y ago
    While it is clear that you did not have any bad intentions, you should never have published it on the web. Based on your earlier comment "It worked a little too well" it becomes clear that multiple users were tricked by your site and that you possibly even intercepted submitted forms ("I gasped when I realised I can actually capture all form submissions and send them to my own email."). You misled people and breached their privacy. This is as simple as it gets, even if it was for an experiment (though leaving the site online in some other form still raises a lot of question marks..). My advice for you is to perform future experiments locally, not on the web and make sure people participating in your experiment are aware.
    - iscoelho 8y ago
      The point of the experiment was the social engineering aspect. The fact that it would work technologically was obvious. The fact that it would work practically was what he set out to prove.
- tomgp 8y ago
  It'd be very easy to make a proof of concept of this exploit which didn't breach copyright or record peoples personal information and then to publicise the problem immediately, instead he chose to operate on real sites, collect real personal data and then forget about it for 5 years. It's this general lax attitude that gives everyone working in the SEO sector -- and by extensions the tech sector as a whole a bad reputation. The whole experiment doesn't feel like it was conducted in good faith or with any consideration for the ethics beyond 'hey this is cool'. Grow up!
cm2012 8y ago
Is this that different than publicizing bugs? He tested it for a small amount of time, noticed a real security vulnerability (he could collect leads), and publicized his findings knowing Google would likely punish him for it. It's mildly unethical at worse, considering he could have happily done profitable leadgen at scale and it would have likely never been caught if he kept quiet.
- thedonkeycometh 8y ago
  He didn't set up a test site, he collected live users information without their consent and invaded the legitimate privacy of his competitors, stole industrial information. Then bragged about it. This blog post is most likely more of a "see, it was just a test" cover post in case the feds come in the same way a bigot professes abuse as just a joke.
- londons_explore 8y ago
  Except he would have been caught by a few of his users. If I notice a scummy page impersonating Google, I'm gonna alert Google so they can do something about it. (For example add the page to the safebrowsing list)
  - cm2012 8y ago
    Google very very rarely does anything with individual complaints sent in with their automated systems. You'd have to get a post to the top of HN.
- dejanseo 8y ago
  That's exactly right. Google has already punished me once for exposing a flaw (which they still haven't fixed): https://news.ycombinator.com/item?id=4748094 https://news.ycombinator.com/item?id=4748094
- TheForumTroll 8y ago
  "Years" "Small amount of time" ?!?
Karishmra1234 8y ago
Well, actually bragging is what makes it ethical and makes us realise how some people might be conning us. I believe he did this to educate us.
hankhill 8y ago
Likewise it doesn't surprise me that HN would downvote this comment to the bottom like the bunch of wannabe black hat SEO scammers they are.

cyrusshepard 8y ago

FWIW, Dan (the author) has an outstanding reputation for professionalism and integrity in the marketing world. If he says he did something for ethical reasons, to those who know him, he's earned the benefit to be believed. (If you don't know him, you'd be forgiven for being suspicious) And credit should be given to him for educating everyone on this exploit.

dejanseo 8y ago
Thank you Cyrus. I thought it would be obvious that this isn't a practical tactic a reputable brand could risk doing.
- jimbauwens 8y ago
  While it is clear that you did not have any bad intentions, you should never have published it on the web. Based on your earlier comment "It worked a little too well" it becomes clear that multiple users were tricked by your site and that you possibly even intercepted submitted forms ("I gasped when I realised I can actually capture all form submissions and send them to my own email."). You misled people and breached their privacy. This is as simple as it gets, even if it was for an experiment (though leaving the site online in some other form still raises a lot of question marks..). My advice for you is to perform future experiments locally, not on the web and make sure people participating in your experiment are aware.
  - iscoelho 8y ago
    The point of the experiment was the social engineering aspect. The fact that it would work technologically was obvious. The fact that it would work practically was what he set out to prove.
tomgp 8y ago
It'd be very easy to make a proof of concept of this exploit which didn't breach copyright or record peoples personal information and then to publicise the problem immediately, instead he chose to operate on real sites, collect real personal data and then forget about it for 5 years. It's this general lax attitude that gives everyone working in the SEO sector -- and by extensions the tech sector as a whole a bad reputation. The whole experiment doesn't feel like it was conducted in good faith or with any consideration for the ethics beyond 'hey this is cool'. Grow up!

cm2012 8y ago

Is this that different than publicizing bugs? He tested it for a small amount of time, noticed a real security vulnerability (he could collect leads), and publicized his findings knowing Google would likely punish him for it. It's mildly unethical at worse, considering he could have happily done profitable leadgen at scale and it would have likely never been caught if he kept quiet.

thedonkeycometh 8y ago
He didn't set up a test site, he collected live users information without their consent and invaded the legitimate privacy of his competitors, stole industrial information. Then bragged about it. This blog post is most likely more of a "see, it was just a test" cover post in case the feds come in the same way a bigot professes abuse as just a joke.
londons_explore 8y ago
Except he would have been caught by a few of his users. If I notice a scummy page impersonating Google, I'm gonna alert Google so they can do something about it. (For example add the page to the safebrowsing list)
- cm2012 8y ago
  Google very very rarely does anything with individual complaints sent in with their automated systems. You'd have to get a post to the top of HN.
dejanseo 8y ago
That's exactly right. Google has already punished me once for exposing a flaw (which they still haven't fixed): https://news.ycombinator.com/item?id=4748094 https://news.ycombinator.com/item?id=4748094
TheForumTroll 8y ago
"Years" "Small amount of time" ?!?

Karishmra1234 8y ago

Well, actually bragging is what makes it ethical and makes us realise how some people might be conning us. I believe he did this to educate us.

hankhill 8y ago

Likewise it doesn't surprise me that HN would downvote this comment to the bottom like the bunch of wannabe black hat SEO scammers they are.