11 ms·

JQuery 1.6.2 syntax error? You may be the victim of SEO.

257 points by gavingmiller 15y ago

Encosia 15y ago
In case the spirit of my post isn't clear, let me be the first to acknowledge that I wouldn't have run into this problem at all if I had been less careless. The purpose of posting this was to raise awareness and hopefully help others avoid making the same blunder (and to point some links at the correct site with good anchor text).
- masklinn 15y ago
  Interestingly, I did the exact same thing today: tried downloading jquery 1.6.2, was not careful enough, got a syntax error when I used it. Just checked, I'd gotten it from jquery.it...
- mrcharles 15y ago
  Sadly, I foresee a future where you have to whitelist everything in order to be truly safe. You got screwed over by two characters.
  - kragen 15y ago
    That's where we were pre-Google; we called the whitelist our "bookmarks".
    - jshen 15y ago
      but it can be more automated than bookmarks. One idea, imagine if your searches searched pages across all your friends bookmarks and your own. Bookmarks isn't the right term, imagine if it were really easy to say "this I validate", then everyone that trusts you will be able to search that as well.
      - kragen 15y ago
        That's a really good idea. I wonder why Delicious never did that. They had your "friends" list and all your friends' bookmarks. I'll implement it in yamemex for sure!
        jshen 15y ago
        I've wanted to build something like my idea for years, but it's not something you can do on the cheap. I've thought about focusing on some vertical to make it cheaper, but meh.
        rokekr 15y ago
        blekko.com looks to be doing something similar to what you described
        jshen 15y ago
        what are they doing?
        msbarnett 15y ago
        Basically they're letting people create "slashtags" that restrict a search to a customized list of sites. Eg) I have one for /objc that searches a half-dozen high-quality, good signal-to-noise, non-spammy objective-c related sites, so that if I search for "timers /objc" I get only quality content and no farmed spam. There's a lot more to it but they've essentially farmed out the job of whitelisting the non-spammy parts of the internet to their users. Edit: and more to the point of what you were desribing, you can easily use other people's public slashtags, and it will detect and suggest relevant ones as you use it. It's totally worth playing around with.
        jshen 15y ago
        That's very close, if they let me search my friends slash tags all at once it would be perfect.
- brown9-2 15y ago
  Honestly it seems like the majority of the article's attention is spent criticizing Google for allowing you to download a file from a site you didn't intend to, rather than warning others.
- yaakov34 15y ago
  I completely agree with the tone of your post. A spam site outranking the official site of a popular tech download is a big deal. Yes, as a web designer, you should know better, but if they can outrank jquery, they can outrank anything. Including sites meant for non-technical users. How's a non-technical user supposed to know he is making a dangerous download, if there is a nice green lock on his screen and the name of the program is familiar? How do we explain this to them?
ljlolel 15y ago
Great find. Google is really lagging behind on the game. An italian blog should never rank higher than the jQuery site. If Google loses our trust, and we have to be on our guard all of the time, ...
VMG 15y ago
No, "being in a hurry" doesn't excuse downloading and including jquery from the wrong website. He is lucky that there was a syntax error and the script didn't work, this could have turned out much uglier. Edit: the headline should be: "Everybody watch out, a fraudulent jquery website ranks higher in google than the official website". The syntax error is the best thing that could happen.
- mtogo 15y ago
  Exactly, i don't understand how he can pin this on google. Sure, it's a problem that google ranks a ripoff over the main site (as they did with SO before), but if you install jQuery from the wrong site, not once noticing the italian TLD, that's your own fault.
  - smackfu 15y ago
    Well, the Italian TLD is not really a red flag in these days of "cute" domain names. Which is the real page for BackPack? http://backpackit.com/ http://backpackit.com/ http://backpack.it/ http://backpack.it/ If the "wrong" one had the same content as the right one, would you know which one to pick?
    - foresterh 15y ago
      The website that actually works, in this case...?
  - knowtheory 15y ago
    Dude was careless, but that hardly excuses the blame the user mentality. People live in an ecosystem which bias behavior. Dude expected top ranking page to be the jquery site (invalid assumption) and presumably that if the top ranked site wasn't the jquery site, it wouldn't be spoofing the actual jquery site. Dude fell for what amounts to a phishing scam. Sure he should have been on better guard, but the circumstances definitely contributed to his user error.
    - 15y ago
chrisjsmith 15y ago
I think the blogger was being an idiot. You should check the authenticity of what you are downloading, not just snag it. It's like eating a kebab dropped in the street.
- reustle 15y ago
  It's not the same. If I type jQuery into google, click one of the top results and the site looks exactly like the jQuery site, I'd probably be fooled too. The domain is close enough to not catch out of the corner of your eye.
  - VMG 15y ago
    With the upcoming version of chrome, there won't even be a url bar. AFAIK firefox wants to get rid of it too. Now is this an argument for keeping the url bar? It's obviously error-prone, but the other methods of establishing identity don't seem to be there yet either.
    - icebraining 15y ago
      The URL bar will be there, it just won't be visible at all times, but it'll still appear when the page is loading or you select the tab.
- Tashtego 15y ago
  Whether he should have downloaded from that site or not, it's ridiculous that it was showing up above the official site in search results. That's his main point.
  - chrisjsmith 15y ago
    I think the rediculous thing is more that he spent that much time making a blog post because he made a mistake whilst obviously trying to do something quickly without thinking.
- aquark 15y ago
kristofferR 15y ago
This should be easy to sabotage/fix for the real jQuery.com guys. Since the fake .it-site hotlinks directly to the css and custom javascript from jquery.com they can add some code that will warn users that the site is a fake, automatically redirect all traffic to jquery.com with a 301, add canonical headers etc...
- masklinn 15y ago
  Then the fake site would just copy those as well.
  - SlyShy 15y ago
    That's kind of the point, is it not?
    - masklinn 15y ago
      Uh not really. Copy, not hotlink. The fake site would copy the originals (no referrer, no special sauce) and would be back to the current situation: a fake site looking exactly like the real one and ranking higher on google.
      - kristofferR 15y ago
        Well, it would work for a while since I doubt the owner of the fake site is actively monitoring it. He probably has a bunch of similar scraped sites running on autopilot. Even when(if?) he notices it, he'd have to change the operation of the bot to rewrite the links. At that point the SEO would be quite damaged by the canonical tags. If the canonical tags were added stealthily he probably wouldn't notice at all until his SEO was completely destroyed.
        rapind 15y ago
        Maybe, but if I were writing a script to scrape and clone a site I'd probably strip canonical meta tags anyways. There needs to be an international douche law to serve as a deterrent to this kind of behaviour.
eps 15y ago
In short - Beware of downloading JQuery from jquery.it, which may appear before jquery.com in related Google searches. The end.
patio11 15y ago
On the plus side: there are a lot more interesting things a spammer could do with a copy of jQuery than accidentally include a syntax error.
- VMG 15y ago
  As a side node: I did a diff and it seems that besides some newlines at the top and the text at the end the scripts jquery-1.6.2.js and and jquery-1.6.2.min.js are in fact identical. This could have changed at any time, so from a security standpoint, you could even consider the client page as being compromised.
- IgorPartola 15y ago
  Exactly. I wonder now if I need to start changing passwords for sites that use jQuery on their login pages. Good thing this did not come out as "lulzsec now has everyone's bank passwords.
tghw 15y ago
What I find incredible about this is that Google has gotten so good at returning exactly what we want that we no longer bother checking the authenticity of it, even when it's something specific. If Google was "lagging behind on the game" as some people are suggesting, this never would have happened because we wouldn't be trusting it to return what we want.
- bittermang 15y ago
  So I guess you're saying you're not feeling lucky anymore?
- hollerith 15y ago
  I would frame the situation a little differently: Google got good enough that we started to trust it for this purpose (which we might call a "brand-name lookup services") but then in the last few years, it has declined and become untrustworthy. IMHO Google is very vulnerable to competition by new brand-name lookup services.
- ams6110 15y ago
  Speak for yourself, I always make sure I'm on the vendor's/author's official site before I download code. I never download code from 3rd parties.
  - tghw 15y ago
    I'm not saying I would do this, I'm just kind of amazed that Google has gained so much trust that some people have stopped bothering.
  - ojilles 15y ago
    Genuine question: how do you do that?
    - tghw 15y ago
      Look at the domain. If I'm downloading jQuery, it should be jquery.com. If I'm not sure what the domain should be, try to get it from someone I do trust, like the Google-hosted libraries[1]. If it's from GitHub or BitBucket, try to make sure the person who owns the repo is actually the one maintaining it (so I don't get a broken copy or one with something "extra"). It's all mostly just common sense and a little bit of extra scrutiny. [1] http://code.google.com/apis/libraries/devguide.html http://code.google.com/apis/libraries/devguide.html
AlexMuir 15y ago
Not only has Google ranked the site highly, it seems to be the financier too. It looks to me that this was done just for the Adsense income. Why this was done? Here were my first few thoughts: 1. Display ad revenue. - Maybe initially, there is Adsense markup but the ads aren't showing for me so perhaps Google has disabled them. 2. Affiliate income from the links to jQuery books - I can't see an affiliate code in the links so probably not. 3. Hijacking the Donate button - No. This leads to a blank page with just a Time to Generate snippet.
mrcharles 15y ago
What worries me about this is the original intentions of the owners of jquery.it. Obviously they planned something malicious, and were setting up for it, only random chance resulted in them getting outed before they could begin deploying their actual malicious code. Frankly, had you been more careful, worse could have happened down the road. Still, I would be interested in seeing exactly how jquery.it made it to the top of the search listings.
- patio11 15y ago
  What worries me about this is the original intentions of the owners of jquery.it. Diff suggests the plan was probably "Serve adsense ads." That is the punchline to quite a bit of spam.
po 15y ago
This is also another example of why having more top level domain names will make things worse, not better.
dspillett 15y ago
There is a fairly simple heuristic that could combat this, which I assume is possible with Google's architecture (which I know little about, so I could be wrong here!): * if a page A refers to the same external css and images as page B on another site, and those external resources are local to B, then assume B is more original and should be ranked higher than A. Of course the SEO people will get around this by making sure they take copies of the css and image assets as well as the html ones once this is implemented, but at least it'll save the "target" site a little bandwidth.
- masklinn 15y ago
  > but at least it'll save the "target" site a little bandwidth. Which really is not the issue at all. Do you also suggest that people fearing home invasions paint their walls red, so the blood splatters are hidden if they get shot?
  - dspillett 15y ago
    It would also cost the scammer bandwidth. Though that is probably paid for on a stolen credit card anyway... Unfortunately the real problem Google is unable to do much about, aside from a few high-profile things (jQuery would count as high enough profile, but many similar libraries would not). How do they know, given two apparently identical chunks of content, which is the original source?
lhnn 15y ago
What if Google put subtle warnings on websites from other CC TLDs than .com, .net or the TLD you live in? Alternatively, Google could just work on spotting phishing and spam sites.
dlikhten 15y ago
HA! I started reading and researching and it just made me laugh. Guess what you get when you go to http://duckduckgo.com/?q=jquery http://duckduckgo.com/?q=jquery THATS RIGHT, an official site logo, because Gabriel is f-ing awesome and I love DDG's little almost insignificant features like showing you the official jquery website vs what you THINK the official one is, since google never helps you there. Also I have adblocking and opt-out from google's ad tracking on so I never suffer these things. But that's what makes DDG so amazing, that opt-outs don't mater Its just so clutter free. Putting things into context vs just presenting you with data. Note that in my search results I even get the nice icons indicating if the result is spam or not. That website for the fake jquery is... well its not even on first 100 search results, may be blocked. Thanks DDG, you just justified your existence yet again.
- retube 15y ago
  How is the "Official Site" authentication done?
  - jrockway 15y ago
    Manually, I would imagine.
    - dlikhten 15y ago
      That's improbable. I know Gabriel is good, but hes not god.
  - callahad 15y ago
    There are far too many "official site" links for me to think it's manual... I know DDG does deep indexing of Wikipedia, perhaps it's using the target of the "Official website" link at http://en.wikipedia.org/wiki/Jquery http://en.wikipedia.org/wiki/Jquery? Edit: Yeah, I think that's the case. These searches don't show the "Official Site" badge: http://ddg.gg/?q=jenkins+ci http://ddg.gg/?q=jenkins+ci http://ddg.gg/?q=hudson+ci http://ddg.gg/?q=hudson+ci, but these do: http://ddg.gg/?q=jenkins+software http://ddg.gg/?q=jenkins+software http://ddg.gg/?q=hudson+software http://ddg.gg/?q=hudson+software Compare those queries to the name of the wikipedia pages: http://en.wikipedia.org/wiki/Jenkins_(software) http://en.wikipedia.org/wiki/Jenkins_(software) http://en.wikipedia.org/wiki/Hudson_(software) http://en.wikipedia.org/wiki/Hudson_(software)
rsoto 15y ago
This is very weird. jQuery.it has the same PageRank as jQuery.com (8/10). This site dates back to 2007 [1] altough it started copying the jQuery site until 2009 [2]. It also has cloned the subdomains: http://dev.jquery.it/ http://dev.jquery.it/ and http://forum.jquery.it/ http://forum.jquery.it/ What this site appears to do is mirror the content of jQuery.com by copying everything and then appending the "Time to generate" string. I just checked adblock, it also adds a Google Ad, which is the point to this. Obviously Google has messed up big time, but also the whole web by linking so much a fake site that it has the same page rank as the original. 1: http://wayback.archive.org/web/20071001000000*/http://www.jquery.it/ http://wayback.archive.org/web/20071001000000*/http://www.jq... 2: http://wayback.archive.org/web/20090601000000*/http://www.jquery.it/ http://wayback.archive.org/web/20090601000000*/http://www.jq...
- qeorge 15y ago
  Its fairly easy to fake PageRank via cloaking. You basically just redirect the Google toolbar queries to the real domain. Of course you're not actually fooling Google - just people using their toolbar or similar tools to check PageRank. That's probably what happened here. The jquery.it domain has nowhere near enough link strength to get an 8/10: http://www.opensiteexplorer.org/jquery.it/a!links http://www.opensiteexplorer.org/jquery.it/a!links jquery.com, for comparison: http://www.opensiteexplorer.org/jquery.com/a!links http://www.opensiteexplorer.org/jquery.com/a!links
  - rsoto 15y ago
    I think the cloaking was fixed long time ago. And Google IS being fooled-- that's why it is ranked on first on that query.
- masklinn 15y ago
  > It also has cloned the subdomains and http://code.jquery.it http://code.jquery.it. It's an exact mirror of jquery.com, the only differences are the tld, the borked download file and ads.
gojomo 15y ago
Google didn't just misrank this fraud; they also provided the loot (AdSense revenue) that likely motivated the crime. They should ban not just jquery.it from both natural rankings and AdSense, but every other site on the same AdSense account and with the same registered domain owner.
- getsat 15y ago
  And if the guy running jquery.it was smart, he'd have the custom jQuery he's hosting randomly replace people's AdSense blocks with his own to make even more money.
  - btilly 15y ago
    If he was really smart, he'd have the custom jQuery also add random links to him. To make sure that he stays at the top of the ranking.
    - slig 15y ago
      Links written from javascript are not indexed by Google, IIRC.
      - alecco 15y ago
        http://code.google.com/web/ajaxcrawling/docs/getting-started.html http://code.google.com/web/ajaxcrawling/docs/getting-started...
        untog 15y ago
        All of that requires server-side coding in order to present the content provided by JS otherwise. It wouldn't do anything in this case. Although altering jQuery to add a link at the bottom of every textarea field...
- ams6110 15y ago
  Maybe we should also reconsider the claimed neutrality of search results provided by a company that makes its money by delivering targeted advertising.
JonnieCache 15y ago
I bet there's a codepath in the magic google algorithm that says, "all things being equal, favor the page that has adsense." Except normally, things arent quite this equal.
- bhartzer 15y ago
  JonnieCache, that couldn't be farther than the truth. Google has recently been downgrading sites that have too much AdSense on them. The AdSense team has been at odds with the Google organic algo team for a while now.
  - JonnieCache 15y ago
    Yeah, I wasn't being entirely serious, guess that doesn't come across. It doesn't take much thought to realise that there are lots of glaring problems with my reasoning there :)
    - bhartzer 15y ago
      Not necessarily, it looks to me like your comment was serious. Unfortunately a lot of people think that just because it's Google that they are going to favor sites that have AdSense on them, or even that advertising via PPC is going to help your organic ranking.
    - scott_s 15y ago
      It doesn't take long at all, but there are enough tinfoil-hat folks out there that I assumed you were serious.
czDev 15y ago
I don't think the author is to blame at all. I do stuff like this all the time - I'm working on something, google for it, download and keep on moving. I use google constantly throughout the day, and trust the top result to be authentic. As it turns out, that trust may be unwarranted.
scottkrager 15y ago
The victim of SEO? No, the victim of a scam and Google. The site barely has any inbound links, if this is SEO, they suck. This is a google fail, not an SEO fail.
MatthewPhillips 15y ago
How is this even possible? Doesn't PageRank work by counting links? Does jquery.it have more inbound links than jquery.com?
- AgentConundrum 15y ago
  Doesn't PageRank work by counting links? This is a very naive view of Googles algorithms. While link count plays a significant role in ranking, there are many more factors (including various secret sauces) that determine where a given link will end up in the SERPs. Still, it really seems odd that Google shows a fake as the top result here. I just ran the search myself and while jquery.COM ranks first for a generic 'jquery' search, the release blog post doesn't appear at all when searching for 'jquery 1.6.2 released'. The closest you get is a link just to 'blog.jquery.com' with the title "jQuery:". It makes me wonder if something went wrong with the blog release that affected the way the "Google Juice" flowed down to that post, and this fake site managed to capitalize on it.
justinbaker 15y ago
Who googles a 9 character domain name that you know?
iter8n 15y ago
I would have just typed in 'jquery.com' and then clicked the link for the download page.
- DrCatbox 15y ago
  Exactly. Why do people trust their search engine, google, so much? And what would be the point of typing jquery.com into google? There is an adress field you know.
- btucker 15y ago
  Because often times you don't remember the domain exactly & then you've got the same problem. Anyone remember whitehouse.com or countless other examples of this? The fact that Google is probably 99%+ effective at getting you where you want to go heavily disincentivizes relying on your brain which may not have as high a success rate as Google. Plus all the browsers have gone in this direction since search terms are more usable than domain names.
  - iter8n 15y ago
    Of course. This could have happened to any site, but in this case I just found it funny because 'JQuery -> jquery.com' is so simple and obvious. I'm sure the author knew the actual domain, but used google out of habit or preference.
AndyJPartridge 15y ago
If I now do a search at google.co.uk for "jquery 1.6.2" the linked article is the first hit. The .IT in question site is the fourth. Things move fast on the interweb, I can't agree with anyone claiming this is Googles fault. With the size of the database, the breadth of queries that are done against it and the myriad of possible returns - how could they reasonably police it?
- kposehn 15y ago
  Here in the US, the the linked article is now first...and jQuery.com doesn't show up until the second page.
bhartzer 15y ago
I'm amazed at how many people jump to conclusions--and say that a bad Google search result or search spam is always the fault of SEO. SEO is not evil, and it is not all search engine spam. Most of the time the SEO that I do has to do with more with cleaning up bad or sloppy code and web design errors.
pierrefar 15y ago
Hello all I work at Google as a Webmaster Trends Analyst to help webmasters with issues like this one. Looking into this, the first thing I noticed is that the blog.jquery.com seems to be blocking Googlebot from fetching its pages, but the site responds normally for web browsers: it returns an HTTP 500 error headers for requests using a Googlebot user agent. You can see this yourself using a public tool like Web Sniffer to fetch the page spoofed as Googlebot ( http://web-sniffer.net/?url=http://blog.jquery.com/2011/06/30/jquery-162-released/&uak=9 http://web-sniffer.net/?url=http://blog.jquery.com/2011/06/3... ) or using Firefox with the User Agent Switcher and Live HTTP Headers addons. Unfortunately this is a very common problem we see. Most of the time it's a mis-configured firewall that blocks Googlebot, and sometimes it's a server-side code issue, perhaps the content management system. Separately from that, I also notice that the blog.jquery.it URL is redirecting to the blog.jquery.com, suggesting they are fixing it on their end too. If an jquery.com admins want more help, please post on our forums ( http://www.google.com/support/forum/p/Webmasters?hl=en http://www.google.com/support/forum/p/Webmasters?hl=en ). Cheers, Pierre
- yaakov34 15y ago
  Do you have any insight into what makes jquery.it rank so highly? I thought a pagerank of 8 was very difficult to attain. Was this done with just some SEO, or did some mega-popular site link to them by mistake? This is the real problem here, because people do have a lot of trust that very highly-ranked results on Google won't hurt them.
  - deleted 15y ago
    [deleted]
  - josegonzalez 15y ago
    I'd imagine that if they are a perfect duplicate of jquery.com, and jquery.com is constantly returning a 500 error page to the googlebot, then all the content on jquery.it would be "unique". There is so much of it, and all highly relevant content, that it's pretty much a no-brainer that it's pagerank would be so high. That said, I find it funny that there is so much vitriol against Google in this case when, as has been noted above, it's likely a misconfiguration on jquery.com's part.
gaborcselle 15y ago
I highly recommend using the Google-hosted versions of JQuery rather than downloading them and hosting them on your own. You get the benefits of faster downloads through Google's CDN and since many websites use these, they're pre-cached in browsers: http://code.google.com/apis/libraries/devguide.html#jquery http://code.google.com/apis/libraries/devguide.html#jquery
ldar15 15y ago
"MAJOR BUG! Google search engine found to be open to SEO abuse!!!" Except that this wouldn't be news. And because it wouldn't be news, the blame falls entirely on the author. The author got fished. Kudos for letting everyone know about it. -kudos for blaming google.
- ldar15 15y ago
  Really???? Mod down???? How about a comment explaining which bit you disagree with?
yaix 15y ago
>> If you’re in a hurry to download a copy of the latest jQuery revision Pardon? If you download just any jQuery without even checking the domain you are downloading from, then you are very careless. That's just like typing your Paypal password into a form on a website that was linked in an email that looked like it came from Paypal... Your copy of jQuery will be able to see anything that happens on the site you are writing, send any user password to a external server, read session keys, query your API for any data as a logged in user, etc. You could even build a botnet out of modified jQuery libraries. Whenever you download executables, make sure you know where they are coming from!
fendmark 15y ago
Saying that you're a victim of "SEO" is about as accurate as saying you are a victim of "Web Development."
EricR23 15y ago
The jQuery team is well aware of this issue.

257 points by gavingmiller 15y ago

In case the spirit of my post isn't clear, let me be the first to acknowledge that I wouldn't have run into this problem at all if I had been less careless. The purpose of posting this was to raise awareness and hopefully help others avoid making the same blunder (and to point some links at the correct site with good anchor text).

masklinn 15y ago
Interestingly, I did the exact same thing today: tried downloading jquery 1.6.2, was not careful enough, got a syntax error when I used it. Just checked, I'd gotten it from jquery.it...
mrcharles 15y ago
Sadly, I foresee a future where you have to whitelist everything in order to be truly safe. You got screwed over by two characters.
- kragen 15y ago
  That's where we were pre-Google; we called the whitelist our "bookmarks".
  - jshen 15y ago
    but it can be more automated than bookmarks. One idea, imagine if your searches searched pages across all your friends bookmarks and your own. Bookmarks isn't the right term, imagine if it were really easy to say "this I validate", then everyone that trusts you will be able to search that as well.
    - kragen 15y ago
      That's a really good idea. I wonder why Delicious never did that. They had your "friends" list and all your friends' bookmarks. I'll implement it in yamemex for sure!
      - jshen 15y ago
        I've wanted to build something like my idea for years, but it's not something you can do on the cheap. I've thought about focusing on some vertical to make it cheaper, but meh.
        rokekr 15y ago
        blekko.com looks to be doing something similar to what you described
        jshen 15y ago
        what are they doing?
        msbarnett 15y ago
        Basically they're letting people create "slashtags" that restrict a search to a customized list of sites. Eg) I have one for /objc that searches a half-dozen high-quality, good signal-to-noise, non-spammy objective-c related sites, so that if I search for "timers /objc" I get only quality content and no farmed spam. There's a lot more to it but they've essentially farmed out the job of whitelisting the non-spammy parts of the internet to their users. Edit: and more to the point of what you were desribing, you can easily use other people's public slashtags, and it will detect and suggest relevant ones as you use it. It's totally worth playing around with.
        jshen 15y ago
        That's very close, if they let me search my friends slash tags all at once it would be perfect.
brown9-2 15y ago
Honestly it seems like the majority of the article's attention is spent criticizing Google for allowing you to download a file from a site you didn't intend to, rather than warning others.
yaakov34 15y ago
I completely agree with the tone of your post. A spam site outranking the official site of a popular tech download is a big deal. Yes, as a web designer, you should know better, but if they can outrank jquery, they can outrank anything. Including sites meant for non-technical users. How's a non-technical user supposed to know he is making a dangerous download, if there is a nice green lock on his screen and the name of the program is familiar? How do we explain this to them?

ljlolel 15y ago

Great find. Google is really lagging behind on the game. An italian blog should never rank higher than the jQuery site. If Google loses our trust, and we have to be on our guard all of the time, ...

VMG 15y ago

No, "being in a hurry" doesn't excuse downloading and including jquery from the wrong website. He is lucky that there was a syntax error and the script didn't work, this could have turned out much uglier. Edit: the headline should be: "Everybody watch out, a fraudulent jquery website ranks higher in google than the official website". The syntax error is the best thing that could happen.

mtogo 15y ago
Exactly, i don't understand how he can pin this on google. Sure, it's a problem that google ranks a ripoff over the main site (as they did with SO before), but if you install jQuery from the wrong site, not once noticing the italian TLD, that's your own fault.
- smackfu 15y ago
  Well, the Italian TLD is not really a red flag in these days of "cute" domain names. Which is the real page for BackPack? http://backpackit.com/ http://backpackit.com/ http://backpack.it/ http://backpack.it/ If the "wrong" one had the same content as the right one, would you know which one to pick?
  - foresterh 15y ago
    The website that actually works, in this case...?
- knowtheory 15y ago
  Dude was careless, but that hardly excuses the blame the user mentality. People live in an ecosystem which bias behavior. Dude expected top ranking page to be the jquery site (invalid assumption) and presumably that if the top ranked site wasn't the jquery site, it wouldn't be spoofing the actual jquery site. Dude fell for what amounts to a phishing scam. Sure he should have been on better guard, but the circumstances definitely contributed to his user error.
  - 15y ago

chrisjsmith 15y ago

I think the blogger was being an idiot. You should check the authenticity of what you are downloading, not just snag it. It's like eating a kebab dropped in the street.

reustle 15y ago
It's not the same. If I type jQuery into google, click one of the top results and the site looks exactly like the jQuery site, I'd probably be fooled too. The domain is close enough to not catch out of the corner of your eye.
- VMG 15y ago
  With the upcoming version of chrome, there won't even be a url bar. AFAIK firefox wants to get rid of it too. Now is this an argument for keeping the url bar? It's obviously error-prone, but the other methods of establishing identity don't seem to be there yet either.
  - icebraining 15y ago
    The URL bar will be there, it just won't be visible at all times, but it'll still appear when the page is loading or you select the tab.
Tashtego 15y ago
Whether he should have downloaded from that site or not, it's ridiculous that it was showing up above the official site in search results. That's his main point.
- chrisjsmith 15y ago
  I think the rediculous thing is more that he spent that much time making a blog post because he made a mistake whilst obviously trying to do something quickly without thinking.
aquark 15y ago

kristofferR 15y ago

This should be easy to sabotage/fix for the real jQuery.com guys. Since the fake .it-site hotlinks directly to the css and custom javascript from jquery.com they can add some code that will warn users that the site is a fake, automatically redirect all traffic to jquery.com with a 301, add canonical headers etc...

masklinn 15y ago
Then the fake site would just copy those as well.
- SlyShy 15y ago
  That's kind of the point, is it not?
  - masklinn 15y ago
    Uh not really. Copy, not hotlink. The fake site would copy the originals (no referrer, no special sauce) and would be back to the current situation: a fake site looking exactly like the real one and ranking higher on google.
    - kristofferR 15y ago
      Well, it would work for a while since I doubt the owner of the fake site is actively monitoring it. He probably has a bunch of similar scraped sites running on autopilot. Even when(if?) he notices it, he'd have to change the operation of the bot to rewrite the links. At that point the SEO would be quite damaged by the canonical tags. If the canonical tags were added stealthily he probably wouldn't notice at all until his SEO was completely destroyed.
      - rapind 15y ago
        Maybe, but if I were writing a script to scrape and clone a site I'd probably strip canonical meta tags anyways. There needs to be an international douche law to serve as a deterrent to this kind of behaviour.

eps 15y ago

In short - Beware of downloading JQuery from jquery.it, which may appear before jquery.com in related Google searches. The end.

patio11 15y ago

On the plus side: there are a lot more interesting things a spammer could do with a copy of jQuery than accidentally include a syntax error.

VMG 15y ago
As a side node: I did a diff and it seems that besides some newlines at the top and the text at the end the scripts jquery-1.6.2.js and and jquery-1.6.2.min.js are in fact identical. This could have changed at any time, so from a security standpoint, you could even consider the client page as being compromised.
IgorPartola 15y ago
Exactly. I wonder now if I need to start changing passwords for sites that use jQuery on their login pages. Good thing this did not come out as "lulzsec now has everyone's bank passwords.

tghw 15y ago

What I find incredible about this is that Google has gotten so good at returning exactly what we want that we no longer bother checking the authenticity of it, even when it's something specific. If Google was "lagging behind on the game" as some people are suggesting, this never would have happened because we wouldn't be trusting it to return what we want.

bittermang 15y ago
So I guess you're saying you're not feeling lucky anymore?
hollerith 15y ago
I would frame the situation a little differently: Google got good enough that we started to trust it for this purpose (which we might call a "brand-name lookup services") but then in the last few years, it has declined and become untrustworthy. IMHO Google is very vulnerable to competition by new brand-name lookup services.
ams6110 15y ago
Speak for yourself, I always make sure I'm on the vendor's/author's official site before I download code. I never download code from 3rd parties.
- tghw 15y ago
  I'm not saying I would do this, I'm just kind of amazed that Google has gained so much trust that some people have stopped bothering.
- ojilles 15y ago
  Genuine question: how do you do that?
  - tghw 15y ago
    Look at the domain. If I'm downloading jQuery, it should be jquery.com. If I'm not sure what the domain should be, try to get it from someone I do trust, like the Google-hosted libraries[1]. If it's from GitHub or BitBucket, try to make sure the person who owns the repo is actually the one maintaining it (so I don't get a broken copy or one with something "extra"). It's all mostly just common sense and a little bit of extra scrutiny. [1] http://code.google.com/apis/libraries/devguide.html http://code.google.com/apis/libraries/devguide.html

AlexMuir 15y ago

Not only has Google ranked the site highly, it seems to be the financier too. It looks to me that this was done just for the Adsense income. Why this was done? Here were my first few thoughts: 1. Display ad revenue. - Maybe initially, there is Adsense markup but the ads aren't showing for me so perhaps Google has disabled them. 2. Affiliate income from the links to jQuery books - I can't see an affiliate code in the links so probably not. 3. Hijacking the Donate button - No. This leads to a blank page with just a Time to Generate snippet.

mrcharles 15y ago

What worries me about this is the original intentions of the owners of jquery.it. Obviously they planned something malicious, and were setting up for it, only random chance resulted in them getting outed before they could begin deploying their actual malicious code. Frankly, had you been more careful, worse could have happened down the road. Still, I would be interested in seeing exactly how jquery.it made it to the top of the search listings.

patio11 15y ago
What worries me about this is the original intentions of the owners of jquery.it. Diff suggests the plan was probably "Serve adsense ads." That is the punchline to quite a bit of spam.

po 15y ago

This is also another example of why having more top level domain names will make things worse, not better.

dspillett 15y ago

There is a fairly simple heuristic that could combat this, which I assume is possible with Google's architecture (which I know little about, so I could be wrong here!): * if a page A refers to the same external css and images as page B on another site, and those external resources are local to B, then assume B is more original and should be ranked higher than A. Of course the SEO people will get around this by making sure they take copies of the css and image assets as well as the html ones once this is implemented, but at least it'll save the "target" site a little bandwidth.

masklinn 15y ago
> but at least it'll save the "target" site a little bandwidth. Which really is not the issue at all. Do you also suggest that people fearing home invasions paint their walls red, so the blood splatters are hidden if they get shot?
- dspillett 15y ago
  It would also cost the scammer bandwidth. Though that is probably paid for on a stolen credit card anyway... Unfortunately the real problem Google is unable to do much about, aside from a few high-profile things (jQuery would count as high enough profile, but many similar libraries would not). How do they know, given two apparently identical chunks of content, which is the original source?

lhnn 15y ago

What if Google put subtle warnings on websites from other CC TLDs than .com, .net or the TLD you live in? Alternatively, Google could just work on spotting phishing and spam sites.

dlikhten 15y ago

HA! I started reading and researching and it just made me laugh. Guess what you get when you go to http://duckduckgo.com/?q=jquery http://duckduckgo.com/?q=jquery THATS RIGHT, an official site logo, because Gabriel is f-ing awesome and I love DDG's little almost insignificant features like showing you the official jquery website vs what you THINK the official one is, since google never helps you there. Also I have adblocking and opt-out from google's ad tracking on so I never suffer these things. But that's what makes DDG so amazing, that opt-outs don't mater Its just so clutter free. Putting things into context vs just presenting you with data. Note that in my search results I even get the nice icons indicating if the result is spam or not. That website for the fake jquery is... well its not even on first 100 search results, may be blocked. Thanks DDG, you just justified your existence yet again.

retube 15y ago
How is the "Official Site" authentication done?
- jrockway 15y ago
  Manually, I would imagine.
  - dlikhten 15y ago
    That's improbable. I know Gabriel is good, but hes not god.
- callahad 15y ago
  There are far too many "official site" links for me to think it's manual... I know DDG does deep indexing of Wikipedia, perhaps it's using the target of the "Official website" link at http://en.wikipedia.org/wiki/Jquery http://en.wikipedia.org/wiki/Jquery? Edit: Yeah, I think that's the case. These searches don't show the "Official Site" badge: http://ddg.gg/?q=jenkins+ci http://ddg.gg/?q=jenkins+ci http://ddg.gg/?q=hudson+ci http://ddg.gg/?q=hudson+ci, but these do: http://ddg.gg/?q=jenkins+software http://ddg.gg/?q=jenkins+software http://ddg.gg/?q=hudson+software http://ddg.gg/?q=hudson+software Compare those queries to the name of the wikipedia pages: http://en.wikipedia.org/wiki/Jenkins_(software) http://en.wikipedia.org/wiki/Jenkins_(software) http://en.wikipedia.org/wiki/Hudson_(software) http://en.wikipedia.org/wiki/Hudson_(software)

rsoto 15y ago

This is very weird. jQuery.it has the same PageRank as jQuery.com (8/10). This site dates back to 2007 [1] altough it started copying the jQuery site until 2009 [2]. It also has cloned the subdomains: http://dev.jquery.it/ http://dev.jquery.it/ and http://forum.jquery.it/ http://forum.jquery.it/ What this site appears to do is mirror the content of jQuery.com by copying everything and then appending the "Time to generate" string. I just checked adblock, it also adds a Google Ad, which is the point to this. Obviously Google has messed up big time, but also the whole web by linking so much a fake site that it has the same page rank as the original. 1: http://wayback.archive.org/web/20071001000000*/http://www.jquery.it/ http://wayback.archive.org/web/20071001000000*/http://www.jq... 2: http://wayback.archive.org/web/20090601000000*/http://www.jquery.it/ http://wayback.archive.org/web/20090601000000*/http://www.jq...

qeorge 15y ago
Its fairly easy to fake PageRank via cloaking. You basically just redirect the Google toolbar queries to the real domain. Of course you're not actually fooling Google - just people using their toolbar or similar tools to check PageRank. That's probably what happened here. The jquery.it domain has nowhere near enough link strength to get an 8/10: http://www.opensiteexplorer.org/jquery.it/a!links http://www.opensiteexplorer.org/jquery.it/a!links jquery.com, for comparison: http://www.opensiteexplorer.org/jquery.com/a!links http://www.opensiteexplorer.org/jquery.com/a!links
- rsoto 15y ago
  I think the cloaking was fixed long time ago. And Google IS being fooled-- that's why it is ranked on first on that query.
masklinn 15y ago
> It also has cloned the subdomains and http://code.jquery.it http://code.jquery.it. It's an exact mirror of jquery.com, the only differences are the tld, the borked download file and ads.

gojomo 15y ago

Google didn't just misrank this fraud; they also provided the loot (AdSense revenue) that likely motivated the crime. They should ban not just jquery.it from both natural rankings and AdSense, but every other site on the same AdSense account and with the same registered domain owner.

getsat 15y ago
And if the guy running jquery.it was smart, he'd have the custom jQuery he's hosting randomly replace people's AdSense blocks with his own to make even more money.
- btilly 15y ago
  If he was really smart, he'd have the custom jQuery also add random links to him. To make sure that he stays at the top of the ranking.
  - slig 15y ago
    Links written from javascript are not indexed by Google, IIRC.
    - alecco 15y ago
      http://code.google.com/web/ajaxcrawling/docs/getting-started.html http://code.google.com/web/ajaxcrawling/docs/getting-started...
      - untog 15y ago
        All of that requires server-side coding in order to present the content provided by JS otherwise. It wouldn't do anything in this case. Although altering jQuery to add a link at the bottom of every textarea field...
ams6110 15y ago
Maybe we should also reconsider the claimed neutrality of search results provided by a company that makes its money by delivering targeted advertising.

JonnieCache 15y ago

I bet there's a codepath in the magic google algorithm that says, "all things being equal, favor the page that has adsense." Except normally, things arent quite this equal.

bhartzer 15y ago
JonnieCache, that couldn't be farther than the truth. Google has recently been downgrading sites that have too much AdSense on them. The AdSense team has been at odds with the Google organic algo team for a while now.
- JonnieCache 15y ago
  Yeah, I wasn't being entirely serious, guess that doesn't come across. It doesn't take much thought to realise that there are lots of glaring problems with my reasoning there :)
  - bhartzer 15y ago
    Not necessarily, it looks to me like your comment was serious. Unfortunately a lot of people think that just because it's Google that they are going to favor sites that have AdSense on them, or even that advertising via PPC is going to help your organic ranking.
  - scott_s 15y ago
    It doesn't take long at all, but there are enough tinfoil-hat folks out there that I assumed you were serious.

czDev 15y ago

I don't think the author is to blame at all. I do stuff like this all the time - I'm working on something, google for it, download and keep on moving. I use google constantly throughout the day, and trust the top result to be authentic. As it turns out, that trust may be unwarranted.

scottkrager 15y ago

The victim of SEO? No, the victim of a scam and Google. The site barely has any inbound links, if this is SEO, they suck. This is a google fail, not an SEO fail.

MatthewPhillips 15y ago

How is this even possible? Doesn't PageRank work by counting links? Does jquery.it have more inbound links than jquery.com?

AgentConundrum 15y ago
Doesn't PageRank work by counting links? This is a very naive view of Googles algorithms. While link count plays a significant role in ranking, there are many more factors (including various secret sauces) that determine where a given link will end up in the SERPs. Still, it really seems odd that Google shows a fake as the top result here. I just ran the search myself and while jquery.COM ranks first for a generic 'jquery' search, the release blog post doesn't appear at all when searching for 'jquery 1.6.2 released'. The closest you get is a link just to 'blog.jquery.com' with the title "jQuery:". It makes me wonder if something went wrong with the blog release that affected the way the "Google Juice" flowed down to that post, and this fake site managed to capitalize on it.

justinbaker 15y ago

Who googles a 9 character domain name that you know?

iter8n 15y ago

I would have just typed in 'jquery.com' and then clicked the link for the download page.

DrCatbox 15y ago
Exactly. Why do people trust their search engine, google, so much? And what would be the point of typing jquery.com into google? There is an adress field you know.
btucker 15y ago
Because often times you don't remember the domain exactly & then you've got the same problem. Anyone remember whitehouse.com or countless other examples of this? The fact that Google is probably 99%+ effective at getting you where you want to go heavily disincentivizes relying on your brain which may not have as high a success rate as Google. Plus all the browsers have gone in this direction since search terms are more usable than domain names.
- iter8n 15y ago
  Of course. This could have happened to any site, but in this case I just found it funny because 'JQuery -> jquery.com' is so simple and obvious. I'm sure the author knew the actual domain, but used google out of habit or preference.

AndyJPartridge 15y ago

If I now do a search at google.co.uk for "jquery 1.6.2" the linked article is the first hit. The .IT in question site is the fourth. Things move fast on the interweb, I can't agree with anyone claiming this is Googles fault. With the size of the database, the breadth of queries that are done against it and the myriad of possible returns - how could they reasonably police it?

kposehn 15y ago
Here in the US, the the linked article is now first...and jQuery.com doesn't show up until the second page.

bhartzer 15y ago

I'm amazed at how many people jump to conclusions--and say that a bad Google search result or search spam is always the fault of SEO. SEO is not evil, and it is not all search engine spam. Most of the time the SEO that I do has to do with more with cleaning up bad or sloppy code and web design errors.

pierrefar 15y ago

Hello all I work at Google as a Webmaster Trends Analyst to help webmasters with issues like this one. Looking into this, the first thing I noticed is that the blog.jquery.com seems to be blocking Googlebot from fetching its pages, but the site responds normally for web browsers: it returns an HTTP 500 error headers for requests using a Googlebot user agent. You can see this yourself using a public tool like Web Sniffer to fetch the page spoofed as Googlebot ( http://web-sniffer.net/?url=http://blog.jquery.com/2011/06/30/jquery-162-released/&uak=9 http://web-sniffer.net/?url=http://blog.jquery.com/2011/06/3... ) or using Firefox with the User Agent Switcher and Live HTTP Headers addons. Unfortunately this is a very common problem we see. Most of the time it's a mis-configured firewall that blocks Googlebot, and sometimes it's a server-side code issue, perhaps the content management system. Separately from that, I also notice that the blog.jquery.it URL is redirecting to the blog.jquery.com, suggesting they are fixing it on their end too. If an jquery.com admins want more help, please post on our forums ( http://www.google.com/support/forum/p/Webmasters?hl=en http://www.google.com/support/forum/p/Webmasters?hl=en ). Cheers, Pierre

yaakov34 15y ago
Do you have any insight into what makes jquery.it rank so highly? I thought a pagerank of 8 was very difficult to attain. Was this done with just some SEO, or did some mega-popular site link to them by mistake? This is the real problem here, because people do have a lot of trust that very highly-ranked results on Google won't hurt them.
- deleted 15y ago
  [deleted]
- josegonzalez 15y ago
  I'd imagine that if they are a perfect duplicate of jquery.com, and jquery.com is constantly returning a 500 error page to the googlebot, then all the content on jquery.it would be "unique". There is so much of it, and all highly relevant content, that it's pretty much a no-brainer that it's pagerank would be so high. That said, I find it funny that there is so much vitriol against Google in this case when, as has been noted above, it's likely a misconfiguration on jquery.com's part.

gaborcselle 15y ago

I highly recommend using the Google-hosted versions of JQuery rather than downloading them and hosting them on your own. You get the benefits of faster downloads through Google's CDN and since many websites use these, they're pre-cached in browsers: http://code.google.com/apis/libraries/devguide.html#jquery http://code.google.com/apis/libraries/devguide.html#jquery

ldar15 15y ago

"MAJOR BUG! Google search engine found to be open to SEO abuse!!!" Except that this wouldn't be news. And because it wouldn't be news, the blame falls entirely on the author. The author got fished. Kudos for letting everyone know about it. -kudos for blaming google.

ldar15 15y ago
Really???? Mod down???? How about a comment explaining which bit you disagree with?

yaix 15y ago

>> If you’re in a hurry to download a copy of the latest jQuery revision Pardon? If you download just any jQuery without even checking the domain you are downloading from, then you are very careless. That's just like typing your Paypal password into a form on a website that was linked in an email that looked like it came from Paypal... Your copy of jQuery will be able to see anything that happens on the site you are writing, send any user password to a external server, read session keys, query your API for any data as a logged in user, etc. You could even build a botnet out of modified jQuery libraries. Whenever you download executables, make sure you know where they are coming from!

fendmark 15y ago

Saying that you're a victim of "SEO" is about as accurate as saying you are a victim of "Web Development."

EricR23 15y ago

The jQuery team is well aware of this issue.