{"id":24407,"date":"2014-05-17T13:01:45","date_gmt":"2014-05-17T19:01:45","guid":{"rendered":"http:\/\/rankexploits.com\/musings\/?p=24407"},"modified":"2014-05-17T14:46:24","modified_gmt":"2014-05-17T20:46:24","slug":"httpwww-sksforum-orgthread-phptipj","status":"publish","type":"post","link":"https:\/\/rankexploits.com\/musings\/2014\/httpwww-sksforum-orgthread-phptipj\/","title":{"rendered":"http:\/\/www.sksforum.org\/thread.php?t=i&p=j"},"content":{"rendered":"

Alas, a playground has been shut down. As many<\/em> bloggers who read their server logs (and Google) knew, sksforum.org used to leave referrers of this form in our server logs:<\/p>\n

site:http:\/\/www.sksforum.org\/thread.php?t=i&p=j<\/p>\n

Here, “i” and “j” would be integer values. <\/p>\n

So: for example, someone like Anthony Watt’s looking at his referrers to http:\/\/wattsupwiththat.com\/2013\/11\/10\/towards-a-theory-of-climate\/<\/a> might see www.sksforum.org\/thread.php?t=12517&p=14289<\/a>. Back in the day, if Anthony clicked on the link to “www.sksforum.org\/thread.php?t=12517&p=14289”, he would find himself referred to “http:\/\/wattsupwiththat.com\/2013\/11\/10\/towards-a-theory-of-climate\/”. <\/p>\n

Hmmm…. What’s up with that? <\/p>\n

Well, it was obvious what was up: someone has programmed a referrer anonymizer<\/a> of some sort. The details about exactly how the anonymizer worked is not obvious but its effects were. Lots of people saw these sorts of referrers and so knew that the system existed. They knew what it did. This information was not a secret. (If SkSers intended it to be a secret, they really don’t know how the intertubes works.)<\/p>\n

As it happened, it was so non-secret google crawled these links:<\/p>\n

\"Search_sksforum_threads\"<\/a>
\nNotice above that each link has a different ‘i’ and ‘j’ value in the t=i&p=j part of the uri. Notice also that the contents listed by Google indicate match the contents at blog posts at places like Wattsupwiththat, not contents at SkS.<\/p>\n

Now, when I first learned of this redirect thingie SkSforum.org was using, my first thought was, “Snort”. <\/p>\n

My second thought came one second later: “What if I change the value of ‘i’ or ‘j’ to “i+1” or “j+1”. Naturally I tried both. <\/p>\n

My third thought was, “This means that the SkS forum has likely created a handy publicly accessible tool for any and every curious person to easily, legally and ethically discover every single link posted on the SkS forum using the handy SkSforum linkfinding too!” All one needs to do is to increment values of i and\/or j (which is perfectly legal and easily accomplished by using the tool SkS provided everyone in the world– including Google.) And if one did this, well, “Bob’s your Uncle” you, just like Google (who likely found these links in published referrer logs or something), or any SEO company could discover pages that had been linked to by members of the SkSforum. If you were thorough, you could find every link they had ever posted.<\/p>\n

I looked at a few links. Got bored. After all: just clicking through to a bunch of fairly boring publicly accessible web pages. (None of the links I clicked through to were password protected. Had they been, I would have simply been blocked from reading them. Not really a problem as I would be perfectly content not to read them.)<\/p>\n

Ok– so far, this is the state Brandon describes himself being in part way through his recent post<\/a>. As it happens, I stayed bored with the idea of looking at SkS links. <\/p>\n

Then….several months after I got bored looking at dumb links, Brandon found the data from the 97% paper data… <\/p>\n

I immediately suspected the method might have revealed interesting stuff if I’d been sufficiently curious to look at more web pages. Brandon had been incrementing the values in links like “http:\/\/www.sksforum.org\/thread.php?t=i&p=j”. Unlike me, he found something not so boring. <\/p>\n

Ultimately, this is resulting in accusations of “hacking”. <\/p>\n

Of course you are all thinking, “What fun! I can use this handy tool John Cook created to help people find every link posted at the sksforum.org forum!” And it’s totally legal as one is merely loading links that sends them to web pages which either are (a) totally public or (b) password protected. In the later case, if password protected, nothing illegal has happened by entering the url. Of course, attempting to crack<\/I> the password might be illegal– but if you don’t do that: well no problem.<\/p>\n

Alas, someone has now programmed an ‘.htaccess’ password access restriction. So no joy. But fear not: you haven’t done anything illegal by entering these URLs. <\/p>\n

Cracking that user\/password combination<\/i> to enter that page would almost certainly be illegal. But merely seeing it is not. <\/p>\n

But sadly, you do see the password protection. The previously publicly accessible playground is now closed. <\/p>\n","protected":false},"excerpt":{"rendered":"

Alas, a playground has been shut down. As many bloggers who read their server logs (and Google) knew, sksforum.org used to leave referrers of this form in our server logs: site:http:\/\/www.sksforum.org\/thread.php?t=i&p=j Here, “i” and “j” would be integer values. So: for example, someone like Anthony Watt’s looking at his referrers to http:\/\/wattsupwiththat.com\/2013\/11\/10\/towards-a-theory-of-climate\/ might see www.sksforum.org\/thread.php?t=12517&p=14289. … Continue reading http:\/\/www.sksforum.org\/thread.php?t=i&p=j<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[134],"tags":[],"class_list":["post-24407","post","type-post","status-publish","format-standard","hentry","category-politics"],"_links":{"self":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts\/24407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/comments?post=24407"}],"version-history":[{"count":0,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts\/24407\/revisions"}],"wp:attachment":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/media?parent=24407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/categories?post=24407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/tags?post=24407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}