LJ erroneously hijacks affiliate links?

[charmian]

It appears that LJ added in some code which redirected links to certain e-commerce domains to other domains (although this script seems to have stopped?) (This company seems to be the one involved. Possibly this program? Also mentioned here. And explained by a user of the program here. )

http://community.livejournal.com/no_lj_ads/87066.html
http://atara.livejournal.com/631445.html
http://vichan.livejournal.com/392527.html

Not being a coder or familiar with affiliate marketing, I don't really understand the technical aspects of it, but it's not really clear what LJ really meant to do. Does anyone know what the actual intention of this code probably was? And if so, how could they muck it up so much?

It seems that, whatever the intention of this code was, that it may have caused LJ users to lose money.

Comments

[samvara]

Thanks for the links - this is really interesting!

At best guess based on what I've seen so far the intent was possibly to add LJ affiliation to 'unclaimed' referral links thus generating LJ revenue.

I'm also getting the impression the code is a bit chunky which could be deliberate obscurantism but is more likely your generic Frankensteins monster of cut-and-paste code that worked somewhere else. I'm thinking that testing wasn't comprehensive (to be fair it never is, although I think it's reasonable to expect trialling this kind of thing on volunteers before launching it on the entire userbase.)

I wonder what the response would have been if it had been launched as a 'help LJ provide high quality service' opt in strategy.

[charmian]

That seems to be what Marta is saying on the no-lj-ads link, which is less sinister, but it then really begs the question of how the code could get so incompetently implemented, given there there is still a note on the code about 'hey, is this the correct account number?'

I've done some more digging into the service, and it seems that they are indeed used by quite a few sites for these reasons, although mostly bulletin boards, by the looks of it.

Well, as I said elsewhere, I think it's legitimate for LJ to decide that they wish to have everyone use their affiliate links, especially if we are talking about unpaid users, but the big issue is that they didn't tell anyone about this change in policy. (speaking of their stated intent, not of the actual result)

[foxfirefey]

Okay, my guess is the code that did the actual work, was not written by LJ, but by Driving Revenue. Driving Revenue obfuscated the code and describes their "Javascript solution" as "patent pending", which means that there might have been contract riders to not reverse engineer the code to see what it was doing, lest you expose yourself to IP liabilities.

The code with the comment about "is this the correct account number" was written by LJ coders implementing Driving Revenue's solutions, probably as per their instructions on how to do so.

[charmian]

Hmm... Well, not even testing it enough to see that this sort of thing happened seems to be a rather big error on LJ's part, though.

I wonder what LJ is going to do in response to the negative feedback: have Driving Revenue fix the code? And if they do, will they announce the change in news or a similar comm?

[foxfirefey]

I totally agree on the lack of testing. This thing has been running live on the site for over a month, there's no reason somebody shouldn't have tested it and found out it wasn't working and stopped using it until it did.

I think they're ditching Driving Revenue, because the company's no good at staying in contact or fixing problems they've been having. But I wouldn't be surprised if they found another way to monetize affiliate links--it's really nice, tasty, low hanging fruit.

[charmian]

Yeah, it sounds like people even contacted them with similar complaints before, so why didn't they do something then?

Oh, have you heard that they hadn't been in contact?

I wonder if then they'll start to actively have a policy on it, then. IIRC there is currently no policy on affiliate links.

[foxfirefey]

The right people weren't complaining. I don't mean that as badly as it sounds, but, basically--LJ Support is swamped and overworked. LJ Management probably did not communicate much about these technical changes to LJ Support, so they muddle through the best they can, which is why those Support Requests complaining about it have been open for weeks. To make matters worse, affiliate link hijacking is often a malware technique, so it's difficult at first to discern something that is the fault of the site from something that is the fault of malware, further delaying the requests.

[charmian]

So who are the 'right people?' I mean, it's difficult to spin that phrase positively.

If it simply is that LJ Support is swamped, it wouldn't have mattered who complained, right? (Huh, so the situation didn't improve? I remember Mark made a post about the situation last year or something, but since then I hadn't heard of anything, so I assumed things had improved).

So what does it take for LJ to do something? Someone to investigate the situation and complain on the news comm?

But this thing should have been easily replicable, shouldn't it? I mean, the way the links were, anyone would have been redirected, unlike malware (and anyway, it seems that 'the fault of the site' and 'malware' are not always mutually exclusive...)

Oops, accidentally deleted my comment :p

[samvara]

I agree on the implementation front. I imagine the test went "check an (unclaimed) link redirects (y/n); y = celebrate!". Which is what we in the biz call a 'unit test' and is done by developers to confirm the code works in its most primitive form. You're then supposed to go do more sophisticated stuff like impact on existing users, new users, potential conflicts etc. At the very least you'd want to test what happens when a link goes from claimed -> unclaimed -> claimed.

If it's 3rd party code then you implement according to their instructions then test the begeezus out of it to see how it interacts with your code.

I think the communication is non-awesome. I can see how a suit could preemptively decide it will be unpopular and want to implement quietly but the loss of goodwill and trust isn't pretty. Then again LJ doesn't seem to have a culture of the kind of open communication we're wanting so it's probably very hard for them to figure out how to do it - which makes stealth_mode the default.

Re: Oops, accidentally deleted my comment :p

[charmian]

Well, it seems even to a non-professional like myself that it would be common sense that the link wouldn't claim things that were claimed. 0_o And also, this stuff about entirely unrelated sites getting redirected is also really strange. Why would it do that, instead of checking for the exact domain?

Not only communication with the users, but with the staff, it seems. I can see how they thought it wouldn't matter and then implement it, but haven't they seen that users tend to find out about these things and then raise a fit? I actually don't think as much of a controversy would have occurred had the original intent been followed, but people naturally were very upset by what actually happened. On the other hand, the goodwill of the users is pretty low anyway, so maybe at this point there is little to lose.

Re: Oops, accidentally deleted my comment :p

[samvara]

*g* Developers don't think like users. Developers make exactly what you ask for, even if you ask for something stupid. This is partly because it's not their job to write requirements, partly because they trust you and partly because they are busy developing! Good developers come back and ask a lot of questions if your documentation sucks is unclear but even good, busy developers will sometimes build you exactly what you asked for with its associated ghastly logic flaws. This game is even more fun if you're playing it with linguistic barriers.

When you ask for a sandwich, you better specify you want bread, what kind of bread, how thickly you want the bread sliced, that it had better not contain nuts, that you want butter, how much butter, when it needs to be applied (after the bread is baked is good but in developer-world not assumed) and so on an so forth. I umh, have been known to deliver extensive talks on the subject of communication and documentation :p

Communication - I am desperately trying to find a quote I remember seeing on the Watergate scandal to the effect that no-one even discussed whether there'd be a cover up - it was just obvious. Darn, maybe it was a Bloom County comic and I dreamed it.

Re: Oops, accidentally deleted my comment :p

[charmian]

Well, I guess that might not be the responsibility of the developers, but then it must be someone's job to see that what's going on IS a good idea and that the code doesn't have crappy side effects. I'm not sure if this does even have anything to do with the Russian side, so perhaps it isn't being implemented there.

Ahahaha, yeah. From what I've googled, forum users where this program has been implemented have accepted it if it is explained. Metafilter IIRC has a similar script, and no one really has a problem with it.

[foxfirefey]

The right people are those who either:

* Know people directly in Support/whatnot, and talk to them about it, and they all go off and do investigation and find stuff, and then it gets passed up the chain.

or

* Have the ability to sleuth something to the root of the cause (or at least a perceived root), write up an articulate post about it, and spread the word, complain on the news, etc. Then Support/staff end up seeing it, and it goes up the chain. Sometimes being able to accurately describe the problem in an inflammatory or clear way works, too, and no root cause is needed.

Now, this isn't always the case by any means--if an issue is obvious or easily recognized as something outside the usual pattern or related to something that was talked about in a code push, Support will definitely catch on a lot faster!

But if the issue is something fewer people are going to complain about, especially if it's similar to things malware writers do, it's hard to figure out the root of it. That's what this was. I saw a report about the affiliate link getting changed weeks ago, and that was the stock answer given (also in part because it originally came in in Italian I imagine).

I don't know if Support is as bad as it was then, but it's certainly no walk in the park even if it's better than absolute rock bottom, and they keep losing category admins to busy life schedules, etc.

Re: Oops, accidentally deleted my comment :p

[samvara]

Testing! It's not a silver bullet but a when a suitably paranoid test manager who is held accountable when things turn to cactus is allowed to do their job you get good results.

I don't have a problem with the concept, just the implementation and communication. Do you know if IIRC allows its users to claim links or does it reserve 100%?

[charmian]

Ah, so to get your problems taken seriously nowadays, you need connections or writing ability/computer knowledge? I think this situation will only encourage people to start raising hell in the news comm, though.

Oh, that it was malware? (the stock answer)

Well, I guess they really can't do anything about that, except hiring staff to help out. It makes me wonder how companies that do use 100% hired staff deal with the issue. (Unless the workload has gotten much worse than it was in the past?)

Re: Oops, accidentally deleted my comment :p

[charmian]

I really don't know anything, I'm afraid. I simply found some references on google to the usage of the code, but in most cases, it seems like the forum admins ban all usage of user affiliate codes on their site. There was a forum admin apologizing to the users for not informing them of this enough, but then also saying that the rules on the forum were no outside affiliate links.

Re: Oops, accidentally deleted my comment :p

[samvara]

*g* sounds like this pings the delicate balance between thew rights of users (provided content) and sites (provided infrastructure).

I wonder if there's an obvious appropriate point to draw the line and say 'no outside affiliate links' and whether LJ is about to do so.

Not really that hard, I think

[charmian]

Actually, I don't think it's that unreasonable for a site owner to say "no outside affiliate links," when we're dealing with non-paying users. I think the main 'right of the user' is not to be deceived or have things done behind their back/have their content altered w/o their knowledge. So I see that as the main problem, rather than the policy in and of itself.

Once the policy is publicly out there, users can decide whether they wish to use the site or not, and I think that's a fair deal.

[azurelunatic]

This whole thing upsets me.

[charmian]

It's kind of a clusterfuck of poor coding (these huge bugs, lack of effective testing), unfairness to users (not telling anyone anything about this), and lack of diligence (only now they decide to do something?)

[azurelunatic]

There has been some testing, in Support, trying to duplicate on what pages and circumstances that script error happens.

I had told Firefox to not tell me about it long before; this was mostly on my computers being slow, so I was getting script-timeouts from Gmail too.

Re: Not really that hard, I think

[samvara]

Site owners + non-paying users = I agree

[foxfirefey]

More that you're not going to get a quick resolution if you can't do those things. I don't blame Support, though--LJ should be notifying Support of technical changes to the site like this in a coordinated fashion, and I am getting the impression that did not happen. (LJ should also have been TESTING to make sure things were functionally to begin with shortly after it went like, but eh, I guess that didn't happen either.)

So of course the Support people wouldn't have known to look out for possible funky things happening to affiliate links. That puts any mysterious affiliate yoinkage happening into the realm of Mysterious Glitches, and those are a lot more work to track down and figure out, and since Support is overworked, there is not a lot of time to do that. And, well, affiliate links being wrong is kind of...not the highest user support priority? I mean, I think trying to figure out other technical glitches that are affecting people's use of the site probably attracts more effort. If not a lot of people are reporting it (and I don't think there were--else it would have come out a lot sooner), then it's harder to bump it up the priority list.

[charmian]

I kind of wonder what's going to happen if people start figuring that out, though and start going straight to News.

The whole testing thing seems really ridiculous. To have the links not even going to the right place... Totally defeats the whole "secret" nature of the program. Probably no one would have figured it out for awhile if it weren't for that.

I suppose not too many people really use/care about affiliate links, but I'm surprised that more people didn't notice links being borked, so perhaps there were other technical things that triggered the problem.

[foxfirefey]

Another thing that's been pointed out that has to do with the Support thing that made it NOT so easy to diagnose is that this affiliate script was connected with a little known opt-out for stats that Support people may have had set. In that case, somebody would have been reporting an issue and the Support volunteer may not have been able to replicate it, because they were logged in. And when you're doing tech support, if things look and talk like a goose when they walk in, it's hard to psychically know that it's actually a really big duck.