> Google and Bing are pretty good at automatically canonicalizing these, but not perfect
I have been meaning to blog this - this leads to cloaking exploits. For eg. Google will figure out the shorter canonical link for a domain. So if you have www.lakers.com redirect to lakers.nba.com Google will treat 'lakers.com' as the canonical link and rewrite all the search results.
This can be exploited by registering a shorter domain and then pointing it to the real site, then waiting for Google to redirect it. For eg. Fred Wilson noticed that the guy who owns avc.com was redirecting to his blog. He thought the guy was being a good samaritan, until I pointed out that it was a cloak attack and he was trying to jack all of avc.blogs.com's Google juice.
You can avoid this by not letting Google or Bing setting the canonical and by specifying it with a rel='canonical' link or using Webmaster Tools. Do you know anything else about this Rand or have you seen it in the wild?
I talked to Fred about this after you pointed out, but there's basically no way that shorter url could have hijacked Fred's site. Way back in the mists of time we had things called "302 hijacks" but I haven't seen any attempts like that succeed in years.
Sorry, missed your reply. I was going to email you about Fred's blog but you were on holidays at the time, so I just asked him to setup the canonical in Webmaster Tools
Comments
> Google and Bing are pretty good at automatically canonicalizing these, but not perfect
I have been meaning to blog this - this leads to cloaking exploits. For eg. Google will figure out the shorter canonical link for a domain. So if you have www.lakers.com redirect to lakers.nba.com Google will treat 'lakers.com' as the canonical link and rewrite all the search results.
This can be exploited by registering a shorter domain and then pointing it to the real site, then waiting for Google to redirect it. For eg. Fred Wilson noticed that the guy who owns avc.com was redirecting to his blog. He thought the guy was being a good samaritan, until I pointed out that it was a cloak attack and he was trying to jack all of avc.blogs.com's Google juice.
You can avoid this by not letting Google or Bing setting the canonical and by specifying it with a rel='canonical' link or using Webmaster Tools. Do you know anything else about this Rand or have you seen it in the wild?
I talked to Fred about this after you pointed out, but there's basically no way that shorter url could have hijacked Fred's site. Way back in the mists of time we had things called "302 hijacks" but I haven't seen any attempts like that succeed in years.
Sorry, missed your reply. I was going to email you about Fred's blog but you were on holidays at the time, so I just asked him to setup the canonical in Webmaster Tools
Good that this doesn't work