Who Do You Trust?
The debate over Google’s new rel="nofollow" attribute for “untrusted” links continues to simmer. I explained our (Musings and the String Coffee Table’s) policy a while back. Trackbacks and Comment-Author Links are innoculated with rel="nofollow".
But then I got to thinking. There is, surely, one class of Comment-Author Link that I do trust: authors who have gone to the trouble to PGP-sign their comments. Previously, PGP-signing your comments gave you that warm feeling of knowing that you cannot be impersonated, nor the text of your comments tampered-with, without that being evident to anyone who clicks on the verification link. But now, PGP-signing your comments buys you that extra little ε of Google PageRank as well.
Comment-Author Links of PGP-signed comments are exempt from the rel="nofollow" policy.
So … go generate yourself a PGP key, put your public key on your website (make sure it’s served right), start signing your comments here, and watch your PageRank soar.
Well, OK, maybe not the last one. But this is a wee bit more incentive to do what you should be doing anyway.
Posted by distler at February 5, 2005 12:41 AM
TrackBack URL for this Entry: http://golem.ph.utexas.edu/cgi-bin/MT-3.0/dxy-tb.fcgi/505
Re: Who Do You Trust?
Good, I get some PageRank! That’s especially important since I wasn’t even giving myself PageRank. The MT nofollow plugin adds rel="nofollow" to all comments, even my own. I disabled the plugin after I realized that.
A problem?
One exploitable issue I can think about is that since PGP signed comments are not verified at submission time, you can never know if a comment with the PGP header and footer is indeed a valid PGP signature. A spammer could put some bogus header and footer and spoof a valid looking PGP comment and get away with it. The obvious way to counter this is to validate any PGP signed looking comment as soon as it is submitted and then if valid, to decide not to tag it as no-follow. This raises the possibility of a DoS attack since validation process puts a not too insignificant load on the machine and given that spammer attack in a swarm, it seem to me to be a very relevant threat. The spammers may not be aiming for such an attack, but the joint effect of their comment attack and our system could be just that.
Re: Who Do You Trust?
How did you implement this? Did you only change the templates or did you also have to hack in MT?
Re: Who Do You Trust?
This is a pretty cool hack.
(Yes, this *is* just a test comment because I’m curious to see how it works!)
Read the post
OpenPGPComment 1.5.1 released
Weblog: TriNetre - The Third Eye
Excerpt: Version 1.5.1 of OpenPGPComment has been released. It is a 2 line addition to version 1.5 code to (1) disable 'no-follow' in PGP signed comments (using new tag MTPGPCommentAuthorLink) and...
Tracked: February 21, 2005 3:11 PM
Re: Who Do You Trust?
I think the real reason Google wants us to add “nofollow” is to get rid all of these blog links which disturb their ranking algorithm.
Seb
Read the post
Full Disclosure
Weblog: Musings
Excerpt: A serious MovableType security vulnerability.
Tracked: January 6, 2007 1:54 AM
Re: Who Do You Trust?
Good, I get some PageRank! That’s especially important since I wasn’t even giving myself PageRank. The MT nofollow plugin adds
rel="nofollow"to all comments, even my own. I disabled the plugin after I realized that.