Anyone can make a mistake, release a product without considering all the possible ramifications, but to release Opt-in Accelerator again without major changes is irresponsible.

The Irresponsible Viral Tell-A-Friend Trio

So far there have been 3 such scripts I have written about, and there is a 4th "coming soon"

• My first coverage of Opt-in Accelerator
• Then there was Viral Optin Generator which may well have been a private label or resale rights product
• Viral Inviter is launching soon - last I saw of this script installed "out in the wild" it was a security risk
• There is another one I know about, TrafficXplode 2.0 which also features the same security risks

Relook @ Opt-In Accelerator

You see that big red circle I added?

That is the key to unlocking:-

• Your Email
• Your Google Adsense Account
• Your Google Adwords Account
• Google Analytics
• Google Website Optimizer
• Your PayPal Account
• Affiliate program passwords
• Access Your Blogger account
• Access any scripts that allow you to resend or reset passwords
• Open any social media profile that used that email address
• Did you use that address for domain records? Wave goodbye to your domains

I am not claiming that anyone creating such as script is dishonest, or even the people who might use them, but it takes a huge investment of manpower and financial muscle to keep personal data secure, and those are things most internet marketers don't have.

All it takes is a script kiddie to come along and compromise the script running on your server, and then rather than acting as an "innocent" tell-a-friend script to boost your email subscribers, it would collect login and password information and forward it to an anonymous server.

All it would take is 2 lines of additional code

We will ignore many of the other potential problems with scraping the email services against their terms of service, potentially breaking the terms of the autoresponder service you use, or totally trashing your email deliverability as 100s of people flag your messages as spam.

I think Robert Plank covered that aspect of Opt-in Accelerator quite adequately.

Solutions

Password data should never be entered in an insecure form hosted by someone without exceptional security in place.

Very Simple Mail To:

This example from Plurk (they also use the insecure method, and have been accused of spam with their Facebook implementation)

This code is wonderful because people use their own email server to send the emails, no strain on your servers, so it could be used on any server, even a shared account which has limitations on how many emails you can send per hour.

Existing APIs

Google Yahoo and Microsoft also have APIs for this kind of stuff which can also be used for finding friends.

Google Contacts API
Yahoo! Contact API
Windows Live Contact API

I should also mention the ongoing Oath efforts being made to create a unified interface for retrieving contact and other personal information with permission.

To be fair, I am going to give Jason a link with some partial counter arguments. He seems to think it is worth the risk.

The problem with that argument is that there is no need for this to be a security risk. It is just junk programming.

Related posts

• How To Screw Up Your Internet Business (13)
• Viral Optin Generator Warning (12)
• Optin Accelerator Closed - Too Risky? (24)
• ZeroRank - More PageRank Carnage (Round 5) (94)
• You Can't Charge For Twitter Popularity (10)
• Wrong Reaction From Techcrunch On Paid Links? (46)
• WordPress.com Subdomain Spam With Tags? (23)
• WordPress.com Bugged XML Sitemaps (14)
• Wolfpack of Lies - Hack Baiting Web 2.0 Startups For Diggs (13)
• Will The FTC Investigate Google & Matt Cutts For Paid Links? (updated) (24)

The idea of specific insurance policies for bloggers, as a form of liability insurance to cover defamation cases has been around for some time.

It seems even Jason Calacanis at one time was thinking of entering the market

Domain Name: BLOGGINGINSURANCE.COM
Registrar: AOL, LLC
Whois Server: whois.registrar.aol.com
Referral URL: http://www.registrar.aol.com
Name Server: NS1.WEBLOGSINC.COM
Name Server: NS3.WEBLOGSINC.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 26-mar-2007
Creation Date: 01-aug-2004
Expiration Date: 01-aug-2008

Whilst Michael Arrington has been throwing a little scorn on the Media Bloggers Association it does seem to have some long standing (3 years) roots and some pedigree.

In an announcement today covering some of the back story of the legal complaint the Associated Press raised with the Drudge Retort, there were some interesting things revealed.

Story Leads

That vital opening paragraph in any article or news item.

• Encourages continued reading when above the fold
• Might be used as a custom excerpt on landing pages (before the jump) to encourage clicks
• Appears in excerpts on socail media aggregators such as Techmeme and Technorati
• If used in a meta description, part of it might appear in search engine results
• It makes an obvious choice for use with social media submissions

Apparently the Associated Press look on their Headline + Story lead as being a core part of their news articles, and reproducing them either exactly or paraphrased might make you liable of copyright infringement.
Creating a news summary based on their coverage containing all the facts might also land you in hot water.

The alternative point of view is very clearly portrayed by Mike Butcher of Techcrunch UK also reported on the main Techcrunch site

Scott Rosenberg puts it differently

The trouble is that fair use law does not, apparently by intention, draw a simple line. It sets up a bunch of criteria that you have to weigh. And so the nightmare reposted-feed site is almost certainly not a fair use. A Digg home page with lots of AP stories? Well, on the one hand Digg is a business that conceivably is taking business value from AP; on the other hand, Digg users rate and discuss stories, so they’re adding them. And AP accounts for only a little bit of Digg’s total volume of stories.

Note: I would have already proposed an "Associated Press Nofollow Plugin" but that is near on impossible - their news stories are syndicated to other sites, and it could be one of 1000s of sites where you first see a story and might give a link. Should bloggers nofollow all newspaper sites? They never or very rarely link to us.

Blogging Insurance

Also included in the article by Robert Cox is the introduction of blogging insurance for members of the Media Bloggers Association.

Cost breakdown

• $25 to join the Media Bloggers Association
• 45 minutes to complete an online course
• $540 for "media Pro" insurance for bloggers earning less than $10,000 per year.

Hang on a second, that isn't workable

It is impossible to determine earnings from a blog:-

• Direct Advertising
• Affiliate programs
• Membership programs with attached blog or vice versa
• Donations
• Consulting
• Branding and speaking gigs
• Links to other web properties not related to blogging

Robert Scoble, Seth Godin, Jason Calacanis, Matt Mullenweg, Jeff Jarvis and many other top tier bloggers most certainly gain more financial benefit from their personal blogs than I do, yet don't overtly monetize. Fred at A VC has advertising, and the money is donated to charity.

It was mentioned being "impossible" coming up with $2,000,000 to fund a dedicated service, yet so many VCs benefit from the honest feedback from the blogosphere, and their investments gain so much free coverage, $2,000,000 is just a drop in the ocean, and it would be a viable business, even if it needed to be subsidized a little.

Maybe look on it from the reverse angle - startups looking for coverage by bloggers should contribute to a blogger immunity fund that waives prosecution of bloggers writing about them. That fund could be used to help protect bloggers on all topics, or at least seed such a fund.

If bloggers have strong legal protection from such an organization, big business trying to use SLAPP tactics would be heavily reduced.

Without adequate protection, the whole blogosphere effectively become shills, because they can't write negative (though constructive) reviews of services for fear of legal action, and even comments on blogs become a legal liability.

Paid review blogging services should also be contributors or offer their own protection

Vlad Is Still Being Sued By ePerks

This isn't my first mention of Vlad's ePerks defamation case, I certainly don't intend to stop.

He has actually updated that post with details of his legal representation -Karl Kronenberger of Kronenberger Burgoyne Internet Law Firm

It is interesting that the EFF have made statements regarding the AP vs Drudge Retort case - surely Vlad's case deserves some airtime too.

Greg at the Bloodhound Real Estate Blog has been updating on contributions to the legal fund so far - on 16th June is was less than $2000

Thanks to all the contributors, and I am not sure where they have come from as I have personally seen over 30 blog posts.

However my opinion so far - that is pathetic

I encourage people to grab a donation button, and don't forget to donate (the fund is being run / controlled by Greg Swann at the Bloodhound blog)

Support Vlad Zablotskyy's Defense Fund Defend your own right to free speech!

I know Vlad is grateful for every contribution - I received a personal thank you email from Vlad showing his appreciation after my donation

It is great to think that all bloggers should already have some kind of business liability insurance, but if you are barely covering hosting costs, or your earnings from blogging are not much more than national minimum wages, the thought of having to hire a lawyer on retainer just doesn't enter into it.

Your chances of being sued are just as likely on a small blog as one with 100K+ subscribers

Related posts

• ePerks & iHype - Legal Kneejerk - Sues Blogger (57)
• iHype & ePerks - How To Kill A Startup (26)
• ePerks - I Am Not A Minion Mr Cook (21)
• Eperks On Mahalo (4)
• Am I Really A Good Person? (19)