COGBLOG

In the last few months, I’ve learned quite a lot about web application security. Not to say that my knowledge is comprehensive–this is a topic where the more you learn, the more you realize you need to know.

One of the very best blogs I’ve found on the topic is RSnake’s ha.ckers.org. Always a fresh article, lots of good links, and very readable for a fairly technical topic. It is worth checking out.

Thursday, he posted a link to this very nice SQL Injection Cheat Sheet. And, he has his own XSS (cross site scripting) Cheat Sheet as well.

Yay, get paranoid everybody!

Yahoo is in the process of upgrading some sponsored search accounts to their new “Panama” system, but one result may be a loss of control over the bidding process.

In speaking with Yahoo about potentially upgrading some of our accounts we learned that while the new system will not allow bidding for specific position, there will be no fundamental change to the way positions are determined when sponsored listings are displayed. So, for users of the old system, the reporting within the Yahoo Search Marketing interface which shows you’re current bid/position along with your competitors bids/positions will be inaccurate. This is because there will be “phantom bidders” –the users of Panama– who’s bids will not show up in the old interface. So you may think you are in position 2, but in reality there could be any number of Panama bidders ahead of you, and you’ll have no way of knowing.

What’s more, the Panama users will not be bidding for a specific position. They will enter a bid amount, but the system will return to them an estimated range of positions they should expect at that bid level–similar to Google AdWords now. Once fully implemented the system will take into account relevancy factors like ad copy, and click-through rates on your ad, along with bid level, to determine your ultimate position. But, and this is the scary part, that system will not be in place until every one moves to Panama. So, Panama users will actually be in a specific position based solely on their bid, but they won’t know what that position is.

Panama users won’t know what position they are in, and the old system’s users won’t even know the Panama users are there. Sounds like a problem to me.

Last night I pulled 20k names from a B2B mailing list to compare the most popular services. These are all from B2B leads generated in the last 4 months. Here are the top six:

#1 : Yahoo.com – 9.2%

#2 : AOL.com – 6.2%

#3 : HotMail – 5.7%

#4 : Gmail – 2.3%

#5 : Comcast – 1.6%

#6 : SBCglobal – 1.6%

BellSouth and MSN were #7 & #8 with 1.3% each.

So, as expected there are far more users of the free email services in the consumer audience. In the B2B audience 23.5% of the addresses were found in the top four free services, vs. 55% in the consumer audience.

I was recently digging through a client’s mailing list, curious to find out what mail services they use (and we should be testing). This was culled from about 18k names:

#1 : Yahoo.com – 31%

#2 : Hotmail – 12%

#3 : AOL – 7%

#4 : Google’s Gmail – 5%

#5 : Comcast – 2.1%

#6 : MSN – 1.8%

This was from a very non-business oriented list. I’m sure the composition would vary for a B2B site. Actually, I might have to look that up.

Here’s an interesting list of the most expensive current adwords phrases:

http://www.theproguy.com/most-expensive-adwords.html

Apparently there are some quite large margins in the “student loan consolidation” business. At $69.16/click they must be making a bundle from each actual sale.

Let’s see, this site http://www.nextstudent.com is the current top bidder (yes, I clicked the link…). Drops visitors directly on a lead gen page with a contact form. They ask for a fair amount of information, including a social security number, which probably hurts their conversion rates (I’m sure it is necessary). From the query string it looks like they’re tracking everything, so I’m sure I’m seeing one of many landing page variants.

But, assuming they have a 5% lead conversion rate, they are still looking at a $1,400 cost per lead? It must be better than that…but still at 10% they are looking at $700/lead, and that is just a pre-qualifier. Those cost of sale expenses are going to add up quick. Hope they have some good salespeople.

One of the best features of the ROI tracking tool we built for ourselves here at COGBOX is the means to identify the true referring URL for each of our sponsored search referrals.

This allows us to evaluate the performance of the publishing partners for each network, and eliminate them from the campaign distribution if they are poor performers. Google AdWords allows you to eliminate particular sites referring adwords clicks from the distribution network for your campaign. However, they won’t share with you which sites are in the distribution network to begin with.

Most analytics packages will allow you to track campaigns and view referrers (the actual URLs sending you traffic) from those campaigns. But, I personally find that the reports from a more sophisticated package provide too much information. Instead we built a very simple campaign tracking tool that pulls our referrers by campaign and presents them in a simple report.

Results are interesting. Out of 39,000 visits delivered from one campaign only 48% of the traffic came directly from Google.com. The rest came from about 500 google AdSense distribution partners. These other sites vary tremendously in quality. For instance, visits from “searchportal.information.com” converted to leads at a rate of only 0.8% vs. 4.9% for the campaign as a whole.

It’s old news by now, but as it relates to my previous post, the Yahoo Search Marketing revamp has been delayed until next year. Too bad, because the system really needs an overhaul.

The official line was that they didn’t want to disrupt campaigns prior to Christmas. But, I have the suspicion that they’ve discovered just how much work needs to be done. Even when you have a nice template like Google AdWords, it is suprisingly difficult to build a really good interface to a complex system.

My hope is that they will take the time to do it right. Not just apply some patch job to the old system and relaunch it (similar to the way Ask.com used the Looksmart system).

I’m sure the 20% one-day market-value plunge after the announcement lit a few fires.

We got some details last week on the upcoming re-launch of Yahoo Search Marketing, Yahoo!’s Pay-Per-Click sponsored search marketing system.

The very first sponsored search system was created by GoTo in 1997 (they launched in the same month as COGBOX). They eventually changed their name to Overture, and were later purchased by Yahoo!. The current management interface for Yahoo Search Marketing (I’ll refer to it as YSM) is still essentially the same system as the original GoTo system.

In the meantime, a little outfit by the name of Google launched their own system with a much easier-to-use management interface and sign-up process. While GoTo/Overture/Yahoo went one way–higher minimum bids, keyword grouping with Match Driver, more lengthy editorial review, pay for specific position–Google went the other–lowered minimum bids, bid any keyword and match type separately, instant ad publication, and relevancy factor influencing position. What has eventually emerged is a Google system that is more powerful, and far easier to use than Yahoo!’s.

But, now Yahoo is hoping to change all that with their new system code named “Panama” (ya hear that? we’re usin code names). Among the new features expected to roll out soon:

• A relevancy factor influencing bid – No longer will you be able to guarantee top position by price alone. Now your bid will be affected by a relevancy multiplier that considers your title, description, historical click-through rate, landing page, and other “secret” factors.
• Fast editorial – ads will go through an automated editorial process, so most will go live immediately rather than the current 2-3 days.
• Ad Testing. You’ll now be able to run multiple ads to test alternate creative versions.
• A new user interface described as “more of a visual model”. I’m not sure what that will be, but sounds interesting.
• Longer reporting periods. You are currently limited to a 90 day period for reports, which I find extremely irritating. The new system will allow up to two years.
• Geo-Targeting by City, State or Country.
• A new Ad Group oriented system where you can assign the same creative to multiple keywords. In the current system you have to specific one creative with one keyword–a management hassle.
• Scheduling – turn ads on/off by day.
• Forcasting improvements to the keyword suggestion tool making it “more of a proposal tool”.

Also mentioned was the fact that their current Search Optimizer tool for bid management will be rolled directly into the new interface. This concerns me a bit as Search Optimizer is only compatible with IE6. It is one of those few occasions where I have to fire up the PC. The other is when managing MSN AdCenter campaigns, which I dislike but at least sort of expected. I was told that the new system is currently planned to support only Internet Explorer on Windows, but that this may change.

To me, most IE-specific interfaces are less usable than those built for a larger browser and platform audience. I just don’t see the advantage of building a system that is incompatible with 10% (and rising) of your audience for the sake of some questionably beneficial interface features. And, if you are going to use Google as a model, why not adopt their excellent approch to web development?

All-in-all, it sounds like there will be some significant, and much-needed improvements in the new system. I’ll post more once I get my hands on it.

Honestly that title almost sounds like complete nonsense. But, it is not.

Google announced that they are scrapping the Froogle Merchant Center, and that all submissions to its comparison shopping engine, Froogle, will be handled through the Google Base interface. What’s more, you can now make submissions to the service in RSS, or Atom formats.

Thursday Google is expected to release their new payments service, Gbuy, which I’m sure will tie into Google Base as well.

Just a follow-up to my previous post.

After checking the 22 unique ip addresses from today’s onslaught, it appears Korea is leading the charge. 14 of the 22 ips were from that country. Here’s how it broke down:

Korea: 14
China: 4
Jordan: 2
Thailand: 1
USA: 1