Users can create pages, but they can't create pages containing
arbitrary content. You can create a page saying "Hello, world!" but
it will render within the confines of an existing HTML layout. This
is why my suggested solution would involve google requesting you
create the google3493284alolwtf.html file with a random string and
only a random string in it.
Everybody knows about robots.txt, and so it's easy for system
administrators to alias whatever/robots.txt to the filesystem.
Additionally, again it would be impossible with most known wiki
systems to create a well-formed robots.txt file by a malicious user.
--Philip Neustrom
http://wikispot.org
On Nov 3, 3:17 pm, webado wrote:
> Well again this is yet another problem with wikis which allow non
> authenticated user input.
> The security flaw is at the wiki level, not Google's level.
> If anybody can add pages unhampered to a site they ARE owners of that
> site, as simple as that.
> Imagine that they can also upload or create a robots.txt file with a
> single directive to disalow all robots. You are in deep doodoo.
> Wikis seem to be a curse for spiders in more ways than one. Wiki
> navigation from what I have seen is a mess. You need to work so very
> hard to build a comprehensive robots.txt file
> On Nov 3, 5:25 pm, philipn wrote:
> > The current verification method poses a major security issue for a
> > good deal of wikis. Currently, all that is needed to verify
> > yourself as the owner of a site is the creation of a single page named
> > something like googlebacb14320d6b1bdb.html at the root level of a
> > site. Most wikis, however, allow anyone to create such pages.
> > There is a small amount of checking that the webmaster tools do --
> > they check to see if a small sampling of random garbage pagenames
> > return 404 or 200. However, many wikis return 404 for non-existent
> > pages, so this remains a serious and definite issue.
> > I suggest that the instructions include content for the HTML file to
> > contain and check that the exact same content exists at the provided
> > location.
> > --Philip Neustromhttp://wikispot.org
