Tech CEO's Negative Coverage Vanished from Google via Security Flaw

Journalist Jack Poulson accidentally discovered that Google had completely removed two of his articles from search results after someone exploited a vulnerability in the company's Refresh Outdated Content tool.

The security flaw allowed malicious actors to de-list specific web pages by submitting URLs with altered capitalization to Google's recrawling system. When Google attempted to index these modified URLs, the system received 404 errors and subsequently removed all variations of the page from search results, including the original legitimate articles.

The affected stories concerned tech CEO Delwin Maurice Blackman's 2021 arrest on felony domestic violence charges. In a statement to 404 Media, Google confirmed the vulnerability and said it had deployed a fix for the issue.

And, for tomorrow's headline:

[SvnLyrBrto]

Tech CEO discovers the Streisand Effect.

Capitalization counts?

[innocent_white_lamb]

I never realized that capitalization counts in a URL.

I had always assumed that, similar to an email address, uppercase and lowercase was treated as the same letter.

Re:

[groobly]

Apparently you are in good company at Google.

Re: Capitalization counts?

[KnobbyMcKnobface]

Only the scheme ("https") and host ("example.com") are always case insensitive. Citation provided: https://www.rfc-editor.org/rfc... [rfc-editor.org]

Re:

[CyberSlugGump]

It can depend on the web server platform. Linux-based servers are more likely than Windows to care about case. It can also depend on what part of a web address you are talking about. Amazon uses a 10-character Amazon Standard Identification Number in its web pages. While those typically appears as all caps in URLs, they aren't case sensitive, and you could use lowercase letters to still get to the page. On the other hand, the 11-character IDs used by YouTube videos ARE case-sensitive. (The same goes fo

Re:

[taustin]

It doesn't matter on the FQND, up to the first slash. After that, yeah, it matters, because most web servers run on operating systems that are case sensitive.

Re:

[Anonymous Coward]

You can't expect Google to know esoteric details like how URIs work!

Re:

[taustin]

I'm not sure it's "doesn't know" so much as "doesn't care." I mean, how can they monetize mixed case searches for advertising?

Re:

[AvitarX]

Capitalization can count in an email address too.

The part before the @ in an email address is handled by the mail server.

Similarly, the part after the third / in a URL is handled by the web server (or other server for not http: [http])

The host/domain part of the address in either is not case sensitive.

Wait!

[Ossifer]

How are we supposed to surmise a conspiracy theory around this?!

Re:

[abulafia]

It takes work on your part. RTFM, it will help a lot - there's a lot going on here.

You've got a shadowy "gigwork" intelligence outfit, SFPD and private eyes, involvement by Trump lawyers, and about $30M spent on legal coverups.

Re:

[Ossifer]

Anything about "precious bodily fluids"?

Re:

[abulafia]

Trump lawyers, so probably.

404 Media

[jddj]

Pretty on-the-nose.

Re:

[Tony Isaac]

Do you suppose *everything* on 404 Media got delisted???