HN Explorer

15 comments

[ 2.5 ms ] story [ 44.4 ms ] thread
asadpanda
Well the user searched news not the general web. Not sure how big of an issue this is. AOL site delivers their search results from google anyways.
rachelbythebay
Sure, they did do a news search, but it also fails at that. How do any of those results fulfill that request? My post did not contain the word "AOL" at all. My only post with that particular sequence of characters before this morning was one from April 21st which talked about the decline of empires, Netscape being eaten, and all of that as seen in Coders at Work.

People are going to do web searches for things which make no sense to technical types. We can either roll our eyes at them (or worse), or we can accept them as a quirk of the human condition and create systems which will provide an acceptable experience even though they don't "get" the web the way we do.

I'm not sure, but I think the latter one might be far more profitable.

mcclung
The first non-ad result for me is mail.aol.com, as it should be.
aswanson
AOL continuously highjacks my default browser search (firefox, I search from the field these days) to their annoying wrapper-over-google search engine. The inanity is widespread.
aphyr
AOL does a lot of weird things. Last year, jrecursive actually observed that their servers would make an HTTP GET for any URL passed over an AIM conversation. Looks like that doesn't happen any more, though.
[deleted]
(comment deleted)
[dead] lmm
I don't think that's particularly crazy. It allows them to do antiphishing (at some cost to the user's privacy, but if you object to that you're not going to be on AOL), and as someone running an HTTP server on the public internet you should expect to receive arbitrary GETs from random sources.
pjscott
The moral of that story is, don't do anything in response to a GET request that you don't want randomly triggered by bots. That's what POST and PUT are for.
baddox
Of course, there's nothing stopping AOL from doing a POST or PUT request either, or a DELETE for that matter.
nkassis
Using CSRF token should protect against that and is good practice.
aphyr
CSRF won't protect against traffic sniffing; only third parties constructing URLs.
derleth
By that logic, there's nothing stopping AOL bots from flooding your domain with TCP SYN requests and taking you down. It would be sinful, but it's possible.

The point of standards is to provide a place for people to meet each other halfway. Protocol standards especially.

lurkinggrue
AOL is still in business?
drgath
Very much so. If you are the average HN reader, odds are likely you visit AOL sites on a daily basis. Also, the stock is up 88% over the last 12-months.

But, I feel like they've given up on being anything other than an SEO / blogging / display advertising sweat-shop. Although it seems to be working for them.