9 ms·

MLB.com is using my Google Analytics code

224 points by rduchnik 12y ago

z3bra 12y ago
Nice unintentionally linkbait. But does their code looks similar to yours?
- deletes 12y ago
  Look at the code as the author suggests; you will notice that a part of the code( ~40 lines ) is identical, including the comments.
  - ars 12y ago
    That's because google gives it to you that way. Much more likely this is a typo in the ID number.
    - eropple 12y ago
      If you're typing that number in by hand, my WAT flag is flying.
    - arbus 12y ago
      If it is a typo in the ID number, thats understandable. But the social tracking id seems to be wrong too and that also points to the authors id. Can't be wrong twice and have both mistakes point to the same person
      - bagels 12y ago
        It could be, but it's exceedingly unlikely to be.
    - tg3 12y ago
      They copy-and-pasted from Google and then changed one of the characters in their ID? Possible, but Occam's Razor and all.
    - deleted 12y ago
      [deleted]
    - JeremyMorgan 12y ago
      Yup, my guess is the ID is a variable in some templating system or CMS that MLB uses, and someone (for some reason) was typing it.
    - rooted 12y ago
      A 16 digit alphanumeric id? It's far more probable they just copied his code
    - Theodores 12y ago
      Apparently it is just a hash collision. Sergei knew about the potential for a problem with crc32 so they went with crcgoogol instead. Clearly the 1 in 10^42 eventuality happened, improbable as it seemed.
  - rduchnik 12y ago
    Well actually it's two sets of codes I use which is custom script I put together to track two ids since I have a lot of subdomains. Not how Google gives it to you, which leads me to believe it was copy and pasted. Still not sure how that could happen though.
mahmud 12y ago
Someone done goofed. Google Analytics and other KPI chew-toys and gadgets are what keeps executives busy while people get work done. This will not go unnoticed.
- untog 12y ago
  Oh please. A good developer cares a great deal about analytics. To do otherwise is to arrogantly presume you know your user when you likely don't.
  - mahmud 12y ago
    Oh agreed, analytics is everybody's business, but even more so for higher-ups. Specially for an organization like MLB, with a tall org-chart.
    - PostGreHipster 12y ago
      Depends on the developers. Marketing developers crave the analytics but IT/Engineering devs are more concerned with site speed.
      - nknighthb 12y ago
        Everyone should want analytics. Better numbers can mean less work, or more focused work. You can prioritize improvement of features people use the most, drop ones that nobody cares about, or decide you're in a good place to spend less time on features and more time working off technical debt.
      - yaur 12y ago
        No way. I absolutely want to know how my users are interacting with my sites and site speed is definitely one of the analytic numbers that I look at whenever new builds go out. We test this stuff of course, but dealing with prod loads and usage patterns (how do you know what they are without analytics?) is not something that it is feasible for us to do.
untog 12y ago
FYI (the author, if they're here), your site doesn't load in Firefox for Android. Not sure why.
- DevUps 12y ago
  It loaded in FF for me. V28 Linux. Have you tried turning off your machine and turning it back on after 5 seconds?
  - untog 12y ago
    I suspect V28 Linux is different to the mobile Android version.
    - jonalmeida 12y ago
      FWIW: Linux V27 - working.
      - jonalmeida 12y ago
        Just realized that I read the initial post as, "Firefox OR Android". Verified it's working on Firefox for Android now. (Nexus 5)
- BorgHunter 12y ago
  Works for me. Firefox 28.0.1, Android 4.3.1.
- chmars 12y ago
  With Safari on my iPhone, the site loads but is unreadable due to are and a screwed up layout.
jrockway 12y ago
Good thing the author didn't ask for "express written permission" to use his code. The irony would have been too much for me to handle.
- swasheck 12y ago
  Any rebroadcast, reproduction, or other use of the code and ids of this site without the express written consent of rduchnik is prohibited.
ChuckMcM 12y ago
Now if you can get them to steal your AdSenseForContent code you are golden!
- fletchowns 12y ago
  The author already made that joke in the article...
- ChuckMcM 12y ago
  Interesting, I was serious. Sure the OA says, "Too bad they didn’t copy my adsense codes, that would have been a nicer surprise." which makes sense since Analytics and Ad inserts are completely different but if you can get someone to do that you are "golden." (not really though since everytime your adsense revenue changes suddenly you get put on fraud watch) And of course to do that you have to have your styling JS go down and re-write things in the ad fetching JS. Not impossible I suppose but well beyond my js-foo.
deleted 12y ago
[deleted]
hanswang2013 12y ago
LMAO
bhashkarsharma 12y ago
One morning, we woke up to see Google Analytics sending us data from an external site. When we opened that link, it turned out to be a clone of our website. They had crawled the entire site (which was designed by our partners) and replaced the logos and text. The GA code was still there.
- cloverich 12y ago
  What next? Would love to hear more details.
  - bhashkarsharma 12y ago
    Coincidentally, our site redesign was internally being worked on, and we updated the site in a day or two. We decided it is not worth going through the hassle of chasing someone who claims their expertise to be cloning a website. That's the product they were selling. Clone websites. And I daresay they proved their competence by cloning ours.
  - techdragon 12y ago
    At least he has info on his recently created competitor's success.
sergiotapia 12y ago
So you share this hilarious bit and leave out the juicy details!? How large of a spike are we talking about here? Share your digits bro!
- rduchnik 12y ago
  Well it's not THAT much of a spike, at least not so far. Although the number has increased significantly since the screen shot. Right now I'm just curious to see how long it will take them to notice.
  - kevando 12y ago
    This is why OP gets such bad raps! Screenshot the digits!
    - rduchnik 12y ago
      I will when the dust settles.
dalek2point3 12y ago
I wrote an example for graduate students in the US to create a webpage and directed them to look at my webpage for an example template. Now they all copy my analytics tracking code, and I have like tens of student websites that I'm tracking me. It annoys me. I think we should have some sort of two-way authentication or atleast a way to "mute" certain domains or only whitelist certain domains in the reporting side of GA. Perhaps it exists?
- thejosh 12y ago
  Seriously Google, unless the domain == example.com , don't show it by default.
  - rduchnik 12y ago
    Actually it's so you can track multiple domain with one code. I do this with subdomains so that I can see all my traffic as well as by individual subdomain.
    - thejosh 12y ago
      Hello User #1122111, we see you are trying to track potatoes.example.com , would you like to show this? Y/N
      - diminoten 12y ago
        It probably doesn't come up all that often.
        thejosh 12y ago
        Great, which means most users will never see the message when someone adds their tracking code.
        diminoten 12y ago
        It doesn't happen that much, so "most users" is going to not be very many users.
dangero 12y ago
I once hired an offshore developer on ODesk who stole my code and resold it. I discovered he was doing this because he left my analytics code in. Same deal; I woke up one day to analytics showing traffic on a domain I didn't own, so I went to look and it was basically a mirror of my site.
- spoiledtechie 12y ago
  did you get it taken down?
  - kevando 12y ago
    Yeah, I'm curious what happened? I had a client have something like this happen. No stolen code, but someone copied her site.
    - smacktoward 12y ago
      I had a friend who had this happen to her -- some SEO spammer picked up the complete text of her blog and posted it under a bunch of different domains, full of hidden links. It was reasonably easy to deal with, though; all you need to do is figure out where the sites are hosted, and then submit a DMCA complaint to the host's abuse address indicating they're hosting illegally copied copyrighted material. Legitimate hosts will take stuff like that down pretty quick. There's two things the DMCA requires that they'll look for in your complaint before they'll take action, though, so make sure you include them: 1) The statement "I swear under penalty of perjury" that you hold the copyright for the material, or that you are representing the person who does; and 2) A list of filenames that contain the infringing content. (If the host won't take action, you can file the complaint at whichever registrar the domain was registered through, too.)
  - dangero 12y ago
    I contacted ODesk explaining what happened with all the evidence. By the next day the guy I had hired was contacting me saying that ODesk suspended his account indefinitely. He continued contacting me for about a year saying that he could no longer feed his family after "what I did". It was kind of a nightmare, but I think ODesk had pretty swift judgement because that's the kind of press they don't want. I also talked to the company that was using my code. They explained that they had hired him on ODesk and had no idea. They wanted nothing to do with the stolen code, and were very apologetic for their accidental involvement.
patmcguire 12y ago
What if I steal your GA code for my app, which has such routes as: /I-know-one-weird-trick-to-save-money-on-car-insurance /buy-coke
- yaur 12y ago
  This is a common marketing strategy for people with products that target webmasters and/or general spammers.
rduchnik 12y ago
Well mystery solved. I did a bit of sleuthing and noticed they have a scratch card at the bottom of the page. I had written a scratchpad plugin so I did a quick search for "wScratchPad" and sure enough it's there. They copied my sample code from http://wscratchpad.websanova.com http://wscratchpad.websanova.com, div's css and all and, you can even see the same `id` and `class` names. I guess they copied a little too much.
- aedocw 12y ago
  Parent comment should be at the top of this submission. The response from MLB about "our CI creating randomly generated GA codes" is kind of ridiculous, when the truth is someone there did an excessive cut and paste from someone else's JS.
- cyphunk 12y ago
  It's the internet. Copy+paste für immer. Get over it.
- xofer 12y ago
  > Kind of feel like a bit of a jackass now Wait, why do /you/ feel like a jackass?
  - adamman 12y ago
    Because he included his google analytics code in the plugin that he made available to the world.
    - underyx 12y ago
      He did not. It was only placed on his demo site and the guys at MLB just copied that site's code instead of using the released plugin.
- 1234tester 12y ago
  I guess you released a little too much, generally you want to remove your GA code and replace it with a placeholder like: '<insert GA code here>'...
vojant 12y ago
I have seen something similar, when three companies stolen award-winning design of digital agency I used to work for. They just copied whole code (including comments in javascript) and changed logos/texts but they haven't change our ga code.
6a68 12y ago
I think it would have been cool to ping one of the MLB.com developers, not write a blog post and laugh at them publicly/without warning. Just sayin'.
nness 12y ago
I thought GA was tied to specific domains; wouldn't GA not track MLB.com traffic?
- jacques_chester 12y ago
  Nope. GA is based on UA numbers (UA-12345 etc). You can reuse a number across multiple domains, so that you can (for example) aggregate a network of sites. GA allows you to then break down stats by domain.
tericho 12y ago
Hilarious. You probably aren't seeing a huge traffic spike because it's a microsite that hasn't been launched yet. It also appears to be outsourced or in some sort of BETA since the script management is atrocious. Run a Chrome audit - it's only a landing page and still makes 37 different JS file requests & 13 different CSS file requests, none of which are minified. Granted many "professional" sites ignore client-side asset performance but regardless, 120+ HTTP requests for a landing page is laughable. Edit: Might be same shop as mlb.com, they don't appear to care about asset performance either.
fekberg 12y ago
Doesn't Google Analytics cost money after a certain amount of hits per day/month? If that is the case and the gap was hit, would MLB.com be liable to pay the fees?
- endianswap 12y ago
  They don't just start charging you, they warn you that you're at the paid level and need to pay or stop using so much.
  - glneo 12y ago
    And then you can do nothing about it because MLB.com has outsourced their site and they stole your analytics codes. I guess you could change them, but still the question is: are companies that outsource to shady firms liable for copyright/damages that will result from said decision.
  - fekberg 12y ago
    That's good to know, thanks. I've seen too many companies starting to charge you instead of giving you a fair warning.
    - dudus 12y ago
      The Paid version is called Google Analytics Premium and requires a contract in place between the client and Google or a reseller. You won't get a bill out of the blue just for being over limit.
- Gustomaximus 12y ago
  Google limit tracking to 10 million recorded events per month. Funny thing is almost know-one knows this of the analysts/developers/marketeers I work with and take GA as gospel. If you have a site with large tracking requirements you should look at paying or manually adjusting your sampling rates (if you have consistent traffic) otherwise results will be skewed to the earlier part of the month. More reading: https://support.google.com/analytics/answer/1070983?hl=en https://support.google.com/analytics/answer/1070983?hl=en
rduchnik 12y ago
There is a comment on my blog from a developer from MLB.com for anyone who is interested: "Hi - Engineer from mlb.com here. It appears this goes a bit deeper down the rabbit hole than meets the eye. Apparently there’s some code laying around in our tests run by a CI setup that randomly generates a tracking code to mock third party scripts (Google analytics, ad tracking, etc) instead of using our actual IDs as to not mess with our marketing guys’ numbers (we run a LOT of tests on CI). The strange thing is that your IDs aren’t being pulled from your site, but have randomly been generated the same way many, many times and then been shipped out to our production server by mistake. We can’t figure out why this is happening, but are looking into the build system and how it caches data. Luckily I read HN or we might have never caught this!"
- glneo 12y ago
  cough bullshit cough, The statically probability that you would generate an actual AND proper tracking code that also just happens to be used by a site that shares all you code is less than can be described. Your team got caught outsourcing jobs to code copy/paste firms.
  - daybreaker2 12y ago
    "Wow, what a coincidence... we just happened to randomly generate a google analytics ID that was the exact same as the one used on a scratchpad plugin that we copied the code from..."
    - skeletonjelly 12y ago
      If only calculating the odds of this were as fun as 2048 we'd have a bunch of different solutions on the frontpage of HN for the next 2 weeks!
  - zavulon 12y ago
    And wouldn't it make more sense to create a test GA account and just use the ID from there for everything, instead of generating randomly each time?
  - 12y ago
gkcgautam 12y ago
@MLB.com But why are you generating those random IDs at all? That means you guys are sending false tracking data to so many websites using those IDs. Stop doing this! Create a different tracking ID for testing or something!!
- catshirt 12y ago
  right. more importantly, a testing ID allows them to you know, test their tracking mechanisms.
ApolloRising 12y ago
For anyone else experiencing this problem what you can do is simply setup a filter in Google Analytics to only allow your domain to add traffic to your google analytics profile. Inside google analytics goto filter, create new filter, select custom filter, select include filter, Enter hostname in the filter field, enter your websitename\.com in the filter pattern box, Apply this filter to your profiles for websitename.com and you should be good to go
- oniTony 12y ago
  That's most of the way there, but if there's sufficient amount of combined traffic, ad hoc reports will start populating from sampled data instead of showing exact results. This might prevent getting any meaningful data about e.g. how A/B test is performing when filtered to a specific segment.
  - ApolloRising 12y ago
    oniTony not sure what you mean exactly since this would just filter traffic to your own domain. This only works moving forward and usually is setup when a profile is created. Filters will not work retroactively with Google Analytics. Would be happy to discuss if you could clarify your statement regarding A/B testing.
    - oniTony 12y ago
      I went back to the Analytics Admin panel to double check, and it indeed looks like filters are applied to specific views. The tracking code collects data at the property level. From https://support.google.com/analytics/answer/2637192?hl=en https://support.google.com/analytics/answer/2637192?hl=en > If the number of visits/sessions to the property in the given date range exceeds 250K visits/sessions, GA will employ a sampling algorithm... > It is important to note that session sampling occurs at the property level, not the view level. So it sounds like reports will sample 250K from total traffic first, and apply the view filter after. This has the potential to be left with reports generated on too small of a sample.
seanalltogether 12y ago
Back in 2003 Sony Pictures hotlinked some javascript code I had created for handling Flash->javascript communication. Back then all I could think of was using it to float a dancing robot over their content. These days I guess you can get away with a lot more.
ColdHawaiian 12y ago
On a side note, when I visited the blog, it triggered a Web of Trust warning because it got flagged as spam: https://www.mywot.com/en/scorecard/websanova.com https://www.mywot.com/en/scorecard/websanova.com. It looks like a legit programmer's blog to me, so I gave it a full positive review.
gk1 12y ago
Meta comment: This thread has seemed to attract more nonsense comments -- many are almost entirely whited-out -- than usual. Why? Whatever happened to the endorsement idea?
Brajeshwar 12y ago
People usually steals my designs. Well, I stole better but that's another story. I once had my site's design stolen complete with my CSS, Javascript errors, the Analytic and the Adsense Code. I think I have the screenshots somewhere on Flickr. The irony was that, mine was powered by a WordPress theme that I designed and was available as a free download.
lurchpop 12y ago
mlb://mlb:mlb@mlb.mlb.mlb/mlb.mlb?mlb=mlb#mlb
jacquesm 12y ago
One day Microsoft (msn.com) to be exact hotlinked a small gif from one of my servers. Support did not respond at all to my inquiries to please have it removed (the msn.com homepage had a lot more traffic than I was used to dealing with) so I replaced the gif on my server with the "netscape now" button. This was at the height of the browser wars.
- iagooar 12y ago
  Epic stuff, did you finally get an answer from Microsoft?
  - jacquesm 12y ago
    No, but they removed it lickety split :)
i_like_robots 12y ago
I've had this issue too with some of my old, Open Source jQuery plugins and even keeping the scripts separated (into the document head and at the end of the body) and commented didn't seem to work. Developers looking for the cheap and easy copy and paste I guess don't recognize the difference. Fortunately GA supports simple filtering to mitigate it.
pa7 12y ago
I've created an open source project and forgot to remove my tracking code too. The only thing was, I was hosting my own analytics with piwik, so the tracking code came from my domain. Although I marked the code with comments lots of people still left it there. If I was a bad guy this would be an easy and subtle XSS attack vector
enterx 12y ago
Reviewing the comments made regarding this and other "Stackoverflow is down" kinda threads I start to wonder... are there so many so-called developers that just copy-paste 9-5?

224 points by rduchnik 12y ago

z3bra 12y ago

Nice unintentionally linkbait. But does their code looks similar to yours?

deletes 12y ago
Look at the code as the author suggests; you will notice that a part of the code( ~40 lines ) is identical, including the comments.
- ars 12y ago
  That's because google gives it to you that way. Much more likely this is a typo in the ID number.
  - eropple 12y ago
    If you're typing that number in by hand, my WAT flag is flying.
  - arbus 12y ago
    If it is a typo in the ID number, thats understandable. But the social tracking id seems to be wrong too and that also points to the authors id. Can't be wrong twice and have both mistakes point to the same person
    - bagels 12y ago
      It could be, but it's exceedingly unlikely to be.
  - tg3 12y ago
    They copy-and-pasted from Google and then changed one of the characters in their ID? Possible, but Occam's Razor and all.
  - deleted 12y ago
    [deleted]
  - JeremyMorgan 12y ago
    Yup, my guess is the ID is a variable in some templating system or CMS that MLB uses, and someone (for some reason) was typing it.
  - rooted 12y ago
    A 16 digit alphanumeric id? It's far more probable they just copied his code
  - Theodores 12y ago
    Apparently it is just a hash collision. Sergei knew about the potential for a problem with crc32 so they went with crcgoogol instead. Clearly the 1 in 10^42 eventuality happened, improbable as it seemed.
- rduchnik 12y ago
  Well actually it's two sets of codes I use which is custom script I put together to track two ids since I have a lot of subdomains. Not how Google gives it to you, which leads me to believe it was copy and pasted. Still not sure how that could happen though.

mahmud 12y ago

Someone done goofed. Google Analytics and other KPI chew-toys and gadgets are what keeps executives busy while people get work done. This will not go unnoticed.

untog 12y ago
Oh please. A good developer cares a great deal about analytics. To do otherwise is to arrogantly presume you know your user when you likely don't.
- mahmud 12y ago
  Oh agreed, analytics is everybody's business, but even more so for higher-ups. Specially for an organization like MLB, with a tall org-chart.
  - PostGreHipster 12y ago
    Depends on the developers. Marketing developers crave the analytics but IT/Engineering devs are more concerned with site speed.
    - nknighthb 12y ago
      Everyone should want analytics. Better numbers can mean less work, or more focused work. You can prioritize improvement of features people use the most, drop ones that nobody cares about, or decide you're in a good place to spend less time on features and more time working off technical debt.
    - yaur 12y ago
      No way. I absolutely want to know how my users are interacting with my sites and site speed is definitely one of the analytic numbers that I look at whenever new builds go out. We test this stuff of course, but dealing with prod loads and usage patterns (how do you know what they are without analytics?) is not something that it is feasible for us to do.

untog 12y ago

FYI (the author, if they're here), your site doesn't load in Firefox for Android. Not sure why.

DevUps 12y ago
It loaded in FF for me. V28 Linux. Have you tried turning off your machine and turning it back on after 5 seconds?
- untog 12y ago
  I suspect V28 Linux is different to the mobile Android version.
  - jonalmeida 12y ago
    FWIW: Linux V27 - working.
    - jonalmeida 12y ago
      Just realized that I read the initial post as, "Firefox OR Android". Verified it's working on Firefox for Android now. (Nexus 5)
BorgHunter 12y ago
Works for me. Firefox 28.0.1, Android 4.3.1.
chmars 12y ago
With Safari on my iPhone, the site loads but is unreadable due to are and a screwed up layout.

jrockway 12y ago

Good thing the author didn't ask for "express written permission" to use his code. The irony would have been too much for me to handle.

swasheck 12y ago
Any rebroadcast, reproduction, or other use of the code and ids of this site without the express written consent of rduchnik is prohibited.

ChuckMcM 12y ago

Now if you can get them to steal your AdSenseForContent code you are golden!

fletchowns 12y ago
The author already made that joke in the article...
ChuckMcM 12y ago
Interesting, I was serious. Sure the OA says, "Too bad they didn’t copy my adsense codes, that would have been a nicer surprise." which makes sense since Analytics and Ad inserts are completely different but if you can get someone to do that you are "golden." (not really though since everytime your adsense revenue changes suddenly you get put on fraud watch) And of course to do that you have to have your styling JS go down and re-write things in the ad fetching JS. Not impossible I suppose but well beyond my js-foo.

deleted 12y ago

[deleted]

hanswang2013 12y ago

LMAO

bhashkarsharma 12y ago

One morning, we woke up to see Google Analytics sending us data from an external site. When we opened that link, it turned out to be a clone of our website. They had crawled the entire site (which was designed by our partners) and replaced the logos and text. The GA code was still there.

cloverich 12y ago
What next? Would love to hear more details.
- bhashkarsharma 12y ago
  Coincidentally, our site redesign was internally being worked on, and we updated the site in a day or two. We decided it is not worth going through the hassle of chasing someone who claims their expertise to be cloning a website. That's the product they were selling. Clone websites. And I daresay they proved their competence by cloning ours.
- techdragon 12y ago
  At least he has info on his recently created competitor's success.

sergiotapia 12y ago

So you share this hilarious bit and leave out the juicy details!? How large of a spike are we talking about here? Share your digits bro!

rduchnik 12y ago
Well it's not THAT much of a spike, at least not so far. Although the number has increased significantly since the screen shot. Right now I'm just curious to see how long it will take them to notice.
- kevando 12y ago
  This is why OP gets such bad raps! Screenshot the digits!
  - rduchnik 12y ago
    I will when the dust settles.

dalek2point3 12y ago

I wrote an example for graduate students in the US to create a webpage and directed them to look at my webpage for an example template. Now they all copy my analytics tracking code, and I have like tens of student websites that I'm tracking me. It annoys me. I think we should have some sort of two-way authentication or atleast a way to "mute" certain domains or only whitelist certain domains in the reporting side of GA. Perhaps it exists?

thejosh 12y ago
Seriously Google, unless the domain == example.com , don't show it by default.
- rduchnik 12y ago
  Actually it's so you can track multiple domain with one code. I do this with subdomains so that I can see all my traffic as well as by individual subdomain.
  - thejosh 12y ago
    Hello User #1122111, we see you are trying to track potatoes.example.com , would you like to show this? Y/N
    - diminoten 12y ago
      It probably doesn't come up all that often.
      - thejosh 12y ago
        Great, which means most users will never see the message when someone adds their tracking code.
        diminoten 12y ago
        It doesn't happen that much, so "most users" is going to not be very many users.

dangero 12y ago

I once hired an offshore developer on ODesk who stole my code and resold it. I discovered he was doing this because he left my analytics code in. Same deal; I woke up one day to analytics showing traffic on a domain I didn't own, so I went to look and it was basically a mirror of my site.

spoiledtechie 12y ago
did you get it taken down?
- kevando 12y ago
  Yeah, I'm curious what happened? I had a client have something like this happen. No stolen code, but someone copied her site.
  - smacktoward 12y ago
    I had a friend who had this happen to her -- some SEO spammer picked up the complete text of her blog and posted it under a bunch of different domains, full of hidden links. It was reasonably easy to deal with, though; all you need to do is figure out where the sites are hosted, and then submit a DMCA complaint to the host's abuse address indicating they're hosting illegally copied copyrighted material. Legitimate hosts will take stuff like that down pretty quick. There's two things the DMCA requires that they'll look for in your complaint before they'll take action, though, so make sure you include them: 1) The statement "I swear under penalty of perjury" that you hold the copyright for the material, or that you are representing the person who does; and 2) A list of filenames that contain the infringing content. (If the host won't take action, you can file the complaint at whichever registrar the domain was registered through, too.)
- dangero 12y ago
  I contacted ODesk explaining what happened with all the evidence. By the next day the guy I had hired was contacting me saying that ODesk suspended his account indefinitely. He continued contacting me for about a year saying that he could no longer feed his family after "what I did". It was kind of a nightmare, but I think ODesk had pretty swift judgement because that's the kind of press they don't want. I also talked to the company that was using my code. They explained that they had hired him on ODesk and had no idea. They wanted nothing to do with the stolen code, and were very apologetic for their accidental involvement.

patmcguire 12y ago

What if I steal your GA code for my app, which has such routes as: /I-know-one-weird-trick-to-save-money-on-car-insurance /buy-coke

yaur 12y ago
This is a common marketing strategy for people with products that target webmasters and/or general spammers.

rduchnik 12y ago

Well mystery solved. I did a bit of sleuthing and noticed they have a scratch card at the bottom of the page. I had written a scratchpad plugin so I did a quick search for "wScratchPad" and sure enough it's there. They copied my sample code from http://wscratchpad.websanova.com http://wscratchpad.websanova.com, div's css and all and, you can even see the same `id` and `class` names. I guess they copied a little too much.

aedocw 12y ago
Parent comment should be at the top of this submission. The response from MLB about "our CI creating randomly generated GA codes" is kind of ridiculous, when the truth is someone there did an excessive cut and paste from someone else's JS.
cyphunk 12y ago
It's the internet. Copy+paste für immer. Get over it.
xofer 12y ago
> Kind of feel like a bit of a jackass now Wait, why do /you/ feel like a jackass?
- adamman 12y ago
  Because he included his google analytics code in the plugin that he made available to the world.
  - underyx 12y ago
    He did not. It was only placed on his demo site and the guys at MLB just copied that site's code instead of using the released plugin.
1234tester 12y ago
I guess you released a little too much, generally you want to remove your GA code and replace it with a placeholder like: '<insert GA code here>'...

vojant 12y ago

I have seen something similar, when three companies stolen award-winning design of digital agency I used to work for. They just copied whole code (including comments in javascript) and changed logos/texts but they haven't change our ga code.

6a68 12y ago

I think it would have been cool to ping one of the MLB.com developers, not write a blog post and laugh at them publicly/without warning. Just sayin'.

nness 12y ago

I thought GA was tied to specific domains; wouldn't GA not track MLB.com traffic?

jacques_chester 12y ago
Nope. GA is based on UA numbers (UA-12345 etc). You can reuse a number across multiple domains, so that you can (for example) aggregate a network of sites. GA allows you to then break down stats by domain.

tericho 12y ago

Hilarious. You probably aren't seeing a huge traffic spike because it's a microsite that hasn't been launched yet. It also appears to be outsourced or in some sort of BETA since the script management is atrocious. Run a Chrome audit - it's only a landing page and still makes 37 different JS file requests & 13 different CSS file requests, none of which are minified. Granted many "professional" sites ignore client-side asset performance but regardless, 120+ HTTP requests for a landing page is laughable. Edit: Might be same shop as mlb.com, they don't appear to care about asset performance either.

fekberg 12y ago

Doesn't Google Analytics cost money after a certain amount of hits per day/month? If that is the case and the gap was hit, would MLB.com be liable to pay the fees?

endianswap 12y ago
They don't just start charging you, they warn you that you're at the paid level and need to pay or stop using so much.
- glneo 12y ago
  And then you can do nothing about it because MLB.com has outsourced their site and they stole your analytics codes. I guess you could change them, but still the question is: are companies that outsource to shady firms liable for copyright/damages that will result from said decision.
- fekberg 12y ago
  That's good to know, thanks. I've seen too many companies starting to charge you instead of giving you a fair warning.
  - dudus 12y ago
    The Paid version is called Google Analytics Premium and requires a contract in place between the client and Google or a reseller. You won't get a bill out of the blue just for being over limit.
Gustomaximus 12y ago
Google limit tracking to 10 million recorded events per month. Funny thing is almost know-one knows this of the analysts/developers/marketeers I work with and take GA as gospel. If you have a site with large tracking requirements you should look at paying or manually adjusting your sampling rates (if you have consistent traffic) otherwise results will be skewed to the earlier part of the month. More reading: https://support.google.com/analytics/answer/1070983?hl=en https://support.google.com/analytics/answer/1070983?hl=en

rduchnik 12y ago

There is a comment on my blog from a developer from MLB.com for anyone who is interested: "Hi - Engineer from mlb.com here. It appears this goes a bit deeper down the rabbit hole than meets the eye. Apparently there’s some code laying around in our tests run by a CI setup that randomly generates a tracking code to mock third party scripts (Google analytics, ad tracking, etc) instead of using our actual IDs as to not mess with our marketing guys’ numbers (we run a LOT of tests on CI). The strange thing is that your IDs aren’t being pulled from your site, but have randomly been generated the same way many, many times and then been shipped out to our production server by mistake. We can’t figure out why this is happening, but are looking into the build system and how it caches data. Luckily I read HN or we might have never caught this!"

glneo 12y ago
cough bullshit cough, The statically probability that you would generate an actual AND proper tracking code that also just happens to be used by a site that shares all you code is less than can be described. Your team got caught outsourcing jobs to code copy/paste firms.
- daybreaker2 12y ago
  "Wow, what a coincidence... we just happened to randomly generate a google analytics ID that was the exact same as the one used on a scratchpad plugin that we copied the code from..."
  - skeletonjelly 12y ago
    If only calculating the odds of this were as fun as 2048 we'd have a bunch of different solutions on the frontpage of HN for the next 2 weeks!
- zavulon 12y ago
  And wouldn't it make more sense to create a test GA account and just use the ID from there for everything, instead of generating randomly each time?
- 12y ago

gkcgautam 12y ago

@MLB.com But why are you generating those random IDs at all? That means you guys are sending false tracking data to so many websites using those IDs. Stop doing this! Create a different tracking ID for testing or something!!

catshirt 12y ago
right. more importantly, a testing ID allows them to you know, test their tracking mechanisms.

ApolloRising 12y ago

For anyone else experiencing this problem what you can do is simply setup a filter in Google Analytics to only allow your domain to add traffic to your google analytics profile. Inside google analytics goto filter, create new filter, select custom filter, select include filter, Enter hostname in the filter field, enter your websitename\.com in the filter pattern box, Apply this filter to your profiles for websitename.com and you should be good to go

oniTony 12y ago
That's most of the way there, but if there's sufficient amount of combined traffic, ad hoc reports will start populating from sampled data instead of showing exact results. This might prevent getting any meaningful data about e.g. how A/B test is performing when filtered to a specific segment.
- ApolloRising 12y ago
  oniTony not sure what you mean exactly since this would just filter traffic to your own domain. This only works moving forward and usually is setup when a profile is created. Filters will not work retroactively with Google Analytics. Would be happy to discuss if you could clarify your statement regarding A/B testing.
  - oniTony 12y ago
    I went back to the Analytics Admin panel to double check, and it indeed looks like filters are applied to specific views. The tracking code collects data at the property level. From https://support.google.com/analytics/answer/2637192?hl=en https://support.google.com/analytics/answer/2637192?hl=en > If the number of visits/sessions to the property in the given date range exceeds 250K visits/sessions, GA will employ a sampling algorithm... > It is important to note that session sampling occurs at the property level, not the view level. So it sounds like reports will sample 250K from total traffic first, and apply the view filter after. This has the potential to be left with reports generated on too small of a sample.

seanalltogether 12y ago

Back in 2003 Sony Pictures hotlinked some javascript code I had created for handling Flash->javascript communication. Back then all I could think of was using it to float a dancing robot over their content. These days I guess you can get away with a lot more.

ColdHawaiian 12y ago

On a side note, when I visited the blog, it triggered a Web of Trust warning because it got flagged as spam: https://www.mywot.com/en/scorecard/websanova.com https://www.mywot.com/en/scorecard/websanova.com. It looks like a legit programmer's blog to me, so I gave it a full positive review.

gk1 12y ago

Meta comment: This thread has seemed to attract more nonsense comments -- many are almost entirely whited-out -- than usual. Why? Whatever happened to the endorsement idea?

Brajeshwar 12y ago

People usually steals my designs. Well, I stole better but that's another story. I once had my site's design stolen complete with my CSS, Javascript errors, the Analytic and the Adsense Code. I think I have the screenshots somewhere on Flickr. The irony was that, mine was powered by a WordPress theme that I designed and was available as a free download.

lurchpop 12y ago

mlb://mlb:mlb@mlb.mlb.mlb/mlb.mlb?mlb=mlb#mlb

jacquesm 12y ago

One day Microsoft (msn.com) to be exact hotlinked a small gif from one of my servers. Support did not respond at all to my inquiries to please have it removed (the msn.com homepage had a lot more traffic than I was used to dealing with) so I replaced the gif on my server with the "netscape now" button. This was at the height of the browser wars.

iagooar 12y ago
Epic stuff, did you finally get an answer from Microsoft?
- jacquesm 12y ago
  No, but they removed it lickety split :)

i_like_robots 12y ago

I've had this issue too with some of my old, Open Source jQuery plugins and even keeping the scripts separated (into the document head and at the end of the body) and commented didn't seem to work. Developers looking for the cheap and easy copy and paste I guess don't recognize the difference. Fortunately GA supports simple filtering to mitigate it.

pa7 12y ago

I've created an open source project and forgot to remove my tracking code too. The only thing was, I was hosting my own analytics with piwik, so the tracking code came from my domain. Although I marked the code with comments lots of people still left it there. If I was a bad guy this would be an easy and subtle XSS attack vector

enterx 12y ago

Reviewing the comments made regarding this and other "Stackoverflow is down" kinda threads I start to wonder... are there so many so-called developers that just copy-paste 9-5?