Comment Notification Email, And Spam Classification

Comment moderation, and comment notification, have long been optional features of Blogger Commenting.

The sequence of comment moderation email, and comment notification email, was simple.

• If comment moderation was selected, moderation email was sent to all blog administrators. Any one administrator could then select to Publish, or to Reject, a given comment.
• If comment moderation was not selected, each comment was simply Published, immediately.
• If comment notification was selected, notification email was sent to all recipient email addresses, when any comment was published.
• All blog administrators could Delete any comment, after it was published, at their discretion.

When the new comment moderation system was provided, in 2010, comment moderation changed. As the comment filters became trained, some comments were automatically rejected - and sent to the Spam queue - and that is where the current problem starts.

With the new comment moderation system, spuriously filtered comments never generated notification email - and this was a problem.

Comments sent directly to the Spam queue could be moderated, and Published, at the discretion of the blog administrators. Comments which were not Published remained in the Spam queue - and never generated notification email.

As the filters in the new comment moderation system became trained, false positives became a problem. Comments, spuriously filtered as Spam, generated no notification email.

Blog owners, accustomed to moderating comments after they were published, and receiving no notification email from comments which went straight to the Spam queue, complained of lost comments.

Listening to complaints from the blog owners, Blogger Engineering changed the sequence of the comment moderation and notification emails.

• If comment notification is selected, email is sent to all recipient email addresses, as soon as a comment is submitted for publication.
• If comment moderation is selected, moderation email is sent to all blog administrators.
• All blog administrators can Delete, or mark as Spam, any comment, before or after Published, at their discretion.

With comment notification email being sent immediately, this leaves recipients of the email occasionally confused. Comments immediately judged as Spam by the filters, or later by a blog administrator, will still generate email.

Recipients of comment notification email, not seeing a given comment published, who are blog administrators, can check the Spam queue - and in some cases, choose to Publish a comment which is spuriously filtered as Spam. This helps to train the filters - and later, see less spuriously filtered comments.

Recipients of comment notification email, not seeing a given comment published, and who are not blog administrators, will have to notify a blog administrator, who can check the Spam queue. In some cases, again, the administrator can choose to Publish a comment that is spuriously filtered as Spam.

As a blog owner, you need to properly select the moderation and notification options, to satisfy your personal needs. And, help to train the filters.

>> Top

Account / Blog Recovery May Involve Your Friends Email Archives

Recovering ownership of a Blogger account or blog may be a frustrating process.

Recovering control of a long forgotten account or blog starts with having a token sent to the recovery email address. If you don't have access to the recovery email account, you may be able to use the Google Account recovery wizard - if you can at least provide the email address that you used long ago, and a few personal details.

But what if you don't even remember the email address? Blogger won't just tell you what the address was.

In the latter case, you may have to involve your friends - and some detective work.

Now, you hope that when you registered your Blogger account long ago, you provided an email address that you used for real life activity.

When you need to identify the email address used, long ago, for registering your Blogger account, think back. Who did you email, long ago, around that time, for serious discussions?

If you're lucky, one of your friends, carefully searching her / his email archives, can find your email - and provide the email address that you were using.

With help from your friend, and now knowing the email address, that may even help you remember the password that you may have used. If you're lucky, you may be able to use that email address and password, and instantly recover control of the blog. Just don't spend a lot of time guessing, and cause account lock (aka "suspicious activity").

Having recovered the email address, try the Google Account recovery wizard, again. This is your best bet. Without this, you're probably going to need to establish your identity using a court order, issued by a sitting judge.

>> Top

Preventing FeedBurner Email Distribution Delay

One very useful FeedBurner service is the Email Distribution feature.

Email Distribution is virtually a turnkey subscription management. Email Distribution has one limitation, which not everybody understands, however.

FeedBurner sends out any new posts daily, based on a chosen distribution time. Depending upon what distribution time you choose, for any FeedBurner Feed, you can have anywhere from (up to) 2 hours, to 26 hours - of delay, between publishing a post, and having that post distributed by email.

To minimise email distribution delay, you choose the daily distribution time carefully - then publish immediately before the daily scheduled distribution.

1. Choose a convenient distribution time window.
2. Using the FeedBurner menu, Publicize - Email Distribution - Delivery Time, choose the corresponding daily 2 hour window, for email distribution.
3. Publish posts immediately before the start of the chosen time window.

You will still have a single daily distribution time - but you can choose an appropriate distribution window. And, you can publish just before the chosen distribution window.

>> Top

Repeated TOS Violations Are Punished Gradually

Some blog owners don't understand the serious nature of repeated violation of TOS Policy, in Blogger blogs - and how offenses are handled, by Google.

We've seen several reports, in Blogger Help Forum: Something Is Broken, from blog owners who appear to be unclear about the consequences of repeated TOS Violations.

I got email from Blogger, about my Blogger account.

We'd like to inform you that we've received another complaint regarding a blog that you administer. Upon review of your account, we've noted that you've repeatedly violated the Terms of Service: http://www.blogger.com/go/terms. Given that we've provided you with several warnings of these violations and advised you of our policy towards repeat infringers, we've been forced to disable your Blogger service.

How do I get my blog restored?

This example appears to represent the final step, in a multi step policy.

It appears that Google takes a multi step approach, towards repeated TOS violations - such as hosting of malware, porn, and / or spam - in Blogger blogs. This is similar to the DMCA Violations punishment process.

1. Unlike DMCA violations, individual posts are not deleted.
2. Deletion of offending blogs.
3. Deletion of offending Blogger account(s) (and blogs).

With a TOS initiated blog deletion, the blog owner is expected to have the blog reviewed. If the review determines the blog to be unrighteously deleted, the blog is restored - though there may be side effects.

If the blog owner does not wish to have the blog reviewed, he / she is allowed to start over, with a new blog - but will have to publish to a new URL. Content lost must be recovered by the owner - and the owner should be more careful with future blogs.

If the blog owner continue to publish blogs which violate TOS, any Blogger accounts involved, along with any other blogs owned by the deleted accounts, will be deleted.

We see that an appeal is possible.

Next steps for suspended accounts: If you believe your access to this product was suspended in error, contact us.

With any blogs published to a non BlogSpot domain, the domain URL(s) will remain in use, in the Google database - though the domain owner is free to use the domain outside Google address space. If the offender wishes to start over, both new BlogSpot and non BlogSpot URLs will be required.

As with other issues with email delivered warnings, there will be cases when the owner may not receive warnings in a timely fashion. Even so, the owner is responsible, when he / she offends, repeatedly.

Blogs under team ownership are apparently vulnerable to action taken against any team member. In some cases, blogs will simply disappear from the dashboards of the other team members, with no appeal or review request being possible.

It's possible that legal notice, provided by Google through email, will supercede ongoing forum advice - even if email sent is not received by the owner.

>> Top

Repeated DMCA Violations Are Punished Gradually

Some blog owners don't understand the serious nature of DMCA Violations in Blogger blogs - and how offenses are handled, by Google.

We've seen several reports, in Blogger Help Forum: Something Is Broken, from blog owners who appear to be unclear about the consequences of repeated DMCA Violations.

I got email from Blogger, about my Blogger account.

We'd like to inform you that we've received another complaint regarding a blog that you administer. Upon review of your account, we've noted that you've repeatedly violated the Terms of Service: http://www.blogger.com/go/terms. Given that we've provided you with several warnings of these violations and advised you of our policy towards repeat infringers, we've been forced to disable your Blogger service.

How do I get my blog restored?

This example appears to represent the final step, in a 3 step policy.

It appears that Google takes a 3 step approach, towards DMCA violations. This is similar to the TOS Violations punishment process.

1. Deletion of offending posts.
2. Deletion of offending blogs.
3. Deletion of offending Blogger account (and blogs).

We've noted the initial step - deletion of offending posts, before. Specific blog posts, which are identified as DMCA Violations, are saved as Draft content. This allows the blog owner to correct the offense, and re publish a corrected post, without losing the content.

If the owner chooses to ignore the initial DMCA Violation, and simply re publishes an offending post - or if the owner publishes multiple offending posts, the blog is deleted. The owner is free to publish another blog, at his convenience - but the offending blog is not recoverable.

If the owner publishes a new blog, containing the same offending material - or if the owner publishes multiple offending blogs, the Blogger account (and blogs) is deleted.

As with all email delivered warnings, there will be cases when the owner may not receive warnings in a timely fashion. Unfortunately, the owner is responsible, even so, when he offends, repeatedly.

>> Top

Confusion Over Custom Domain Expiration Dates, Caused By Google Apps Email

We're seeing some panic today, in Blogger Help Forum: Something Is Broken, from a few blog owners who have received email, which implies that their custom domain registrations are approaching expiration - and can't be renewed.

I registered my domain several months ago, through Google. I have the receipt for the payment in my email, my Google Wallet account, and my credit card statement.

Why am I getting this email now, some months after registering my domain - but well before my registration should be expiring?

Our records indicate that the payment for registering your domain mydomain.com was unsuccessful.

Payment failures happen for a variety of reasons (such as insufficient funds or an expired card). You can update your payment information to resolve the issue.

Please log in to your account and update your payment information. If you take no action, your domain will not be renewed on .

This confusion is especially unfortunate, given the recent discontinuation of the very popular Google Domain Registration option, which drives the Blogger "Buy a domain" wizard. It is reminiscent of a similar episode, almost a year ago.

When this confusion is reported in Blogger Help Forum: Something Is Broken, it's not difficult to dispel the panic. Several helpful websites provide registration look up services for the domains in question - and allow us to easily verify that there is no sudden flood of registration problems.

• DomainTools.com
• Name.com
• Network-Tools.com

Overview for mydomain.com
Registrar Info
Name  ENOM, INC.
Whois Server  whois.enom.com
Referral URL  http://www.enom.com
Status  clientTransferProhibited

Important Dates
Expires On  December 01, 2013
Registered On  December 01, 2012
Updated On  December 01, 2012

We have identified a popular topic in Google Apps Forum: General Discussion, where this issue is being discussed, and which has been forwarded to Google Apps Support.

Please watch the Google Apps discussion, or this blog post, for updates. And get back to work, on your blog.

>> Top

Renewing Your Custom Domain Registration

Some Blogger blog owners, having experienced the anxiety of custom domain setup, intend to carefully maintain their domain registration.

We see a few queries, in Blogger Help Forum: How Do I?, about domain registration renewal.

How do I make sure my registration gets renewed?

or

How do I renew registration before it expires?

or, possibly

My blog now displays a search page! Have I been hacked?

Some registration issues will depend upon how the domain registration was originally purchased.

Domains purchased directly from a registrar - whether using eNom, GoDaddy, or a third party registrar, will have to be renewed directly from the registrar. It's not possible to migrate a direct purchase to Blogger / Google registration for payment, any more than to use the Blogger / Google automatic DNS setup. Once you purchase domain registration from a registrar, you are on your own.

If you used Blogger "Buy a domain", Google Apps, or Google Wallet, to purchase the domain registration, you should get email reminders when registration is expiring. However, this will depend upon whether your Blogger / Google account, under which you purchased the registration, uses an active and accessible email address.

If you choose to anonymise yourself by using a bogus or inactive email address for your Blogger or Google activities, don't expect to get email reminding you, or allowing you to renew domain registration.

The most reliable way to assure the domain remains registered is to use domain auto renewal. You can check your auto renewal settings using the Google Apps administrator account, for the domain (now called the "Admin Console").

For domains purchased before December 2012, you'll use email from Google Apps, or an entry in your Google Wallet log, to retrieve the token to setup your Google Apps account. For domains purchased after November 2012, you will have only a limited access Google Apps account, which you should reset the password, to access.

If you intend to use domain auto renewal, make sure that the bank account (credit, or debit) is active, and currently paid. If your bank rejects the payment, you should get a notice - but again, this will come reliably when the email account associated with the domain is active and accessible by you.

If you do not renew registration on time, depending upon the registrar, the domain may be changed to point to a domain parking server, where the registrar will serve ads. Some registrars will serve ads which you, or your readers, won't appreciate.

If the domain registration has expired, and the domain was purchased from Blogger / Google, you may be able to submit late payment, and renew now.

If your original charge fails and you’re unable to resolve the form of payment issue within 7 days, you may still be within the grace period for renewals. If you’re still within 19 days of the renewal date, you can try again using any Google Wallet account by visiting http://www.google.com/a/cpanel/domain/renew-domain/primary-domain-name, where primary-domain-name is the domain name you are trying to renew.

In some cases, once late payment has been processed, your registration may resume, with no long lasting ill effects. In other cases, you may end up having to setup the DNS addresses.

The best renewal experiences, of course, start with advance planning.

>> Top

Recovering And Protecting Your GMail Account

Blogger blog owners may have productive action, when their Blogger accounts are successfully hacked through an attack on their GMail accounts.

GMail account owners can get detailed instructions on recovering a successfully hacked account, and on preventing future hacking attacks from being successful. Some of the instructions are specific to GMail use - but overall, Blogger account owners will benefit from their use.

To benefit from the GMail instructions, one should consider the differences between Blogger, email, and Google accounts.

Gmail Account Recovery: Gmail Account Recovery and Security provides complete and detailed instructions for recovering a hacked and stolen GMail email account.

The Recovery instructions include specific mentions of Disabled / Suspended accounts, successfully Stolen accounts, and accounts locked or deleted because of Underage owners.

Accompanying the recovery advice is Gmail help and information: How NOT To Get Hacked. These are instructions for preventing a recurrence of a reported problem. This includes discussion of using a strong and secure password, identifying hacking techniques that involve the account owner, and preventing attacks which are conducted using the computer or network in use by the account owner.

The Prevention instructions, many which are common sense issues to any IT professional or security expert, are specifically written to apply to GMail account owners. There may be additional issues which apply in general, to Blogger accounts - and specifically, to Blogger accounts which are based on non GMail email accounts.

There are a few differences between Blogger blog ownership and GMail account ownership, which will cause issues that cannot be easily resolved by Blogger Support, or by GMail Support, to the satisfaction of the (former) blog owner.

GMail accounts are, by nature, single owner - and ownership of a GMail account is never transferred. In contrast, Blogger blogs can be under team ownership - and ownership can be transferred.

• Intentional team blog ownership. Team blog ownership can cause problems with loss of blog control, when all known blog administrators (accidentally or intentionally) remove themselves as administrators, leaving an unknown administrator.
• Intentional transfer of control. A blog owner may assign administrator status to another person, voluntarily - then later regret his decision.
• Un intentional transfer of control. A blog owner may assign administrator status to another person, voluntarily - and the other person may then remove the former owner administrator status.
• Ownership theft after account hacking. A hacker, having temporarily gained control of a Blogger account, may transfer ownership of a blog to another Blogger account.

All of these scenarios are regarded as simple transfer of blog ownership, by Blogger Support.

Though maybe not preferred by the (former) blog owner, the blog in question will now be under control of another person. It's possible that some of these scenarios are considered by Google Security, when reviewing Blogger / Google accounts after hacking activity is detected.

Blogger accounts, based on non GMail email addresses, will be subject to the typical uncertainty which accompanies any third party service in Blogger. Some details may be involve the email provider, while others will involve Blogger - and arbitrating between the two will be the responsibility of the Blogger account owner.

Owners of Blogger accounts which are based on non GMail email addresses will need to contact the providers of the actual email service, for resolution of some of these issues.

In general though, the GMail Account Loss Prevention and Recovery instructions provide good advice, for any Blogger account owner.

>> Top

If You Comment On Blogs Extensively, You Should Consider Using Google 2-Step Verification

One recently identified cause of deleted Blogger blogs appears to involve brute force hacking against our Blogger / Google accounts.

We've known, for some time, about blog owners receiving alerts about "suspicious" / "unusual" account activity. The alerts frequently involve locked or deleted Blogger / Google accounts - and generally include the owner having to change their password, solve a CAPTCHA, and / or provide their phone number (mobile or home phone) to login.

Later, people started reporting that their blogs were being deleted - possibly as a result of having to change their password, solve a CAPTCHA, and / or provide their phone number.

I've been observing - and blocking - an annoying style of comment based spam, which I have termed "nice blog" spam, for some time.

Nice blog. I will keep visiting this blog very often.

This style of spam, from what I can tell, has been published by the millions, in various blog comments, on both Blogger and non Blogger platforms.

The reason for the spam always intrigued me. Observing that the spam was published in the millions, suggested to me that it had a special purpose, intended by its creators. Looking at a typical spam message, in my email (since I moderate before publishing), I could see no consistent type of content.

• Some messages would contain links, others not.
• Some messages would mention what looked like commercial products, other references were obviously imaginary targets.
• Some messages would appear to be mere babble.

Recently, I discovered one strong possibility for the purpose of the spam - a very ingenious form of email address mining. The spam comment is only needed to allow a hacker to subscribe to a given comment stream, using the "Email follow-up comments to ..." option. It's possible that the subscription is not even affected by moderation - whether the blog owner is moderating, either before or after the comment is published to the blog, the hacker remains subscribed to the comment stream.

All that the hacker / spammer has to do is to publish a spam comment, select the "Email follow-up comments to ..." option, and watch while his Inbox fills up with subsequent comments from other Blogger / Google / OpenID account owners. Any comment containing an email address, and linking to a Blogger blog, would go straight into the hackers database.

Later, the hacker could go to work against the Blogger accounts referenced in the comments. In some cases, this would result in successfully hijacked Blogger blogs, which would become part of a spammers blog farm where advertisements of various nature could be hosted. Valuable blogs, with established reader populations, could also be used to serve malware (and more hacking) to unsuspecting readers.

The demographics of some hijacking attacks provide interesting clues. In one episode, we had a significant number of home / personal / small business blogs that had been hijacked by one specific individual. Many of the victim blogs

• Contained details relevant to the owners, which provided clues to passwords used by the owners.
• Were owned by people who used commenting extensively, for networking both with friends, and with business targets.
• Were read (and commented upon) by similar people, who similarly provided password clues in their own blogs.

Having been part of the restore process, both with people who had their blogs hijacked, and who had their accounts locked and blogs deleted, I observed that the former (hijacked blogs) seem to have decreased in volume as the latter (accounts and blogs locked / deleted) increased in volume. I don't think that the relationship is coincidental - or spurious.

My opinion is that the locking of Blogger / Google accounts - and subsequent deletion of blogs - directly results from detected attacks against the accounts in question ("suspicious" / "unusual" activity). Noting that the attacks seem to be more common to people who comment on blogs as a form of networking, it appears that commenting can lead to accounts and blogs being locked or deleted, as Google protects us against hacking.

Considering this possible cause and effect relationship, Google 2-step verification is a good idea. Click here, for Google instructions on setting up 2-step verification.

Use of 2-step verification helps safeguard our accounts against brute force hacking. This will help anybody who is anxious about accounts and blogs being deleted or locked, as a result of "suspicious" / "unusual" activity. If you own a blog which is subject to this threat, you should consider using 2-step verification.

The sanity (heart attack, ulcer) that is saved may be your own.

>> Top

Google+ Circles Is Replacing Following / Google Friend Connect

Those of you who have been Following this blog, in the past, may have recently noted a new gadget in the sidebar.

Just below the "Follow Me" gadget, you'll see "+Follow Me". The latter gadget looks the same as the former, but has some subtle differences. Some differences are visible, others not so visible. And some differences are not visible to the eye - but will still affect your access to this blog.

The Google+ Circles gadget, which on this blog is labeled "+Follow Me", appears similar to the Following / Google Friend Connect "Follow Me" gadget - but appearances can be very misleading.

The larger pictures are one obvious difference - but that's not the most significant difference. Some difference need to be discussed now, rather than later, for maximum benefit.

Following / Google Friend Connect lets your acquaintances Follow a single blog. I have several blogs, and a different group of Followers for each blog. The Google+ Circles gadget shows everybody in all of your publicly visible circles, merged together. The merged concept may, or may not, be to your liking.

With Following / Google Friend Connect, your Followers can use email, or any number of newsfeed clients, to read the complete content of your blog - including each complete post, if you setup the blog feed that way. Google+ Circle members can read a snippet of any blog post intentionally Shared, in their stream - but will have to click on the link to the blog, in the snippet, to read the entire blog post. If you have read this far, that's what you have already done.

Following / Google Friend Connect works best for public blogs - and supports a reader audience of unlimited size. A Google+ Circle, likewise, supports a reader audience of unlimited size.

With a properly setup Google+ Circle, and a Blogger blog with a list of designated readers - and your readers properly accepting the emailed membership invitation, up to 99 of your designated readers can Follow your blog. As before, the limit for private blog distribution, as for any team blog, is still 99 members.

Anybody Following a blog, using the stream of any author of the blog, will see a snippet of each post Shared in their stream. To read the complete post, they will have to click on the link in the snippet. With a private blog, the reader will have to be a blog member, to read the complete post.

Many publicly visible Blogger blogs have Following communities which vastly exceed my 4700 member population (my "Follow Me" gadget, as of April 2013) - and the possibility of losing those communities will not be willingly accepted by everybody. The integration of Following with the newsfeed subscription - and with the dashboard Reading List - is not automatic with Google+ Circles.

A blog with multiple authors (aka "team blog") will have either a Google+ Circles gadget for only one author - or multiple Circles gadgets, to fairly let people subscribe to the various authors Google+ streams. Neither solution will be exactly equal to the Following / GFC blog feed subscription - especially if the various team members are similar to me, and my range of interests.

Right now, it appears that a blog can have just one Circles gadget. How team membership blogs will use Google+ is another question to ask.

Similar to the team blog, we may wish to consider the multiple interests of each blog owner. I am one person, with a number of interests. People who have intentionally subscribed to the newsfeed from this blog, and are specifically interested in my blog about Blogger blogs, may not be extremely interested in my blog about cooking - nor in my blog about jokes, pranks, and miscellaneous ramblings. Unfortunately, if you Follow my Google+ stream, you'll get a bit of each subject.

Again, the Google+ Circles gadget appears to contain the total Followers for one person, for all interests of that one person. I have not yet found a tool that will allow me to analyse the interests of each of my Followers, and to accurately determine the specific areas of overlapping, between my own personal interests and theirs. It will be impossible for many blog owners to keep an accurate Circle complement, and segregate each circle according to interest, so they may Share only relevant material with the specific members of each different Circle.

As the Google+ Circles gadget evolves, some significant improvements - and some compromises - will be required. Like the Internet, Blogger, and Google, are constantly evolving. This may require compromises by many Blogger blog owners.

We now have a rollup discussion, where each blog owner is asked to provide their thoughts about the above described issues - and possibly, others that concern you. Anybody who experienced the Blogger GUI upgrade of several years ago may, from experience, realise how much better off we may all be, with these issues discussed now - rather than later.

>> Top

Some Blogger Blogs Being Locked As Malware Hosts, Because Of Malicious JavaScript

For a long time, we've been dealing with various malware / spam mitigation issues, in Blogger Help Forum: Something Is Broken.

Recently, malware detections, long simply identified as "Malicious JavaScript" in the well known Spam Appeal Guidelines, was given its own identity, and a separate classification / appeal process. We're now seeing several common types of JavaScript, included in blogs which are typically mentioned in forum reports.

It may be helpful to describe some examples of JavaScript code being seen, so blog owners can avoid making the same mistakes, by not including these scripts in their blogs.

There are 3 common types of JavaScript applications, found in many blogs with the owners requesting review / unlock action.

1. CPA / Cost Per Action.
2. Traffic Redirection, targeting other blogs / websites.
3. Traffic redirection, targeting the canonical URL for the host blog.

CPA / CPALeads / Cost Per Action, and similar online marketing terminology, involves providing a reward for viewing a blog, or for subscribing to the blog feed. Some CPA scripts may be used to collect email addresses, also known as "email address mining", later used for hacking activity or spam distribution.

CPA scripts present another problem. Since Blogger blogs are intended to reward the readers by providing interesting and unique content, blogs which use CPA may be improperly designed or maintained. Blogger wants the blog owners to publish blogs which entertain or inform their readers - not blogs which require artificial or ingenious techniques to generate traffic, and visitor activity.

Traffic Redirection, targeting other blogs / websites is a technique enjoyed by many hackers and spammers. The use of some blogs as gateways, leading to redistributors, which in turn lead to payload blogs or non Google websites, is part of many hacking / spam attacks. Google is trying to restrict the use of Blogger blogs as malware / spam hosts - and actively prevents scripts, which only shuffle readers from one blog to another, without choice.

Even though Blogger will not encourage you to move your blog, to Tumblr, Weebly, WordPress, or wherever, you are allowed to do this - if you feel the need.

Hello, faithful readers:

This blog is now hosted at my new blogging host. Please update your blog lists and bookmarks!

If you must do this, it's OK to post a notice, in your Blogger blog. You can even put a link, to the new blog, in the notice. You just can't use JavaScript, to automatically send the reader to the new blog.

Traffic redirection, targeting the canonical URL for the host blog, is a technique used by some blog owners who perceive Country Code Alias Redirection to present a problem. Some accessories installed on their blogs, and various non Google services which may be used to provide activity on their blogs, may not properly reference the canonical URL tag included in all Blogger blogs.

Since Blogger / Google wants all Blogger blog owners to benefit from improved world wide access to Blogger blogs, blogs which employ automatic canonical URL redirection may damage the effect of CC alias redirection. Blogs which host scripts which immediately redirect readers to the canonical URL, and are considered undesirable by any host government, may force an offended host government to block the entire Blogger service, in their country.

To prevent malicious misuse of Blogger by hackers and spammers, and to encourage effective long term use of Blogger by legitimate blog owners, Blogger / Google may detect any blogs which use these types of scripts as part of their general malware / spam classification strategy. Given the ability and willingness of the blog owner, to remove the JavaScript code in question, most blogs can be returned to service - but each blog will remain offline, until the removal is verified.

It's to everybody's benefit to identify, and to avoid use of, these scripts in our blogs, before it's too late. If your blog contains one of these scripts, why not remove the problem now, instead of waiting until you too have to post your problem report, in the forum

Help me! My blog was just locked for

MALICIOUS JAVASCRIPT

What do I do, now?

>> Top

If You Moderate Comments Using Email, Mark The Spam Properly

One evidence of confusion, in Blogger Help Forum: Something Is Broken, comes from blog owners who are moderating comments, to their blogs, using comment moderation email.

I am constantly assailed by spam comments, being published to my blog, delivered to my Inbox! Is there anything I can do, about the spam, except just keep deleting?

Comment moderation, using email, offers several choices for action - but only one action will have any actual effect upon the spam.

When you moderate comments using email, and you are using comment moderation email - not comment notification email, you'll have the same choices for comment moderation, as when you use the Blogger dashboard wizard.

• Publish
• Delete
• Mark as spam

You'll have an additional choice, too.

• Moderate comments for this blog.

The latter choice gives you - when you are properly logged in to Blogger - quick access to the dashboard Comments wizard, to moderate from there.

As with using the dashboard wizard, the choice here is crucial. You need to mark spam comments as Spam. If you delete, the comment goes away - and nothing is done to train the spam filters. Spam comments, deleted, will simply let the spammer continue to annoy you.

With email messages, there are two more actions which some people take - and neither will do anything, directly, about comment spam.

• Some people will delete the email message - and this simply removes the email message, and the emailed copy of the spam, from the Inbox.
• Other people will use the "Spam" email mark. This selection is used to train the email comment filters - but it will only indirectly train the comment spam filters.

Neither deleting the email message, nor marking the email message as spam, will do anything about comment spam.

If you're looking at the comment notification email message, you'll have no comment moderation choices. Here, your only choice will be to delete the email message - if you're concerned with Inbox capacity. You can't moderate, using comment notification email.

Marking an email message, containing a spam comment, as spam - whether you are viewing the comment moderation or comment notification email message - accomplishes nothing. When you mark an email message as spam, you're reporting the sender of the email message. With comment moderation or comment notification email, marking an email message as spam reports the Blogger comment forwarding wizard - and this does nothing about the originator of the spam comment.

Use email to moderate comments, if you like. It's a convenient way to quickly moderate comments - and for some, more convenient than the Blogger dashboard. But make the right choices, when moderating.

>> Top

Control The Email Settings, Relevant To Your Blog, Wisely

Some blog owners don't always think about the various email settings, which are part of their Blogger blogs, and the possible effects to their email - or somebody else's email.

There are several settings, where a blog owner may enter an email address.

• Email posts to
• Comment Moderation.
• Comment Notification Email.

These settings don't require acceptance by the recipient, making for some interesting possibilities for causing problems in other people's email, as well as one's own email.

There are several Blogger dashboard settings - related to post publication and to various commenting activities - with differing effect to one's own, or somebody else's, email.

• Settings - "Mobile and email" - "Email posts to" generates a minimally formatted text copy of each post, when published, to up to 10 email addresses.
• Settings - "Posts and comments" - "Comment Moderation" generates a minimally formatted copy of each incoming comment, before the comment is published - and allows moderation of the comment, while reading the email message - when the recipient has the proper authority.
• Settings - "Mobile and email" - "Comment Notification Email" generates a minimally formatted copy of each incoming comment, before the comment is published or rejected.

Since none of these settings require acceptance by the recipient, there are various possibilities for causing interesting email delivery.

Unlike various subscription services which use email, such as a FeedBurner Email Subscription service, an email address added to any of these three settings requires no formal acceptance. If a blog administrator should add an email address, whether their own (primary or additional personal email address), a willing friend or relative, or an unknown victim's address, there is no initial email sent to the recipient

You (or somebody else) has added this email address as a recipient of "Email posts to" / "Comment Moderation" / "Comment Notification Email". Do you approve of this additional traffic source to your email service?

or a similarly worded notification / approval. Given a clueless or malicious blog owner, it's possible that one (or all) of these settings could be used to harass an unwitting third party.

The "Email posts to" feature, also known as "BlogSend", generates a minimally formatted text copy of each post, when published, to up to 10 email addresses. This setting has been used, in the past, to provide distribution of newly published posts for private blogs, as well as a simple distribution for posts from public blogs.

Since it's limited to 10 entries, BlogSend does not provide a suitable service for any blog with a reader population of any appreciable size. For a blog owner with any technical experience, FeedBurner Email Distribution is a much better solution for post distribution - when the blog in question is publicly accessible.

For distribution of a private blog to more than 10 readers, one may use Google+.

The "Comment Moderation" and "Comment Notification Email" settings, used together, can generate interesting duplication of email to one's own (or somebody else's) email service. If these settings are made without thinking, some interesting confusion can result. Email addresses can be added to each of these settings without consideration of the relationship or level of authority enjoyed by the owner of the email address, relative to the blog in question.

Comment Moderation Email is presumed to generally be a function performed by blog administrators - but email resulting from this setting will be sent to anybody addressed. A blog administrator / member - or other non administrator of the blog or an unwitting stranger - will receive email suggesting several options,

Publish
Delete
Mark as spam

Moderate comments for this blog.

If the recipient is not an actual blog administrator, the links in the email provide confusion, and no result.

Comment Notification Email might be generally addressed to blog members - but is not necessarily limited. Since notification of comments is sent separately from moderation, recipients of a notification can become confused when they fail to find the comment, mentioned in the notification, present on the blog. A blog administrator, using either an email moderation message - or using the blog Comments wizard, may or may not decide to Publish - or to designate a comment as Spam - regardless of a notification message having been delivered to each designated recipient.

Comment notification email may look similar to comment moderation email, less the comment processing options - possibly causing more confusion. A blog owner, adding his own email address to both comment moderation and comment notification, may see the combination as unknown duplication. And blog owners may confuse the proper use of comment moderation and comment notification email.

A blog owner, transferring ownership of a given blog, may overlook updating of the email settings. A new blog owner, receiving a blog being transferred, may likewise overlook these settings, and may lack the associated email, until the omission is corrected.

Either the previous owner, or the new owner, may be confused temporarily - and may wonder why they are still getting email / not getting email, until they examine and correct the setting in question. Alternately, if someone's email address was added maliciously, by a blog owner intending to harass somebody, one can see interesting possibility for conflict.

>> Top

Everybody Won't Get Proper Notification When Their Blog Is Deleted Or Locked

One problem that we're seeing in Blogger Help Forum: Something Is Broken involves blog owners, who recently discovered their blogs deleted or locked, by Blogger - and without any notice received.

The account actions may be required with the blog deleted for a suspected TOS Violation, such as hosting malware, porn, or spam - or locked because of "suspicious activity" on the Blogger account.

Why was my blog deleted? I never got proper notice!

Too many people depend upon email notification - and may not receive proper notification, in all cases.

Blogger provides a dashboard based malware / porn / spam classification notification / recovery process, which may not be available for everybody. Similar to malware / porn / spam classification, there will be issues with DMCA violation notification.

This is also a problem when accounts are locked for "suspicious activity", and when blogs are locked for hosting malicious third party gadgets.

There are several reasons why some blog owners won't get notification of their blogs being deleted or locked, by the various Blogger / Google security processes. Besides notification limitations, nobody should expect to get advance warning of action being taken - as this would simply encourage the intentional spammers to never request review.

Intentional spammers, if permitted, would play 3 Card Monte, endlessly, with their spammy blogs. Both the notification, and advance warning, limitations contribute to confusion about the various Blogger / Google security recovery options.

All email based notifications may not be properly delivered. The owner of any email account, which may not deliver email properly, is still responsible for reading any important email messages.

Too many Blogger blogs are owned by Blogger accounts which are based on inactive or nonexistent email addresses. Owners of these blogs will never see email notification, when they - intentionally or not - make themselves anonymous.

In other cases, some people may get the email notifying them of problems - but their email program may misfile the email, in a folder which they may not check, regularly. In some odd cases, somebody other than the owner may get the email.

In team blog ownerships, any blog owned by the team is subject to action against any team member accounts. Blogs affected will simply disappear from the dashboards of all team members - with no opportunity provided for appeal or review.

Finally, too many blog owners maintain multiple Blogger / Google accounts, and are not completely sure which Blogger account may own a given blog. These owners may not even see the dashboard based "Deleted Blogs" button / link, because they will be logged in to the wrong Blogger account.

Not all of the above scenarios are entirely the fault of the blog owners - but the blog owners are the ones who will have to make the effort to resolve the resulting problems.

>> Top

Use Of Google+ For Networking, And Keeping Your Blogger Account And Blogs Safe

One constant activity in Blogger Help Forum: Something Is Broken involves blog owners whose blogs were deleted - either righteously or spuriously - as part of the ongoing battle against spam, in Blogger blogs. Generally, the problem comes directly from the blog content.

Sometimes, the problem is more subtle.

When I tried to login to Blogger, I got a screen that said my account needed to be verified, due to "unusual activity on my account". Having verified my account, I see that my blogs have been deleted.

This is part of one of the more intriguing episodes, in the never ending fight against hacking and spam, in Blogger.

Some Blogger blog owners participate in comment based discussions, and provide their email addresses there. Some state their email addresses openly, in the body of the comments, for the world to see when viewing the comments. Others post comments using their Blogger accounts, knowing that the blog owners can see their email address in the comment moderation / notification email messages - and can contact them using email.

Spammers use comment based networking, to their advantage. They subscribe to any comment thread, using the "Notify me" option - then wait while blog readers comment using their Blogger accounts. As the email comes in, from blog readers commenting, they scrape the email addresses from the email content. Since most people commenting either openly state their blog URLs in the comment bodies - or link to a list of their blogs - the spammer now has two essential ingredients, to be used for hacking someone's Blogger account, and gaining control of the blogs owned by the account.

Google now provides Google+, where we can network with a designated audience, and avoid spam in our email. Using Google+, our email addresses are not revealed, and spammers have less incentive to use Google+ for email address harvesting. This protects our Blogger accounts and blogs against hacking, and relieves us from email based spam.

For people who update their Blogger accounts to use Google+ based profiles, but continue to network using Blogger comments, Blogger now protects us by using anonymous email addresses in all comment generated email. This leaves people who continue to comment, using Blogger accounts with native Blogger profiles, vulnerable to ongoing email address harvesting, and account hacking.

Blogger account hacking, using email addresses harvested from Blogger blog comments, will typically involve brute force password guessing. Blogger, detecting brute force attempts against a vulnerable Blogger account, will lock the account and the blogs. Once we verify ownership of our Blogger account - and hopefully change the Blogger account password to something less vulnerable to guessing - the blogs owned by a possibly compromised account remain locked, until they can be examined for signs of tampering, by Google security / spam analysts.

We also must consider the possibility that not all brute force password guessing attacks are being detected by Google - and some Blogger accounts are being deviously, and temporarily, hijacked.

People who setup Blogger accounts based on bogus email addresses - or who have accounts based on old email addresses which they can't use - continue to present a challenge here. These people will never receive essential email advising them of a problem in either verifying their Blogger account - or their blogs. This will continue to make our initial spam lock advice relevant.

Can you login to Blogger? Do you have a dashboard link "Deleted blogs"? That's where you start.

You wait 24 to 48 hours after submitting a Restore request - then you post back here, and we take the next step.

>> Top

Blogger Comments Being Posted Using An Anonymous Blogger Email Address

Some Blogger blog owners use their Blogger blogs as the center of their peer to peer networking life.

Many blog readers are expected to post comments - and to leave their email addresses, as part of their message or profile, to allow direct contact. Long ago, I used the email address of my commenters, as part of an easy "Contact Me" form, on this blog.

Recently, we've been noting that Blogger comments don't always include a useful email addresses - many comments simply describe the commenter as

noreply-comment@blogger.com

Not all blog owners - and readers - appreciate this change.

When I leave a comment using my google profile, it isn't linking my profile with my email address. How do I get my email address properly displayed?

and

Why do so many comments, published to my blog, show the email address of "noreply-comment@blogger.com"? How do I email my readers?

For some time, we've known of the dangers of revealing your email address to the world, in general.

Blogger blog owners have been a known special risk, with their email addresses. Google developed Google+, with the Google+ profile, to allow everybody to network with their friends - both old and new - without the risk of revealing one's email address.

Google+ replaces email completely. You can share comments, messages, photos, and videos with anybody, in a self contained universe - and you can define your own, personal universes. This leaves the need to reveal your email address completely unnecessary (though you can use email, if you wish, without knowing anyone's address - or revealing yours).

After Google+ became popular, Blogger added the option to link our Blogger blogs with our Google+ profiles. Blogger profiles, based on Google+, are cleaner, and use the Google+ displays to update.

To encourage people to use Google+ for peer to peer networking activity, and to make our Blogger accounts and blogs safer, Blogger has eliminated our email addresses from all outside correspondence - including when we publish comments on Blogger (and non Blogger) blogs, using a Google+ based Blogger profile.

If we publish a comment on somebody's blog, and the blog owner has enabled comment moderation or notification, our comment shows up in the email inbox of the blog owner - but with our email address displayed as "noreply-comment@blogger.com".

With email addresses not displayed, this helps protect our Blogger account names from becoming unnecessarily revealed. Blog owner - reader comment communication is still possible - but again, without the email address of the reader being known.

Some time ago, I discovered an odd type of comment spam, which I termed "nice Blog" spam.

Nice blog. I will keep visiting this blog very often.

This spam, from what I can tell, has been published by the millions, in various blog comments. It's likely that this particular spam is being published as a very imaginative form of email address mining, and recently became even more imaginatively produced.

All that the spammer has to do is publish a spam comment, and select the option to "Send me replies". Any comments published later, and including the commenters actual email address, would be delivered directly to the spammers inbox. Knowing the email address - and the blog URL (how many comments do not include a link to a blog?) - the hacker would go straight to work.

Later, we would see forum reports.

I can't control my blog, any more - and somebody has updated it with spam!

This was a direct result of the former blog owner, having left a comment on somebody else's blog.

By eliminating our email addresses from our comments, Google is helping to protect our accounts and blogs, while letting us continue to comment on each others blogs - and to eliminate one type of unnecessary spam from our blogs.

Google+, which replaces email for networking, uses a "Friend of a Friend" relationship to let you expand your universe infinitely, with each comment, message, photo, and video that you share. It lets you control the expansion of your universe - if you wish. And, it helps keeps your Blogger blog under your control.

>> Top

Enabling Blogger, If You Now Have An ISP Provided Email Account, That Uses Google Apps Based GMail

We're seeing problem reports from some confused blog owners, who are apparently customers of ISPs who have made the switch, from using a private email infrastructure, to using GMail based email (administered using Google Apps).

When I try to sign in I get this message.

Blogger has not been enabled by the administrator of the domain

How do I administer my blog?

We've known, for a while, that having a Blogger account based on a Google Apps provided GMail account may not be a good long term strategy - particularly if the Apps account is based on a domain which you own, and the domain was purchased to host one of your blogs.

Possibly considering the latter scenario, Blogger / Google now requires that you enable the Blogger service, for any new Google Apps controlled domain - if you wish to use email addresses in that domain to host Blogger accounts. This is a safety measure, helping to prevent you from having a Blogger account that you can't control - or can't recover access when you forget the password.

All of that is fine - when you control the domain that you wish to use to host your Blogger account. But what if you don't control the domain? What if you previously setup a Blogger account based on your ISP's email domain - then later the domain administrator decides to upgrade the domain, to use GMail based email? What happens to your Blogger account?

Short of convincing the domain administrators for your ISP that you have a genuine and urgent need to have a Blogger account, based on an email address that they provide, you're going to need a new email address - provided by someone other than Google, or your ISP (school, employer, what have you).

Start by setting up an email account in some third party web service - maybe "Yahoo.com". Then, you have two possibilities. If you're reading this article just before your ISP makes the switch, and you can still use your Blogger account, transfer control of your blog(s) to a new Blogger account that's based on your new email address.

If you just discovered the change by your ISP - maybe because you now see the bad news

Blogger has not been enabled by the administrator of the domain

you are going to have to recover control of your blog, based upon access to your ISP's email account - and setup a new Blogger account based on your new non ISP based email account.

1. Generate a new account recovery email message.
2. Setup a new email account, outside your current email service.
3. Clear cache, cookies, and sessions.
4. Restart the browser.
5. Login to your current email service, find, and open the email message.
6. Click on the link in the email message.
7. Setup a new Blogger account, based on the new email address.

Whatever you do when setting up your new Blogger account, please make sure to verify the email address - and setup recovery options, carefully.

>> Top

Comments Posted, Using Google / Google+ Profiles, Use "noreply" Email Addresses

Recently, we've noted a number of complaints about Blogger commenting, in Blogger Help Forum: Something Is Broken

.My comments all use a "noreply" email address, instead of my actual email address. How do I have people email their replies to my comments?

These are people who have updated their Blogger accounts, to use a Google or Google+ profile. Neither Google or Google+ profiles provide the option to

Show my email address

It appears that, with the deployment of the new Google / Google+ profiles to Blogger, Google is making yet one more attempt to convince us to network using Google+ - and keep our email addresses to ourselves. If you moderate or monitor comments to your blog, you may have recently noticed many non anonymous comments labeled with a common email address of "noreply-comment@blogger.com", instead of personal email addresses.

People who intentionally wish to expose their email addresses in their comments will need to revert their Blogger accounts to the Blogger profile. If this is a concern for you, go to your dashboard. From the menu attached to the gear icon at the top right, select "Revert to Blogger profile", and you'll have your Blogger profile back. Then edit your profile, select "Show my email address" under Privacy, and you'll be back to sharing your email addresses in your comments.

It's likely that the noreply email addresses are being offered to keep many bloggers from, inadvertently, exposing their email addresses to email mining techniques. In remembering the long ago discovered "nice blog" spam, it's possible that "nice blog" spam was originally developed to help the spammers gather email addresses.

All that an imaginative spammer has to do is to post a "nice blog" comment, select "Email follow-up comments to me" - then watch as the Inbox fills up with follow up comments from bloggers, willingly giving up their email addresses to every stranger also selecting "Email follow-up comments to me", in that comment thread.

The people willingly providing their email addresses, to the world in general, are perfect targets for hackers later trying to brute force access to the Blogger accounts, using their email addresses.

If you decide to revert to a Blogger Profile for posting comments - or even if you don't - consider using Google 2-Step Verification, to protect your Blogger / Google account from hacking.

>> Top

Mail-To-Blogger - July 2012

We have seen a significant number of reports, in Blogger Help Forum: Something Is Broken, again mentioning inability to post to our blogs using EMail / Phone / SMS. The problem appears to have started several days ago - but was quiet for a while, and has been rather noticeable today.

Blogger Support posted last Thursday, acknowledging the problem - but since then, the problem appears to have gotten worse.

Oddly enough, I conducted my standard functionality test, and sent a message at 18:00 my time, which posted to my test blog at 18:16. Normal latency would be 1 - 2 minutes, not 16 minutes. Before posting, I was forced to update my MTB "secret word", as I examined my settings and found that the "secret word" had been previously cleared.

We have a rollup discussion where we are requesting diagnostic details, from blog owners observing the problem.

1. What is the URL of the blog?
2. When did you, initially, observe a problem?
3. When did you, most recently, observe a problem?
4. When did you, most recently, not observe a problem?
5. Do you receive an email refusal (aka "bounce back message"), or does the email / message simply disappear?
6. How long has it been since you last changed the MTB "secret word"?
7. Do you post using GMail based email, Non GMail based email, or Phone / SMS?

If you're able, please provide reports of your involvement with this problem.

---

(Update 7/30): Blogger Support has reported the problem as fixed.

Update, 7/30: This has been fixed.

---

>> Top

Confusion Over Community Building Accessories - Blog Feeds, EMail, And Following

A few blog owners become confused over the various community building options offered for our blogs. We see the queries in Blogger Help Forum: Something Is Broken.

How do I get a list of my Followers email addresses?

and

Why don't my email subscribers show up in my Followers gadget?

and

How do I know how many people subscribe to my feed?

These questions all come from people who don't understand the differences between blog feed subscribers, email subscribers, and Followers.

There are various community building accessories available for our Blogger blogs.

• Blog feed subscriptions.
• Email subscriptions.
• Following (aka "Google Friend Connect").
• Google+.

If you have a private blog, with designated readers, not all of these options will be as useful. Neither blog feed subscriptions, nor email subscriptions (which use the blog feed) will work for private blogs.

The native Blogger blog feed subscriptions, and email subscriptions, are pretty basic.

• People subscribe to the blog feed using any of dozens of various industry standard newsfeed subscription products. You can't count, or enumerate, these subscribers.
• You provide up to 10 email subscriptions, using BlogSend. You'll have a list of these (up to) 10 email recipients. Only BlogSend based email is available, to members of private blogs.

You can enhance the possibilities for both blog feed subscriptions, and email subscriptions, by using a FeedBurner enhanced feed.

You can make it easy for your readers to subscribe to your blog, using standard Blogger / Google gadgets. Look in the sidebar for this blog, for the orange "XML" icon. Beneath that, you will see "Subscribe to The Real Blogger Status by Email", which provides a link to the FeedBurner Email Subscription form. Next, you see the "Subscribe To" gadget, which is the Blogger supplied "Subscription Links" gadget, installed using the Layout "Add a Gadget" wizard.

Even with FeedBurner involved, all accessories won't be the same.

After you add a FeedBurner Email Subscription to your blog, don't get confused over the terminology - someone who Follows your blog using a FeedBurner Email Subscription won't be counted, or treated, as one who Follows using Following / Google Friend Connect.

• People who Follow using FeedBurner Email will not get their picture in the Friend Connect gadget.
• FeedBurner will give you a count of people who Follow, using Email.
• Following / Google Friend Connect will give you a count of people who Follow / Join your blog.
• Some people may do both - but don't expect this to be normal.

If you redirect the blog feed to FeedBurner, you can see statistics about everybody who reads your blog in their newsfeed reader. The FeedBurner statistics will be different from the Following / Google Friend Connect count, and from the FeedBurner Email subscriber count and list.

• People who subscribe to the FeedBurner feed using "Subscribe to: Posts (Atom)" will read the blog feed in their newsfeed readers - not in their email.
• People who read the redirected blog feed using their newsfeed readers will be counted in the FeedBurner statistics, but they will not provide their email address - so they won't be listed in the FeedBurner "Subscriber Management" list.
• Both people who Follow / Join the blog, using Following / Google Friend Connect, and people who use the "Subscribe to: Posts (Atom)" link will be redirected to the FeedBurner feed, and contribute to the FeedBurner statistics.

So enjoy the convenience to you, and to your potential Followers - but understand what they, and you, get - and don't get. You'll have up to three different counts, to consider.

• FeedBurner Email Subscribers. You can get an email address list, of email subscribers.
• FeedBurner Newsfeed Subscribers. You can get FeedBurner Statistics, about newsfeed subscribers.
• Following / Friend Connect Members. You can see pictures and profiles of Members, who do not Follow anonymously.

Finally, people can follow you using your stream, in Google+. If you Share your posts when you publish, your posts will go into your Google+ stream, and be visible to anybody Following you there. Sometime in the future, Google+ Circles may replace Following / Friend Connect.

If you include a Google+ Followers gadget on your blog, your Followers may get their pictures on your blog, similar to Following / Google Friend Connect. And you can use Google+, and restricted Google+ Circles, with a private blog - an option not available using the blog feed.

>> Top