If you’re trying to get a message out, or provide a service, analytics are great. They tell you what’s working and what’s not, so you can focus on what does work. Unfortunately, when it comes to email, a lot of organizations use a third-party click-tracking service, which registers which mailing the user clicked on, then redirects them to the real website.

Why do I say unfortunately?

Because it’s what phishing does: Sets up a link that looks like it goes one place, but sends you somewhere else instead. In the case of a legitimate email with a click tracker, you end up at the real site eventually. In the case of a phishing message, you end up at a fake login page that wants to capture your username & password, or a site with drive-by malware downloads. Using this technique in legit mail trains people to ignore warning signs, making them more vulnerable to the bad guys. And it makes it harder for security software to detect phishing automatically.

Now add another reason: You don’t control that click-tracking service, so it had better be reliable.

That’s what happened with Comic-Con registration today.

Getting tickets to San Diego Comic-Con used to be a breeze, but last year the system broke down repeatedly. It took them three tries, with multiple handlers, to open a registration system that didn’t melt in the first few minutes.

A few days ago, Comic-Con International sent out a message with the date and time registration would open, and a link to where the page would be when it went live. They went to a lot of trouble to make sure their servers could handle the load, as did the company handling registration. They built a “waiting room” to make sure that people trying to buy tickets would get feedback, and get into a queue, when they arrived, but could still be filtered into the registration system slowly enough not to overwhelm it.

The weak link: The click tracker.

That click tracking service was swamped, and thousands of people clicked on that link and got a blank browser window with the “loading” icon.

To make matters worse, Comic-Con had not only insisted that you should use the link from the email, but they had make a big point about how you shouldn’t refresh your browser, or try reloading the page in another browser or tab, or you’d get sent to the back of the line. After last year’s fiasco, and the last few years of “Hoteloween” with the same sort of problems dogging hotel reservations, people were used to pages loading slowly, and CCI had trained them to let that blank page sit there, loading.

After 15-20 minutes, SDCC realized that the tracker was broken and sent out bulletins on Facebook and Twitter suggesting that people copy and paste the URL, or type it in manually. But by then, the damage had been done, and a lot of users who would have gotten in line at 8:00 got in line at 8:15 or 8:20 instead, and ended up so far back in line that the convention sold out before they made it to the front.

This all could have been avoided if the bulletin had linked directly to the target website instead of to that redirector.

So, email campaigners: remember this cautionary tale and do your own click-tracking.

(For the record: I was able to get through and got the days I wanted. But only because I copied and pasted that URL instead of clicking on it, and started at position #3948 about 30 seconds after registration opened. To be honest, I probably benefited from the fact that so many people who would have been in competition with me those first 30 seconds ended up getting in line after me, but it was still a bad move on SDCC’s part.)

Some…isn’t.

I mean, it’s dudical to the max, daddy-o!

I never pulled in a lot – maybe $10 to $15 a month on average, enough to buy an extra book or two (though recently it’s mainly been baby supplies), or counteract some of my hosting costs. That’s over now, though, because California just declared me (and other affiliates, of course) to be a local agent for Amazon, requiring them to pay local sales tax within the state. In response, Amazon has shut down the affiliate program within California so that they won’t fall under the new requirements.

I guess I’ll leave the inline links, since those are mostly the ones I would have included anyway, but there’s not much point in including those “Buy this thing I was writing about from Amazon!” ads anymore.

It’s astonishing how many times I’ve seen drivers stop near the entrance of a parking lot or structure and wait for someone else to load their car, get in the car, start the car, fumble around for sunglasses, make a phone call, put the car in reverse, check their messages, and then back out…even though there are 1306 open parking spaces on the upper levels, and a line of six cars behind them waiting just to get inside.

If the other driver is actually ready to back out, then yeah, it’s nice to pause and let them out. But if they’re not even inside the car, or if they haven’t even started it? The only thing you’re accomplishing by waiting for this space is annoying the people behind you.

Though I suppose for some people, that’s reason enough.

1. The company sends you an email with a link to a third-party or co-branded website, asking you to click on it in order to read important information about your financial/insurance/whatever account. (Or better yet, the third party site sends you the mail on the company’s behalf.)
2. You click on the link and open the site in your web browser.
3. You register for the site (which usually involves entering your name, choosing a password, and possibly entering other personal detail like a reminder question.)
4. You log into the site and actually read the message.

Can you see what the problem is?

That’s right: Steps 1-3 are exactly what you see in a phishing attack. Only in a phishing attack, the third-party site is a fake that’s trying to collect account information (like your login and password) or personal information (like your SSN).

So while they may be solving the immediate problem of “someone might intercept this message,” they’re perpetuating a broader problem by training people to fall for phishing attacks.

Sadly, this is not new.

When you hover over a link, the status bar tells you where it will take you.

This is important (especially for security) — important enough that they’ve moved the functionality elsewhere…but in a broken manner. They’ve put it into the location bar — you know, the field where you type in a URL, or look to see where you are.

The problem is that there isn’t room in the location bar to show the full URL of a hovered link except for very short links. The status bar has the entire width of the browser. The location bar has to share that space with the navigation buttons, the search box, the feedback button (during the beta), any custom toolbar buttons, the site name on secure websites, etc.

Just about every link I hover over ends up with critical information cut off in the “…” between the start of the hostname and the parameters at the end. That’s almost useless. (Almost, because at least the hostname is visibla, but it would help to see the page name as well.)

Displaying the target URL in some way is core functionality for a web browser, and you shouldn’t remove or break core functionality. In some ways this is worse than the proposal a few years ago to remove “View Source,” because that at least isn’t core functionality for a browser (though it is core functionality for the web, because it encourages people to explore and tinker and learn how to make their own websites — which is exactly why that was put back in). It’s crazy that I need to install an add-on to get back something as basic as a working preview for links.

The fare calculator tries to make the train cost look more appealing by showing you how much you’d spend driving the same trip, using a factor of 54.1 cents per mile from AAA’s driving cost formula.

Two problems:

1. They’re using the average value of all the cars on the road. Drive a gas-guzzling Hummer? A fuel-efficient Prius? Same cost estimate.

2. They’re using the formula wrong. It’s not intended to answer the question of “How much does this trip cost?” but “How much am I spending overall to use this car?” So in addition to fuel and maintenance, it also includes static costs of owning a car, like registration, insurance, interest payments, etc. Things that you’ll be paying whether you drive it today or not.

So unless you own an average car and plan on getting rid of it entirely, the comparison doesn’t actually tell you anything useful. But it does make Metrolink’s ticket prices look cheaper.

The slogan just bugs me, because they got the metaphor wrong.

Think about it: Vaccines work by training your body’s immune system to recognize a particular type of germ ahead of time, so that if you get exposed to the real thing later on, you can fight it off before it actually manages to make you sick. In terms of a warfare metaphor, it’s about training the troops who guard the home front so that if the enemy successfully invades past your borders, you can fight them off before they become entrenched.

The first line of defense would be something that stops them from invading in the first place. A well-defended border, in terms of ground troops. The Coast Guard in terms of sea. Radar and anti-aircraft missiles to identity and shoot down incoming enemy aircraft.

Your first line of defense against the flu? That would be your skin.

So wash your hands!

</pedantic>