You've heard that whole "kicking a dead horse" phrase before, right?  Well I'm not typically a fan of that kind of behavior.  But after spending nearly an hour this morning reading various posts, comments, and general bitching from a number of other sites, I've decided to give the dead horse one more kick.  Because I think I have a different perspective than a lot of the other folks talking about the issue.

Yesterday I mentioned the fact that MyBlogLog had banned Jeremy Schoemaker of ShoeMoney.com from using their service.  A quick rundown looks something like this:

There are a couple of givens here, too.  The ID numbers were easy to find so he didn't technically hack their system or anything.  As I said yesterday in my response to the original ShoeMoney post, it's a very insecure system and the flaw needed to be pointed out.  I went home last night amused by the whole thing… but not really of an opinion either way.

This morning I discovered that there had been a huge uproar in the blogosphere about it.  Marketing Pilgrim's Andy Beal is boycotting MBL until ShoeMoney's account is reinstated.   Loren Baker at Search Engine Journal still doesn't see why Schoemaker was banned.  Jim Kukral says the action could push MBL into the "uncool" territory.  And literally dozens of other blogs are talking about the "childish" or "stupid" or "amateur" reaction of MyBlogLog to the situation.  This doesn't include the comments left on numerous blogs that basically reiterate the points being made by the bloggers themselves.

I said that I went home last night without an opinion.  But after seeing all of this in my feed reader this morning, I do.  As I said earlier, I'm pretty sure my perspective on the whole situation is different.  Most of these folks are blogging buddies.  I don't know any of them.  And I can look at the situation without having personal feelings about the way some company is dealing with one of my "friends".

I think MyBlogLog did the right thing.

I know… I know… I've done my fair share of MBL-bashing in the past.  But one of the goals upon which Matt started The Internet Marketing Monitor was balance.  When someone does something right, you should commend them and support them for it.  When someone does wrong, you should call them out on it.  And interestingly enough, Matt and I don't agree on most of the details of this situation.  But one of the fundamental flaws of a lot of blogs is the imbalance of their writing.  A lot of bloggers have a hard time stepping outside of their box of thought.

I think MyBlogLog has made some mistakes along the way.  I think their system needs a lot of work.  And I think their customer service is horrible (I've emailed them twice and never once received a reply).  That being said, I would have done the exact same thing that they did in this situation.  And here's why.

It's true that ShoeMoney's exploitation of their system has helped them fix a number of flaws in the past.  I'm sure they'd rather him have discussed the issues with them in private.  But unfortunately, the Internet doesn't operate like that most of the time.

The difference between this last post and other ShoeMoney posts is that he crossed a line this time.  He posted (and continued to add to) a list of prominent bloggers and their MBL user IDs to go along with his post.  He didn't just tell people what the flaw was or how it could be exploited.  He told them what it was, how to do it, and gave them a list of people to impersonate.

Too much info.

I don't care if the user IDs were easy for anyone to find.  There's a difference in telling people how the trick is done and passing out personally identifiable information about other users without their permission.  Several of the folks exposed on the list are the very same ones who are now crying foul at MBL.  Maybe they don't care.  They should.  But whether they do or not is irrelevant.  Someone on that list might.  Or someone on the next list of IDs for another service that ShoeMoney might publish.  If he wanted to post his own ID, that's his business.

Just because something can be done doesn't mean it should be done.  There are billions of illegal MP3s, movies, and warez floating around out there.  It's all available for any Joe Schmoe to go and get.  But the simple fact that it's there doesn't mean it's right to go out and steal all of that stuff.  ShoeMoney could have made his point just as effectively without posting those people's IDs.  And that's the line that he crossed.  There was absolutely no added benefit achieved by providing that list other than to stir things up (which I must say worked out very well).    The explanation of the exploit was just as effective without the list as it was with it.

By providing that list for the entire world to see, ShoeMoney, in effect, became a trafficker of stolen identities.  I don't even know why he would want to do that (except for the obvious linkbait purposes).  Granted, MBL isn't your credit report or your bank account.  But I know I personally wouldn't want my face being plastered up all over the web on who knows how many sites I'd never actually go to.  And these bloggers, who arguably owe a lot of their success to their reputations, shouldn't be cool with that either.  There's nothing to stop me from hijacking a MyBlogLog ID number from any of them and spending the rest of the day leaving spoofed comments (since that's so easy, too) with their names and MBL faces.

Seriously, people.  Why doesn't that bother you more?

I think a lot of this reaction has to do with friendships and blogging circles.  "Oh that stupid MyBlogLog… they can't do that to ShoeMoney!  He's my friend so I think they're all amateur idiots for banning him" (even though he exposed several of you to the world).  It's hard to react appropriately when it's a friend that does something.  Things that we'd normally get mad about seem funny or inconsequential when our friends do them.  And if we were truly friends with those people we'd be able to call them out just the same.. .and say "hey… that's not cool.."  If I, who am a complete stranger to all of those people, had posted that list… if I'd been the one telling people how to imitate these other bloggers… do you think they'd react the same way when I got banned?  Of course not.

MyBlogLog has it's flaws.  It, like most fairly new products, is far from a finished deal.  And I'll admit that their track record on a couple of things has been sketchy lately.  If they really are selling information, which their privacy policy says doesn't happen, they need to be called out on it.

But this is one instance when I think they reacted just like any other company would have (and should have).  If people are allowed to push the limits once… they'll do it again… and again (as ShoeMoney has done numerous other times).  Next time it might not be something as harmless as a MBL user ID.  The next time it could be something that actually does matter.  And companies just can't take that risk.

So regardless of what the ShoeMoney circle of bloggers is saying, I don't think MyBlogLog did anything that warrants a boycott.  And if that's the way some people want to react when companies respond to security threats, that's fine.  But it sets a bad example for other companies in future.  To avoid negative press some other company might not react in a similar way, even though it really is the best course of action for them to take.

So enjoy your boycott, folks.  Great show!