New Sedo Offer Page Look and Feel!

[Acro]

--------------------------------------------------------------------------------------------------
Edit 08-27-2008: This method does not work anymore as Sedo has taken care of this particular issue, so clicking on the links is pointless. I'm leaving the rest of the post intact as two other people below are quoting it.
--------------------------------------------------------------------------------------------------

I'll show you how easy it is to scrape data from Sedo's new features!

Create a simple PHP script (can be Perl etc) that:

1. Logs into your account
2. Grabs all auctions via Sedo's RSS

Example: Zenplan.com is now on auction on the front page of sedo.com

Grab their id via the "Meet the seller" link.

Store the domain, the WHOIS and the seller's credentials as a seller and as a buyer.

Continue accumulating data; their unique seller id turns up the same with each auction they hold. Now, they are identified. All the auctions they ever held on Sedo are stored by your scraper.

Did I mention the seller id's are sequential? Want to grab them all? Just change the number.

I personally take issue with showing how long the domain has been listed at SEDO. No one needs this information.

Poor planning, poor execution. I won't address the security issues - yet. What concerns me is the privacy issue and how easy it becomes to store massive amounts of sales data with the blessings of Sedo.

[draggar]

A suggestion for sedo:
Instead of making these aesthetic changes that some may question privacy issues, how about improving on your parking program? The pages are, at best, very basic and allow extremely little room for customization. With parked, I have thousands of keywords and categories to choose from as opposed to the couple of dozen that is available though sedo.

The parking page templates are also basic and few and offer nothing in the way of customization.

I do like the rating system for as long as it can only be completed by people who have conducted business (as a buyer or a seller). If just anyone can submit feedback then it is worthless.

The "buddy" system - as others have said, are you a marketplace or a social site? I thought it was a place of business, maybe I am wrong and should go elsewhere? If I want to list buddies, I'll point people to my MySpace, LinkedIn, or FaceBook profiles.

[cursal]

I'll show you how easy it is to scrape data from Sedo's new features!

Create a simple PHP script (can be Perl etc) that:

1. Logs into your account
2. Grabs all auctions via Sedo's RSS

Example: Zenplan.com is now on auction on the front page of sedo.com

Grab their id via the "Meet the seller" link.

Store the domain, the WHOIS and the seller's credentials as a seller and as a buyer.

Continue accumulating data; their unique seller id turns up the same with each auction they hold. Now, they are identified. All the auctions they ever held on Sedo are stored by your scraper.

Did I mention the seller id's are sequential? Want to grab them all? Just change the number.



Poor planning, poor execution. I won't address the security issues - yet. What concerns me is the privacy issue and how easy it becomes to store massive amounts of sales data with the blessings of Sedo.

And Now sedo Should See the HOLE they created let see how/when/if they plug it, before the scraping begins and privacy is gone.

[dominator]

If it ain't broke, don't fix it.
--------------------------------

privacy is important
new features are useless
- - -
you need rating when you trade without escrow
in case of sedo, you do not need any rating
(because the buyer does not pay directly to the seller)

[msn]

I'll show you how easy it is to scrape data from Sedo's new features!

Create a simple PHP script (can be Perl etc) that:

1. Logs into your account
2. Grabs all auctions via Sedo's RSS

Example: Zenplan.com is now on auction on the front page of sedo.com

Grab their id via the "Meet the seller" link.

Store the domain, the WHOIS and the seller's credentials as a seller and as a buyer.

Continue accumulating data; their unique seller id turns up the same with each auction they hold. Now, they are identified. All the auctions they ever held on Sedo are stored by your scraper.

Did I mention the seller id's are sequential? Want to grab them all? Just change the number.



Poor planning, poor execution. I won't address the security issues - yet. What concerns me is the privacy issue and how easy it becomes to store massive amounts of sales data with the blessings of Sedo.

Funny - we looked at the same one. It is no problem at all, especially from the active auctions I scanned already.

[Acro]

As a side-story: In 2001 GoDaddy made the same mistake of using sequential (predictable) id's with a default password. All it took was to change the browser cookie accordingly. I helped them patch it.

sedo, your data is exposed without any attempt even. Your logic is flawed when you announce "features" that are in fact gaping holes.

So Monica, you have my cellphone number. Give me a call.

[TheLegendaryJP]

I agree with most that the information they are providing is not beneficial to a seller and may actually detour a buyer. I wont go further as to why.

As for privacy, this is a tuff one. No one is forcing you to list there yet on the other hand now that this feature has been enabled, it was done so without notification to those who wished to opt out before hand. That is where I would take issue.

[Acro]

Correct. No one is forcing me to list there, and that might be the ending statement in my 4 year relationship with sedo; unless sedo disables this feature selectively. At least, I want it turned off on my account.

I explained why this is a privacy breach. It's not just having access to raw data, it's what can be done with it. All it takes is a $50 script.

Sedo's latest customer is from Germany with an id #1384759

Who will be #1384760 ?

Do you undestand how easy it is to generate stats from Sedo's exposed data?

[NameGuy]

The activity index is very misleading. Some people, like myself don't sell domains in large volumes. Therefore, my index is 0 stars which could mislead a potential buyer that my selling reputation is low and may negatively influence their decision as to whether they should make an offer. Similiarly, an end user buyer is probably going to have 0 stars as well since they are not buying lots of domains and may just be interested in one certain domain. A buyer with 5 stars tells me the buyer does lots of domain purchases and as a seller I may not want to sell to a 5 star buyer because they are most likely not an end user and I can probably get higher sale price from an end user sale.

I also don't like my country and membership details provided publicly. I agree its a breach of privacy. Its really nobody's business when I joined sedo or where I am from.

[James]

Well if Sedo values our opinions..... Acro great work pointing out the flaws ...
I want to go on the record as being opposed to this "feature"

I hate a company "beta'ing" with private and confidential information

Please note this is a beta feature and is in the final stages of testing and review.

https://sedo.com/faq/faq.php?faqid=2...d=&language=us


jim

[katherine]

Displaying unique identifiers like that is a huge no-no in view of privacy issues and potential data aggregation by unauthorized parties (as explained above).

What's the point of trader reputation ? sedo provides the escrow so there is little monetary risk involved for both parties. Besides transactions are supposed to be anonymous on the sedo platform.

I also agree the star rating is a putoff. Why do I have 3 stars only ?

Sedo must quickly address all the valid points that have been raised.

[David G]

Personally I like the new information and look to it.

In the past there was far too little information readily available.

P.S. Acro, how is it a privacy breach when the names are not given?

[Nullmind]

how is it a privacy breach when the names are not given?

I think the names are easily identifiable via domainname whois and are associable to id

[dominator]

acro was already my favorite member here
now he is absolute #1

everybody, read carefully what he wrote
think about it
and support him!

- - -
i also agree with nameguy
what is activity index good for?

somebody sells 20 domains worth $100 each
a somebody else only 3 domains, but each for $xx,xxx

and somebody buys only one, because he is no trader, but an end-user...

[thevirtual]

privacy is important
new features are useless

New features are useless? How so?

This could be beneficial to buyers and sellers. I don't see this as costing anyone sales. When sedo introduced extra verification steps for buyers, many on the forum supported this even though it has even more potential to cost sales.

I find it surprising that domainers are seeing this as a privacy violation!

Domain holders have their info stored and displayed in Whois!

Whois privacy is costly and not full proof. There are tool such as the ones at Domaintools.com that anyone can use to find every detail about any domain registered past and present. Anyone can easily find your domains on forums such as DNForum by doing a search and find any other details they need.

If you would like to fight to protect domainers privacy there are much bigger fish to fry in my opinion.

[Acro]

Well, I am not here to convince everyone that *does not* care about why this is a huge privacy issue. But those who *do care* can easily see that.

It's the trivial manner with which sedo treats this situation that's mostly infuriating.

This is not about simply WHOIS data. It's not about your contact info. It's not about how much you sold ABCDEFG.com for on sedo.

It's about *all* of the above combined together, to form a huge pile of data that can be compiled, connected, stored, resold and why not - used against you in any form, including that of a legal action that will tag you nicely as a: cybersquatter, habitual domain seller etc. When that first lawsuit uses the Sedo data as proof of something that you call a job, a profession or a hobby, it will be too late to yell at Sedo "I didn't want that kind of info exposed!"

If the option is to leave Sedo as a selling platform, so be it.

[Raider]

My domains are not offered for sale at sedo, but they show for sale when you search the domain... Am I still vulnerable to having my other domains exposed?

[Acro]

Currently, I don't think that if you don't sell domains on sedo you can expose any such info. Did you simply park them at sedo?

The issue at stake is two-fold: first, the ease with which these new profile features can expose the seller's individual credentials, such as location, seniority and ratings, along with the age of the domain on Sedo's marketplace. Second, the ease with which the data can be scraped to form a database that can be mined for whatever purpose.

Sedo needs to provide us with an On/Off switch to these features. Those that don't care can do whatever they want.

[Raider]

Did you simply park them at sedo?

Yes, back in my newbie days. I dont park with them anymore but the domains are still listed in my account

Acro; Will removing the domains from your account solve the problem?

[Acro]

At this point, I have no answer because sedo has not responded. Actually, let me take this back: Stephanie from sedo was *clear* about it: your data remains with Sedo even after you remove it from your account, per some mysterious regulatory law. I called it the law of bullshit on the phone - that's when Stephanie could not handle my firm approach. I told Stephanie that I have nothing against her in person, that she is being used by me as a Sedo rep so that I can convey the message. So far Sedo has showed no concern addressing these serious issues pragmatically. When my privacy is at stake among other things, I am not exactly nice about voicing it.