behind the news

Do It Now, Fix It Later!

A blogger's discovery of a "major security hole" on nytimes.com makes clear that the Gray Lady is still learning to swim in the tumultuous seas of...
May 11, 2006

Recently, the New York Times has begun dipping its toes into the blogosphere by launching the occasional Times-sanctioned blog. And some of its nascent blogging efforts — most notably David Carr’s Carpetbagger blog leading up to the Oscars awards ceremony — were clear hits. But, alas, in recent days it’s become clear that when it comes to navigating the tumultuous seas of the blogosphere, the Gray Lady is still learning to swim.

To wit: On Tuesday, blogger Liza Sabater of the Daily Gotham and Culture Kitchen stumbled upon a Times test blog, which apparently someday soon will chronicle the minutiae of New York politics. The blog had yet to be introduced to the public. And, yet, much to her surprise, Sabater quickly realized that the Times had done a feeble job of protecting the site. Most notably, it had failed to secure the site’s posting privileges. To prove the point, Sabater logged in and promptly posted an item.

“Hi guys, Liza Sabater here,” she wrote. “No, I did not hack into the site. You’ve just got a major security hole.”

“Again this is not hacking,” she added on the Times‘ Web site. “You’ve overlooked what I would consider a huge detail in blog development: You never, ever leave the login permissions open while mired in testing and development.”

In a follow-up post, on her own Web site, Sabater was still marveling at the slip-up. “I honestly cannot believe they just left the door open like that,” she wrote. “I mean, I’d never ever develop a site for a client on their actual URL. And if I really had to, then all access would be restricted — and I mean, all of it.”

Elsewhere, as least one blogger felt that more could have been made of the open-access opportunity.

Sign up for CJR's daily email

“Oh, the places we would have gone with access to the Times political blog,” writes Jossip. “Cursed Liza Sabater! Why couldn’t she have just shared the password with everyone, waited for it to go live, and give us all a chance at accomplishing our greatest dreams?”

At the same time, other bloggers were chipping in with some friendly neighborly blogging advice for the Times.

“Here’s what the NYTD team should do next: Pick door number 1 … declare success and work with your blog community,” writes Surfette. “Liza has done you a favor. You’ve been hoping to recruit Liza’s feedback and her readers and you did. Now email all the speakers at the Personal Democracy Forum happening in your neck of the woods on May 15 and ask them to help you test the blog. A blog does not stand alone — anymore than one talks with one’s self, if one wishes to continue charging premium ad rates. So partner with other bloggers to work out the kinks.”

All of which prompted Mickey Kaus at Slate to lament the whole notion of a test blog.

“‘Testing,’ … ‘development’?” writes Kaus. “Wow. People actually do those things! And criticize others for not doing them! Sounds like creeping professionalism to me. … Of the two modes of product launching — (1) Rational, systematic testing and development, with dry runs and mock issues before anything becomes public, or (2) Just start doing it and fix anything that sucks — I’ve always found that (2) is not only more fun, it’s vastly more efficient. Dry runs are soul-killers. Nobody really puts their heart into a mock issue, and there’s no substitute for feedback from actual readers.”

There’s something to what Kaus says. But somehow we have a sneaking suspicion that “Just start doing it and fix anything that sucks” isn’t in the management procedures manual passed out to every junior editor making his way through the cubicles maze at 229 West 43rd Street.

Felix Gillette writes about the media for The New York Observer.