"HTTPS Redirect" And Private Blogs

URL redirection is a Blogger magic trick, similar to a common sleight of hand trick in stage magic performances.

The Blogger HTTPS Redirection, a recently added feature in Blogger security, may be a similar Blogger magic trick - and a possible problem. Some browsers treat websites with multiple redirects as possibly malicious.

Private blogs, accessed through the Blogger / Google interstitial login, may also complicate HTTPS Redirection.

Interstitial webpages may pop up like magic, where you (or your prospective viewer) would least expect them.

• In front of a "private" blog, where you have to identify yourself to continue.
• In front of a blog that contains (or is reputed to contain) objectionable material (naughty pictures or such).
• In front of a blog that is (or appears to be) published off site.
• In front of a blog that has been blocked, for TOS violation, or maybe for hosting hacking content.

One of the problems with HTTPS Redirection may involve private blogs.

To access a private blog, you must be identified.

To access a private blog, one must be logged into Blogger, using an account that is a member or owner of the blog.

If you are not logged in to Blogger, you may be asked to identify yourself, to access the blog.

If you are logged in to Blogger, but using a non member / owner account to access the blog, you may simply be refused access.



Both of those displays come after the link to the blog - and before the blog is viewed. They are called "interstitial" webpages.

If you try to access a private blog, and are not a member / owner, you should see the well known Blogger / Google interstitial login webpage. In order to check that you are a member / owner, the infamous Google Login Cookie must be accessed.

The Google Login Cookie, created under the Google login sequence and accessed from a Blogger display, is a "third party" cookie. If the browser blocks "third party" cookies, as many do, the browser may refuse access to the private blog - even if the prospective reader is logged in to Blogger, as a member or owner.

If third party cookies are not blocked, too many redirects may present a problem.

If third party cookies are not blocked, some browsers may still have a problem - too many redirects. Some browsers may object to multiple redirects to other websites - as possible malicious content. A redirect to an interstitial display, following the "HTTP to HTTPS" redirect, may be one too many redirects.

The mysterious Blogger "private blog" interstitial display, which lets people login to a private blog when necessary, may contribute to the "too many redirects" problem, for browsers which are sensitive to multiple redirects. Even if a private blog member / owner is logged in properly, the interstitial display is still involved, in checking for proper login - and this is where the infamous "third party" cookie is involved.

You may need to adjust your security settings, for best results.

If you are trying to access a private blog - and you see "This blog is open to invited readers only", or you are forced to login, again (!!), you will need to check and correct your cookie filters. You might want to similarly check and correct your script filters.

Please remember that the filter that is affecting your private blog access - whether cookie or script - may not be part of your browser native settings. Check thoroughly.

---

One of the challenges involved with the recently added #Blogger "HTTPS Redirect" may involve private blogs, and the Blogger private blog interstitial login. "Third party cookie" filters, and the Blogger private blog interstitial login, will complicate this problem.

https://productforums.google.com/d/topic/blogger/WiR84_IRF8w/discussion

Act Immediately, When Invited

Some moments come fleetingly, and never again.

One such moment may be, when you receive a blog membership invitation.

The purpose of this message is to inform you that xxxxxxx has invited you to join their private blog "xxxxx xxxxx". To accept this invitation, click on the button below.

or

The purpose of this message is to inform you that yyyyyyy has invited you to contribute to their blog "yyyyy yyyyy". To accept this invitation, click on the button below.

Unless you know the blog owner, this may be your one chance.

If you get an invitation to be a designated reader on a private blog - or an author on either a private or team blog - decide, and act as soon as possible.

Any invitation that you get will be temporary. Blog membership invitations expire, after a fixed amount of time.

Accept the invitation, to view and note the URL.

If the blog is private, and you accept the invitation as a reader, make a note of the URL too.

Long ago, you might get a "preview link" in the invitation - allowing you to view the blog, and bookmark / copy the URL for later. The "preview link" feature was abused by too many owners - and appears to be gone now.

No preview = no URL until after you accept the invitation.

Become an author, on a team blog!

Become a reader, on a private blog!



There's a limited amount of detail, in the invitation.

How useful is either invitation, if you don't accept, when viewed later? You can get the owner name (as provided by the owner), and the blog title - and that's it.

• Invitations contain only the author name, the blog title, and a membership token.
• A reader invitation, for a private blog, may not produce an entry in the dashboard "My blogs" list.
• Both author and reader invitations will expire.

Act promptly, for best result.

If you get an invitation, and you file it away so you can "think about it", don't think about it too long.

Once the token expires - and if you don't know the owner - you'll not be able to contact the owner. And until you accept the invitation - and actually view then bookmark the blog - you won't find out the URL.

Act quickly - or never.

---

If you get an invitation to be an author on a private or team #Blogger blog, or a reader on a private blog, act promptly. Invitations expire too soon - they contain few details - and won't be very useful later.

https://productforums.google.com/forum/#!category-topic/blogger/z-lKeqO-ssA

Custom Domain Publishing And Private Blogs

We see an occasional report in Blogger Help Forum: Get Help with an Issue, about custom domain publishing.

My readers can't view the blog - they get a redirection count error!

DNS analysis shows a properly setup domain. When we try to examine the blog, we see a private blog notice - or we are required to login.

But why a private blog, using a custom domain?

The purpose of publishing to a custom domain is to increase readership - by making a blog more visible, using a non BlogSpot URL.

A private blog has limited readership, based on permissions provided by the owner. The need to make a blog private conflicts with the need to increase reader population.

Besides the functional conflict, there's a second problem with combining a custom domain published blog, and access by invitation. Both the custom domain redirection, and the private blog redirection involve interstitial code.

This is a private blog. Combine this, and a custom domain redirection - and you get trouble.



A potential blog reader, when accessing the blog by the BlogSpot URL, will redirect to the domain URL - and then to the access checking interstitial. Some browsers will interpret this as a possible security issue, and cite

Too many redirections!

In other cases, the two redirections may lead to a redirect loop - and the reader will see a white screen of death.

What ever the result - "Too many redirections", or a redirect loop, the potential reader will never see the blog.

If you want to publish a blog, and limit reader access by invitation, you're better off publishing to BlogSpot. If you want to use a non BlogSpot URL, a public blog makes sense.

---

You are allowed to publish a #Blogger blog with a designated reader population - and you're allowed to publish a blog to a non BlogSPot URL.

You can publish a private blog to a custom domain, if you wish - but this is not recommended. Learn why combining limited access with a non BlogSpot URL is not a good idea.

https://productforums.google.com/forum/#!category-topic/blogger/5IUByvxKYeg

Blogger Magic - Make A Private Or Team Blog

Some blog owners like to restrict access to their blog - and others want to have multiple people able to publish, or maybe to administer their blog.

A few even want multiple administrators, and restricted access. Both private and team blogs involve use of the Permissions wizard, and the membership invitation / acceptance process.

Making either a private or a team blog starts from the Permissions wizard. Just keep the multiple functions, and the different links, in mind.

The Permissions wizard, on the dashboard Settings - Basic page, is how we setup both private and team blogs.

You invite members - prospective authors and readers - using "Add authors" and "Add readers", respectively.

Start from the dashboard Settings - Basic page, in both cases.

Start from the Settings - Basic page.

Find the Permissions wizard.



The "Add authors" link is used for adding both administrators and authors.

Click on "Add authors", to add prospective administrators and authors.

Click on "Add authors", and add prospective blog authors.


Add a list of names / email addresses, with entries separated by commas.

Paste or type email addresses of prospective administrators and authors, into the "Add authors" window. Or use "Choose from Contacts".

The existing "Blog Authors" list is updated, and invitations are sent, when you hit "Save changes".

To make an administrator, wait until the invited author has accepted membership. Then, change "Author" to "Admin", in "Blog Authors". Don't change an author to administrator, unless you understand the risks!

The "Add readers" link is used for adding readers.

Click on "Add readers", to add prospective readers.

Click on "Add readers", and add prospective blog readers.


Add a list of names / email addresses, with entries separated by commas.

Paste or type email addresses of prospective readers, into the "Add readers" window. Or use "Choose from Contacts".

The existing "Blog Readers" list is updated, and invitations are sent, when you hit "Save changes".

Select either "Only blog authors" or "Only these readers", for private blogs.

You can make a blog private to Authors - or have both Authors and Readers. Select "Only blog authors" or "Only these readers", respectively.

Each prospective member must accept membership.

For an invited author or reader to become an active member, they must open the email and accept membership.

Prospective authors and readers are listed as "open invitations" - under either the "Blog Authors" or "Blog Readers" window - until they accept the membership invitation.



Accepting membership involves opening the emailed membership invitation, and clicking on the invitation link. The new member can use an existing Blogger account - or setup a new Blogger account, on the fly.

A GMail account is not required - just a Blogger / Google account - existing or new.

Remember membership limits.

Whether you are making a private or a team blog, remember that every blog is limited to an absolute total of 100 members.

• You.
• Any additional administrators.
• Authors.
• Designated Readers.

Designated readers (in a private blog) are part of the 100 member limit. Un designated readers (in a public blog) are not part of the limit. A public blog can have any number of readers.

Membership revocation may not be immediate.

You can revoke or update membership of an administrator, author, and / or reader - but membership changes don't always take effect, immediately.

---

Making a #Blogger blog with administrators, authors, and / or readers starts with the Permissions wizard - and continues with each prospective member accepting membership, using email sent by the Permissions wizard.

https://productforums.google.com/forum/#!category-topic/blogger/Vd_L5xAtKFY

Share Posts, From Private Blogs, By Email

Owners of private blogs have, periodically, lamented the lack of options for distribution of comments and posts. We've seen a few queries, in Blogger Help Forum: Learn More About Blogger.

How do I let my readers subscribe to my private blog?

There's no good answer, to please everybody, here.

You can't use EMail, FeedBurner, or Reading List, for sharing private blog content. FeedBurner requires the blog comments / posts newsfeeds - and private blogs don't produce newsfeeds.

If you need to distribute content from a private blog, you'll have to use BlogSend.

Private blog post subscriptions require the dashboard "BlogSend" feature.

You'll have to use "BlogSend" to provide email subscriptions, for private blogs - and that limits you to 10 subscribers (1 who should be you). That's the "Email posts to" option in the dashboard Settings - Email page.

"BlogSend" aka "Email posts to" is the only option, for private blogs.



You can try to email specific posts, from a private blog.

You can try to use the Blogger post footer "Email Posts" feature.

Just enable the "Email Post Links" option in "Configure Blog Posts". You cannot enable "Show Share Buttons" - but you can enable "Show Email Post Links".

Use "Configure Blog Posts" from the dashboard Layout page.

Look under "Post Page Options" for "Show Email Post Links".



With the option enabled, and the icon visible, it's still a no go.

D'Ohh!



There's still no social sharing of private blog content.

Note the advice for "Show Share Buttons".

Sharing is available only for public blogs.

You can't share blog content, outside Blogger, if the blog is private. That protects private blog owners, from having their confidential posts distributed to the world.

We can't share content from private blogs, using EMail, FaceBook, Google+, Pinterest, or Twitter.

---

If you publish a private #Blogger blog, you cannot email or share comments or posts. Your only option will be BlogSend aka the "Email posts to" dashboard option.

Private Blogs Limit Other Blog Features

Private blogs affect other Blogger features - and the combination of results are inconsistent.

With dynamic templates, the private blog selection causes an inoperable display. Conversely, with Google+ Comments, enabling Google+ Comments disables the private blog (designated reader) selection - and vice versa, in the various Blogger dashboard pages.

The two interactions - and differing mutual exclusiveness - contribute to some interesting diagnostic sessions, in Blogger Help Forum: Get Help with an Issue.

Intriguingly enough, when one of the known limitations with private blogs is diagnosed, some blog owners may treat the limitation as a personal insult.

Not all blog owners understand the technical limitations, with private blogs and other Blogger features. The limitations are based on simple technical interactions.

• Dynamic templates, and private blogs.
• Google+ comments, and private blogs.

Dynamic templates, and private blogs.

Private blogs do not publish blog newsfeeds. Dynamic templates require comments and posts newsfeeds, to generate the displays.

You can make a blog private - and you lose the "Dynamic Template" selection, in the dashboard Template page.

Some of the templates offered on the Template page, for a public blog.
Simple.
Dynamic Views.
Picture Window.
Awesome Inc.

Some of the templates offered on the Template page, for a private blog.
Simple.
Picture Window.
Awesome Inc.



If the blog has a dynamic template already, you can change to private access (edit Permissions, and designate readers), with no warning. The next time the blog is accessed, you will see the Spinner of Death.

My Dynamic Template test blog, set to Private.



Google+ comments, and private blogs.

When Google+ is used, no access to the Blogger permissions database is available. Since Google+ Comments are (or can be) Google+ stream posts, Google+ Comments can only support public blogs.

If you enable Google+ Comments, you will see a warning in the Permissions wizard - and you'll have no ability to Edit "Blog Readers".

Google+ Comments enabled. Learn more

If the blog is private already, you'll similarly see a warning on the dashboard Google+ page.

Google+ Comments are unsupported on non-public blogs and blogs marked as containing adult content. Learn more

So Google+ Comments, and private blogs, are mutually exclusive, on the dashboard - though Dynamic Views and private blogs are not, with intriguing result.

Why won't my blog load? It was fine, yesterday!

And when the blog address is provided with the problem report, we can see the problem.

Learn More.

• More information about Dynamic Views blogs.
• Manage Google+ Comments for Blogger.
• Control access to your blog.

---

The option to designate permitted readers, for a #Blogger blog, affects other Blogger features. Not all blog owners know about or understand the limitations that exist.

Private Google Groups Email Distribution Is Broken

Some blog owners have reported in Blogger Help Forum: Get Help with an Issue, about broken email distribution.

There are various ways to distribute Blogger blog content, to email. For those unable or unwilling to use FeedBurner Email Distribution, one popular alternative is Google Groups.

One drawback of FeedBurner based distribution is that FeedBurner uses the blog newsfeed - and is unusable for private blogs.

Google Groups is the best content distribution medium, for private blogs.

The only scalable distribution medium, for private blogs, is Google Groups. Right now, Google Groups, for some owners, is not accepting incoming email.

This problem may not be unique to Blogger blogs. There are other reports of this problem, in the Google Groups Support Forum.

We are asking for details, in a previously posted forum Problem Rollup topic.

We have a previously discussed article, and a Problem Rollup topic, in Blogger Help Forum: Get Help with an Issue - where we are requesting details, as phrased above, about the problems. If you have details to contribute, solution to this problem may result from your contribution.

Please help Blogger Engineering to help you - and make your responses polite, relevant, and responsive. If this problem is to be identified, and you are affected, resolution depends upon you. And also report your problem in Google Groups Support.

---

Some #Blogger blog owners are reporting that distribution of private blog content, using Google Groups, is not operational. This problem may not be unique to Blogger blogs, as there is some discussion in Google Groups Support.

Don't Password Protect A Blogger Blog

We see the signs of naivete, periodically, in Blogger Help Forum: Learn More About Blogger.

How do I require my readers to enter a password, to keep my blog safe from public view?

This blog owner does not understand the realities of setting up a private blog.

Long ago (very long ago), a computer system might have "private" files, and a shared password, known by everybody, for each file. Nowadays, a private Blogger blog uses team blog access - or team blog ownership - and each team member gets to choose her / his own Blogger account, with a password that he / she decides to use (and hopefully, remember).

Having a group shared password is fine, for a small group, where nobody leaves. What happens when somebody leaves the group?

Group shared pass codes are fine - until the group changes.

Have you ever worked in an office, where the doors are protected by a tumbler key set - or maybe combination push buttons? That's a shared password system. What happens when somebody leaves the group? Every door has to be re keyed - or the locks have to be changed.

What if the blog owner has to change the password for the blog, because somebody shared the password with a stranger - or somebody just left the group? Have you ever gotten to work, and found that your key - or assigned push button combination - doesn't work?

Have you ever had to wait for the department secretary to get to work, and give you a new key, because they changed the locks last week, while you were out of town? Have you had to anxiously search your email, looking for the message from the manager, providing the new password (here's hoping that you can get online, and your computer / phone has a freshly charged battery)?

Personal pass codes promote individual responsibility.

The personal account / password approach is so much more supportable - and it promotes responsibility. Have you ever had the manager ask everybody who came in over the weekend, and left the office in a mess?

With everybody using a common physical key, to open the door, there is no telling who comes and goes. Using individual passwords - or preferably, a card key system - you can audit employee presence, and encourage responsible attendance.

Use personal Blogger / Google accounts, for better security.

Using a personal account / password is so much better than a group shared password. Don't waste time trying to protect your blog, behind a shared password script.

Just make the blog private. Invite designated members - and let each member choose their own account / password, for blog membership.

Private Blogs, And Dynamic Blog Access

Occasionally, someone may publish a blog as private, invite / accept readers, then later decide that results are not as positive as desired.

It's easy enough to change a blog, from Private to Public. Just go to the Permissions wizard, in the dashboard menu Settings - Basic, and change Blog Readers from "Private" to "Public".

Unfortunately, this may not leave everybody able to access the blog.

I made my blog public, last week. Some of my friends are now seeing

Your current account does not have access to view this page.

Why is this still an issue?

The blog owner, in this case, is seeing the effect of cache, and authentication.

In many cases, simple instructions to "clear cache, cookies, and sessions" may resolve this problem. This does not always work, however - and the mystery why it does not always work may frustrate us, almost as much as the original symptom.

Sometimes, clearing private data - even though it may be a bit drastic - does nothing to resolve the problem at hand.

I just did that - and there's no improvement!

Now, we suspect that there is a cache, outside the browser, that can't be cleared.

There is no permanent solution, for upstream cache. But, there may be a diagnostic step, that helps us understand what is going on.

This is the URL of this blog.

http://blogging.nitecruzr.net/

If I need to access the main page, without refreshing the browser, or clearing cache, I can retrieve the updated content, on a temporary basis.

http://blogging.nitecruzr.net?

A URL containing a "?" is normally used for retrieving a web page, dynamically, with extra settings embedded in the URL.

http://blogging.nitecruzr.net?something

A dynamic retrieval is evaluated immediately, using the Blogger server (in this case) - and without any interference from any caches.

Even without a real need to have the URL evaluated by the server, we can still make the URL dynamic, just by adding the "?" at the end. And this bypasses any cache - including cache upstream from the browser.

http://blogging.nitecruzr.net?

Just remember - this is a temporary solution.

If you forget to use the "?" later - and you retrieve the old web page, still in cache, don't be surprised to keep seeing

Your current account does not have access to view this page.

Until the cached page expires normally, from the cache that you can't control, that's going to still be a possibility.

>> Top

Interstitial Warnings And Cookie Filters

Along with problems with comments and unwanted CAPTCHA forms, we're seeing some reports about problems with persistent and unwanted interstitial displays, in Blogger Help Forum: Get Help with an Issue.

The interstitial display, and its use of cookies, is similar to the new mandatory anonymous comments CAPTCHA form. If your identity can't be determined, or your decision to view a blog can't be remembered, an interstitial warning is displayed - just as the CAPTCHA form is displayed, when your readers are preparing to comment.

Interstitial warnings require cookies, both to identify you, and to remember your decisions.

• In front of a "private" blog, where you have to be identified, to determine your relationship with the blog.
• In front of a blog that contains (or is reputed to contain) objectionable material (naughty pictures or such), to remember your desire to view the blog, and your decision to continue.
• In front of a blog that is (or appears to be) published off site, to remember your desire to view the blog, and your decision to continue.
• In front of a blog that has been blocked, for TOS violation, or maybe for hosting hacking content, where you have to be identified, to determine your relationship with the blog.

If the cookie can't be read, the interstitial code will try again.

If a preference cookie can't be read after being created, the blog display may force you to try again, and re display the interstitial warning. If a session cookie is not accessible to the blog display, the reader gets treated as someone not logged in.

In neither case, does the reader get to go to the next screen, and view the blog.

Both session cookies, and preference cookies, are vulnerable to "third party" cookie filters.

• A preference cookie is created under "blogger.com", where the interstitial runs.
• A session cookie is created under "google.com", where you login.

These are third party cookies, being read under the blog published URL.

Both types of cookies are read under "blogspot.com" - or under whatever custom domain, or whatever country code alias, is being used by the blog, as displayed.

Whether a cookie is needed, but non existent - or needed, but can't be read - the result is the same. The reader is unable to continue, and does not get to view the blog, when necessary.

If the computer has a cookie filter, the cookie won't be read.

If a reader is subject to a filter that blocks "third party" cookies, and a preference or session cookie is needed, the reader will be unable to continue. This is a condition that Blogger Engineers cannot program around, because it is part of the security code, in the browser.

Thanks to the Google "One account" login, as Blogger is made a way of life to more of a reader population who have no interest in maintaining security on their computer, these issues will become more problematic.

If You Want To Keep A Secret, Don't Publish It

Have you ever heard the old saying

I had a friend, and I had a secret. I told my friend my secret - and now, I have neither a friend, or a secret.

Occasionally we see signs of naivete, in Blogger Help Forum: Something Is Broken.

I have a private blog! Why do I see my blog listed in Google?

or

I distinctly set my blog to be invisible! Why is my blog being indexed?

Not all blog owners know that neither the "disallow" statement, in "Robots.Txt" - nor the "noindex, nofollow" directives, in our blogs - are mandatory.

If you publish content on the web, chances are it is - or will eventually be - indexed somewhere, by some search engine.

Obedient search engines won't index content, when instructed.

Obedient search engine robots will observe the Google privacy directives, such as "noindex, nofollow" directives in HTML code, and the instructions in the "robots.txt" file. Not all robots are obedient, however.

There are many search engines besides Google - and not all search engines observe privacy directives.

The various robotic processes, which scan for abusive content, scan all blogs and websites out of necessity. Some archiving robots archive everything - not just content that's provided openly.

Many search engines share indexed content - obedient, or not.

Many search engines share data with other search engines, and / or retrieve data from other search engines. Even Google will index some sites, indirectly, that are not intended to be indexed.

Ownership and privacy laws vary - from country to country, and between Internet services. What you consider private (personal data), if you live in Germany, may be treated as common knowledge, by someone in Russia, or the USA. And if you report someone publishing your private data to Blogger / Google, you may get different treatment than from WordPress, or from an independent hosting service in China.

If you publish content, expect that it will be indexed.

If you want to keep a secret, do not publish your secret on the Internet. Regardless of whether you publish it to a blog with designated readers, using the Blogger dashboard Privacy settings, or even using a custom "robots.txt" file, your secret may be visible on any search engine - even on Google.

If you think the Internet is your friend, try publishing a secret there. You will learn the truth, eventually. And hiding your secret, after it gets out, will not be an easy task.

Private / Team Blog Owners, Using Non GMail EMail

For some time, we've known about a problem with non GMail based Blogger accounts, and comment moderation / notification email.

That problem, though mildly annoying to the blog owners affected, has an easy workaround - use a GMail based email address, for comment moderation / notification. That's a quick 15 minute fix.

1. Setup a GMail account, if necessary.
2. Change the comment moderation / notification email addresses, for the blog(s) affected, to use the GMail email account.

GMail email accounts are, after all, free.

Besides the ease of putting a workaround in place, that problem is not all that severe. The problem with comment moderation / notification email, being filtered, only affects blog owners who moderate before publishing. Owners who moderate after publishing can always use the Blogger dashboard Comments wizard, at their convenience, to moderate.

This week, we realised that the base problem - rejected email because of non GMail based Blogger accounts - may also affect owners of private / team blogs, who have prospective non GMail members. This specific problem probably affects less blogs - but it won't have as easy a workaround.

Owners of private / team blogs, who use non GMail based Blogger accounts, may not find an easy workaround for the problem of Blogger blog membership invitations being rejected by a non GMail email system.

The base problem, as it affects comment moderation / notification, is obvious. The owner of an affected blog will see all comment moderation / notification email, sent to him, rejected by his own non GMail email system. Anybody who owns a blog that's affected will be sending all comment moderation / notification email to the non GMail email system.

The base problem, as it affects private / team blog membership invitations, is more subtle. This problem will affect blogs owned under non GMail based Blogger accounts - and / or when sending invitations to prospective members who use non GMail email systems. Email within Google - Blogger to GMail - should not be subject to the same filtering, since the email will actually originate from a Google server.

With all that, this problem will be more annoying, in that it will involve email rejected by the prospective member email system - not by the blog owner email system. Prospective blog members won't likely be receptive to changing their email addresses, just to receive a membership invitation. Also, the blog owner may not always see the email rejection - and may not know that the invitations are being dropped - and may not be found in the "Bulk" / "Spam" folders.

To avoid this problem, membership invitations, from any affected blogs, will have to have be sent from a GMail based Blogger account. This will require a GMail based Blogger account, added as an additional administrator - and it will involve the known risks of having an extra administrator account. Only administrators can send membership invitations.

This problem will probably have less exposure than the one with comment moderation / notification email - but to the blog owners affected, it will seem more severe. It will actually prevent prospective members, using non GMail based email systems, from joining the blogs affected. And, it will require a blog owner to add a GMail based Blogger account, as a blog member.

Please, NEVER Share Your Blogger Account!

We see signs of naivete, in Blogger Help Forum: Something Is Broken. too often.

I gave my boyfriend (girlfriend, former spouse, Internet acquaintance, whatever) my account password - and now, I can't access my account.

This is a problem which Blogger cannot resolve, in any way.

Please, never ever share your Blogger account. Blogger accounts, like Blogger blogs, are free.

If someone who you know would like to read your private blog - or contribute to your team blog - add that person as a blog member, and let her / him use his / her own Blogger account (new, or existing).

There is absolutely no need for you to ever share your Blogger account.

Use private / team blog membership, when applicable.

Shared Blogger accounts carry all of the risks of team blog ownership - and more. Do not share your personal Blogger account to provide private blog membership, or team blog ownership.

Blogger does not provide an option to protect blog content, using a shared password. If you want to password protect blog content, make the blog private, and add readers. Let your readers use their own password (with their own Blogger account).

Split a blog into a security cluster, if necessary.

If you want to password protect a portion of a Blogger blog, break the blog into two portions - the public portion, and the private portion, and provide the private portion as a private blog.

Private blogs, with large reader communities, will require imaginative setup.

If you must have a private blog with more than 100 members, and you cannot use Google+ as an email based distribution medium, setup a read only account to access the blog - and let the members share that Blogger account.

If you setup a shared Blogger account as a blog member (read only), you'll need to maintain a separate mailing list of all shared members. Use BCC to email everybody (don't share everybody's email address with everybody else), giving them the shared account name and password. Save the mailing list, carefully.

With 100+ shared account members, chances are that one day, somebody will change the password on the account, and lock out everybody else. You'll have to then setup a new Blogger account, make that account a new read only blog member, cancel the old member, and email everybody with the new shared account name and password.

If you must have a community, of over 100 members, and let everybody share (not just read), use Google+ - or setup a wiki based website. Your needs are far beyond the ability of Blogger.

When another person works on the blog, they can use their own account.

If you need someone else to work on the blog, make them a blog member or administrator - with their own Blogger account. If their usefulness is temporary, when they are done, revoke their access to the blog - then verify that they did not leave any back door code behind.

Your account name and password is your personal identity.

In any case, keep your account and password (and the blog ownership) private, to you.

Use common sense. Do not share your Blogger account.

• Do not share your Blogger account with your boyfriend.
• Do not share your Blogger account with your girlfriend.
• Do not share your Blogger account with your husband.
• Do not share your Blogger account with your wife.
• Do not share your Blogger account with your boss.
• Do not share your Blogger account with your employee.
• Do not share your Blogger account with your collaborator.

I've warned everybody that team blogs are security risks - but they are way safer than team Blogger accounts.

• Do not wear other peoples underpants.
• Do not share your Blogger account.

Both are rules to live by.

Dynamic Templates And Private Blogs

With the new dynamic templates steadily gaining acceptance, there's one group of blog owners finding themselves left out - and not understanding why.

We are seeing various queries in Blogger Help Forum: Something Is Broken, from owners of private blogs.

Is there a way to use a dynamic view, and have a private blog, just for us to view?

And the answer here is simple

No, private blogs don't publish a blog feed - and dynamic views won't work.

This is not a capricious or pedantic decision by Blogger, it's a technical limitation.

Private Blog Owners Need To Use Google+, To Distribute Blog Updates

Recently, we've seen a few questions in Blogger Help Forum: Something Is Broken, about email distribution of blog posts, from private blogs.

I previously used a Google Group, to send an email to more than 102 people. This is now no longer working - my Google Group is not notified of a new post, automatically. Any idea what could have changed or be going wrong?

Here, we see signs of the use of Google+ becoming more necessary.

Some months ago, Blogger, responding to a security vulnerability in BlogSend, changed the email address used by BlogSend. This required many owners of private blogs, using Google Groups to distribute BlogSend based email updates, to add "noreply@blogger.com" as a Group member. This requires the use of the Groups administrative control, to add a new member without consent.

The ability to add a new member, without consent (without requiring return confirmation from the new member), carried with it a warning, to Groups administrators.

If you misuse this option, your use of it may be revoked.

This ability, when provided, was an excellent tool for spammers, to maintain a spam victim mailing list.

Recently, and possibly involving the misuse of "noreply@blogger.com" as Groups members, the option to add Groups members without consent was removed from the Groups "invite members" wizard. Now, any new Groups memberships require return consent from the new member.

This change leaves owners of private Groups unable to add "noreply@blogger.com" as a Group member - which leaves Groups unusable for distribution of private blog content. Private blog owners now have only one option - Use Google+, and properly restricted Circles, to selectively distribute blog post updates.

Note that owners of publicly accessible blogs can use Google+ also, in addition to the also popular option to use FeedBurner Email Distribution. Or, if you want to continue using Groups for distribution, set "Who can post messages?" to "Anyone can post", in the "Group settings" Access tab.

Google+ will also be useful as a replacement for Private blogs, where membership has grown past the 100 member limit. This will, unfortunately, require that each member setup a Google+ account - and become less anonymous. One feature of Google+, which not every blog owner or member appreciates, is the loss of anonymity. Google+ accounts are based on our actual legal identity, by Google policy. Not everybody wants to be identifiable.

>> Top

Innovative Concepts Behind The Dynamic Templates

Now that the new dynamic templates have been available for several weeks, and people are actually using them on their favourite blogs, some folks are disappointed that they can't use them.

I'm trying to install the dynamic template on my blog, and I'm seeing

Sorry, dynamic views aren't available for this blog.

Why me? What did I do wrong??

And these people simply have no idea how the new templates work - and why they don't always work.

Previous templates, whether Classic, Layout, or Designer types, served the formatted content of your blog, as posts applied to the template, page by page, from the Blogger servers. Since the blog content is served page by page, from Blogger, auto pagination is required to protect the Blogger servers from overload by single, large blogs, which generate irregular and large amounts of network and server load.

Blogger Dynamic Templates are a very innovative approach to web content, where the dynamic templates use the client computers as local web servers. Check out my test blog, and watch what happens. What you see is a few seconds of the orange gears turning, while your browser downloads the dynamic template code. This code is reused, when you view any Blogger blog that uses a dynamic template.

Once the dynamic template code has been downloaded, your computer simply retrieves the raw text of the newsfeed from the blog being displayed. Newsfeed text is far lighter than formatted blog posts, as served by Blogger from Classic, Layout, or Designer template blogs. Also, the newsfeed text is downloaded on a page by page basis. The overall effect is far less load on the Blogger servers and the Blogger / Google network - and eliminates the need for auto pagination.

Also, dynamic templates, which provide less options, are more stable - and require less support resources, which is necessitated by blog owners who are more concerned with accessories and style, rather than content. Use of third party accessories, and extensive tweaking of the blog layout, are two major causes of instability of Blogger blogs, using a dynamic template.

For all of its simplicity, reduced support resources, and the reduced load on the Blogger network and servers - and yes, reduced load on your network too - the dynamic templates have serious limitations.

1. The careful formatting of your posts - including fancy, relevant, fonts and other features - isn't available. Newsfeed text, which you can see in a copy of this blog, for instance, contains very few formatting options.
2. The dynamic templates only work for blogs with a full feed. Blogs with a disabled blog feed - or a partial blog feed - can't use them.
3. Since the dynamic templates require the blog feed, they can't be used on private blogs.

So, the new, dynamic templates aren't for everybody - or even for everybody who are willing to overlook the currently known design deficiencies. For public blogs which don't require extensive formatting and special retrieval options, though, they offer definite possibilities.

>> Top

Private Blogs And Your Visitor Log

There are known limitations, to the effectiveness of making a blog private.

The problem of access latency, where a blog made private won't block everybody immediately, is one. Another is the possibility of co workers of a legitimately designated reader being able to read a private blog, on an office network that uses a caching proxy server. But there are other perceived problems with private blogs, that don't actually exist.

One perceived problem is seen when examining the visitor log for a private blog. Some one without access permission, loading a private blog, will load the "Private Blog" interstitial warning on top of the requested page. The visitor log will show the page in question being loaded. But look closer - do you see any other pages being loaded?

A log from StatCounter is perfect for this task. For any visitor to your blog, you can see a record of each link clicked during the visit. For an uninvited visitor to a private blog, you'll likely see one click - the "Entry Page" - and that's it. And even if the "Entry Page" is listed in the visitor log, chances are that all that was actually seen was the interstitial page.

So if you're examining the visitor log for your private blog, relax. Your private content is, most likely, safe.

Private Blogs And Designated Readers

Last year, in Private Blogs And Commenting Policy, I documented a private blog conundrum.

I had discovered the oddity that designated readers in a private blog are unable to publish comments, when commenting is authenticated as "Only members of this blog".

At the time, I merely suspected a design oversight on the part of Blogger engineers, in deciding that designated readers to a private blog were not afforded the courtesy of being allowed to comment.

The comment authentication choices (for the blog owner to select) appear to include

1. Require no additional authentication ("Anyone - includes Anonymous Users"), presumably because ability to access the comments wizard requires authenticated access to the blog.
2. Accept "OpenID" authentication ("Registered Users - includes OpenID").
3. Accept Blogger account ("Users with Google Accounts") for designated readers.
4. Accept author members only ("Only members of this blog").
5. Eliminate the "designated readers" distinction altogether, and make all members "authors".

In further retrospect, I see that this "oddity" allows blog owners an additional level of control - whether or not to have a blog that allows some people to only view the blog, and to not publish comments.

It would be possibly more obvious, if private blogs were to have an additional selection, in Settings - Comments, for "Who Can Comment?". This would, preferably, include a setting "Designated readers may post comments". This would save blog owners from the uncertainty, that allowing anything less than "Only members of this blog" to publish comments, may bring.

It's also possible that understanding of the choices which exist now may be sufficient. Your comments are welcome.

(Update 2015/06/24): Blogger has reduced the confusion, by eliminating non authenticated ("guest") access, to private blogs. All private blog access will require Blogger authentication.

Private And Team Blog Membership Invitations Are Subject To Abuse

When you invite a designated reader to your private blog, or invite a member to your private or team blog, you use the Settings - Permissions wizard to send an email to the prospective member or reader. You select the email address to send the invitation to, based upon the known address of your prospective member or reader.

The prospective member / reader, upon receiving the email, is free to send it on, to any other email address that he or she uses, and to accept the membership by using any Blogger account - current, or setup at the time of accepting the invitation.

This allows anonymity in membership, by permitting somebody to accept membership, period. You have no way of knowing, nor should you know, what account or what email address your new member uses to accept membership. The only thing that you know is that a membership invitation was accepted, by a given prospective member.

Unfortunately, just as you don't know what account the membership was accepted under, you have no way of knowing how many people other than your targeted member were sent a copy of your invitation. That's a possible reason for some blogs mysteriously exceeding the 100 member limit.

The bottom line here is, just as you must choose your blog administrators wisely, so should you choose your members and readers. Don't just send an invitation to somebody, without considering the possibilities.

Privacy Has Limitations

If you own a computer, and use it where there are other people - maybe in your home or office - you may setup your computer so certain files can only be read and / or updated by you.

Maybe you decide just you and one other person - or you and a select number of other people - should share access. That's your decision, and one of the features of Windows Networking and similar file sharing protocols is the ability to have and to maintain private files and folders.

Built in to Microsoft Windows, and other network operating systems (aka "NOS"), is the process of "authentication" and "authorisation" - that is, "Who are you?" and "Should you be doing this?". A major portion of any NOS does just that, constantly.

There is no similar feature in the Internet, using HTTP (or HTTPS).

As originally designed, all Internet content is published to be accessible to everybody, equally.

No browser or Internet server provides authentication and authorisation, to the same level of detail that is provided by an NOS. Any concept of "private" content, and / or Internet "security" is provided at different, and seldom equal, levels of detail.

These are details which are not understood by everybody.

I have a private blog. People who are not members of my blog are reading, and leaving comments.

or

Why do I see my private blog mentioned in search pages?

or

Why can't I make some portions of my blog public, and other portions private?

or

Why do I have people reading my blog, who I did not invite to read my blog?

And similar questions show that people don't understand how well NOSses do their job, and how well similar (but never equal) Internet functions will never do so.

On the Internet (in general), and in Blogger blogging (in particular)

• Blogs that are made private won't be so, immediately. Blogs that were public, for a while, have cached content which won't disappear, immediately.
• Blogger lets us have private blogs. Blogs made private by Blogger aren't as granular as protected content in an NOS.
  • A private blog may be accessed by people who you don't know, but who know people that you invite as members.
  • A private blog may be accessed by people who you don't know, but who work with people that you invite as members.
  • You can't have a blog with some public posts, and some private posts.
• A private blog may not be closed to search engine spiders. A blog that's closed to search engine spiders may not be private.
• If you have a problem with a Private blog, we can't view the blog, or use any online diagnostic utilities, to look for problems.

So enjoy your Private blog, if you like - but be aware of the limitations and problems, which will be your responsibility.

>> Top