He's a malware researcher at checkpoint and comes from the Israeli Institute of Technology And he's gonna to tell us something about key streaming reuse and how to avoid to spend nights and nights Trying to understand a crypto protocol, but what was it worth the time to use? I mean in terms of spending your night developing these other software for automatizing these instead of checking by yourself Let's see. Thank you. Please give him another round of applause Hi I'm Ben. I'm from the checkpoint malware vulnerability research group This was mentioned earlier, but I felt like mentioning it again What I do is I look at the applications of theoretical computer science to problems facing that we come across in the infosack field and In less whitewash terms what this means is that I am and a mature mathematician was infiltrated the industry somehow Don't tell anyone especially not the people working with me It's hard enough to keep this under covers as it is considering that when I handed my boss the first draft for this Presentation he took one look at it and he said you're really going to present this with all of those formulas They are going to lynch you So first of all, please don't lynch me second of all. I really tried my best to take away most of the formulas There's one formula somewhere in one of the slides So this talk as I said it is about Automatic detection of a curious vulnerabilities. I would like to dive right into that Unfortunately, first I'm going to have to explain what the curious vulnerability is and Unfortunately to explain what that means I'm going to have to explain how a stream cipher works So let's go over it as quickly as we can Okay This is how a stream cipher works Basically, there's this machinery called a pseudo random number generator and the pseudo random number generator Excepts a short key and outputs what what basically looks like noise to anyone who is not familiar with the key it looks like noise And what you can do is you can use it for encryption How you insert the symmetric key known to both parties trying to communicate say Alice and Bob and The pseudo random number generator outputs this key stream that looks like noise and you X or the plain text here it's the smiley image and You get the ciphertext which is a plain text X or the key stream and to the uninitiated Anyone who is not familiar with the key or you can see me It looks also like knows this is a property of the X operation you take a nice plain text that you X or it with What looks like noise? We also get something that looks like noise Next what can you do now? There's the ciphertext looks like noise But if you X or it again with the same key stream Which is what Bob on the other side of the communication will do get the plain text back back again Why because this is another property of the X operation if you X or something with the same element Whether it's noise or not noise twice you get the that element cancels itself out you X or with noise X or with noise again the noise cancels itself out and you get that plain text back again, so What's curious curious Astonishingly it is when you reuse the same key stream twice to encrypt two different plain texts and As you can see, let's take a certain key. This is the key and We X or the text with the first latex with a key and the second plain text again With the same key and we get two bunches of noise as we said earlier if you X or with noise You get something that looks like no as unless you know the key and advice is generated the key stream And now if Sans in the middle of the communication She's if dropping onto the on the communication and she gets this Noise and this other noise and it all looks like noise to her and of course she can't do anything And there is no such thing as a curious vulnerability. You can all get up from the seats and go home No, not really This is what happens if you encrypt two different plain texts with the same key It is possible for Eve who has access to both cipher texts to X or the two cipher texts And what did we say earlier about having the same element twice in an X operation here? The key appears twice You're the first plain text X or the key the second plain text X or the key and if you X or the two cipher texts Resulted the key cancelled itself out and you get this the first plain text X or the second plain text This is not something that you want to enable As you can I can see here. It's very easy for you to take a look at this thing and Have a very good idea of what the original plain texts were now This is due to the redundancy in the two original plain texts in Our context the context that we will be working with and mentioning in a moment. It's a bit more difficult than that It's not so obvious. It doesn't just jump out at you like that. In fact, there's all Effort and their algorithms dedicated to extracting the original plain text like that But this is an example so you can look at it and see how horrible this vulnerability is if if it exists It's not something very nice so What is it good for why do we we want to detect curious here's the first example This is a document for the Venom a project the Venom a project ran for 40 years from the 1940s to 1980s Initiated by the USA to Israel upon a Soviet communication. This was started before the NSA even existed and The Soviets they were reusing their key strings their one-time pads a one-time pad when used correctly it is an unbreakable cipher, but they were reusing their one-time pads and What happened is that the vulnerability that we saw earlier arose because of that and US intelligence was able to extract Information from those encrypted messages for the following 40 years It isn't the case that the Soviets continued sending vulnerable information for 40 years It was only for four years and then they wise up But for 40 years the Americans continued working on this project and starting more and more information And they got all sorts of useful intelligence including the names of and the identities of spy rings and such So this is one use for it if you can look at the traffic and say, huh, there's been curious here It's helpful. You can then start to attack the traffic and look for information This is another use now. I will be shamelessly promoting my colleague Nittai because he's awesome Nittai Earlier this year we researched a certain ransomware variant called dear crypt It's basically like a crypto locker wannabe. It infects your computer and it starts encrypting your files Unfortunately as Nittai dug deeper into the source code it found that their crypt commits curious It basically it uses the stream cipher RC for this is a good point to mention that everything I'm talking about right now applies only to stream ciphers and one time page which are like stream cipher and not block ciphers like a yes and that's and the like and And I found out that that's what happens there's a Every single file encrypted by dear crypt using RC for Uses the same key. It was a five-letter key black in all our case And this means that all the encrypted files could theoretically be recovered using Depending on redundancy in the plaintext. Anyway, it's not something that the malware offer planned on Now the funny thing is that we didn't even have to go that far because the malware author actually Included the key in every file. We don't really know why Probably it seemed like you would they did to him at the time and So unless the malware author had done this thing We could have recovered that plaintext or a large part of the plaintext anyway because this comes to use now If we had a way to look at the files and come to an epiphany, there's been curious here And it I would have had to sit down in front of the screen looking at either pro and the eyes are There's tears of blood in his eyes for nights and nights on end. We could have just looked At the files and say hey, there's a curious vulnerability here and proceeded from there and saved a lot of time and effort This is something similar. This is traffic from the ram knit malware ram knit malware came out around 2010 it still credentials and it was used to commit a financial fraud and Ram knit sends its traffic in a special home group protocol over port 443 it's not actually a cell but it's over port 443 and this protocol contains blocks and some of the box can be encrypted and Every single block is encrypted with the same key with the pseudo random number Generator restarted before every use so basically here you have curious on the block level every single block is encrypted using the same key so if we can look at this traffic and Understand somebody look at it and say, huh, there's been curious here again. That's useful because Coming into this traffic. We don't even know anything about it And now just if we could just from looking at traffic say curious has been committed here. That's interesting not we don't expect key reuse in a regular traffic and This is our last example Lest you think that only malware authors and shady characters commit curious Microsoft committed in in the 2003 version of office in their document encryption function Basically Every time you saved the file you modify the file and you saved it again It was encrypted again with the same key the key was bound to a file It was a single key every time and someone who monitored your directory over a long time could look at the files again and again And see as the basically different plain text different files are encrypted again and again with the same key stream and This enables a curious attack So it took time for people to catch on to this if we could only look at the files and come again to an epiphany Oh, wow, there's curious here. It could have been detected much earlier so how do we Manage to actually do this thing and I spent four slides explaining how wonderful it would be if we could just look at the hip of Bytes and understand there's been key reuse here. No, that's a nice, but how do we actually pull this off? well Do you remember has any one of you ever got stuck in one of those early 90s quest like someone the sorcerer and monkey island? When you are completely stuck and you have no more ideas of what to do. What do you do? That's right. You try everything on everything else until something works. So this is What we're going to do here. Basically if we take every bite from our original input and X or eat with every other bite We're going to get this space where again every bite is x or is every other bite So for example this Square will be the result of x or in the R with the R and it's going to be an albite because I think x or if itself is an albite and Every square every tile in this space is going to be basically the exos of their character from its column and the character from its Row, what is this good for I'm going to see in a moment First of all, this is what it looks like as you can see along the diagonal everything is now bites Right because it's an a character X or itself so What's our game plan based on the above? the if we take our input let's look at Typical input that we might want to operate on and find something interesting. Let's take this input Right, there's all sorts of noise in here somewhere in here are hidden to ciphertext Each encrypted each are they are both two different plain text and creeper with the same key This is the thing that we are out to find out and if we X or every bite with every other bite summer in here Right, this is the first bite of this ciphertext X or with the first bite of this ciphertext Why do we care because of the phenomenon that we saw earlier? if we X or the third the first bite of the two ciphertexts the key bite cancels itself out and the same applies if we X or the second bites of the two ciphertexts and Along this diagonal, right if we go up One unit and to the right one unit. We basically advanced to the next character in both Strings so along this white line you can basically you will be able to see the two ciphertexts with the Extra drift each other basically the two different ciphertext extra with the shower can be read along this Diagonal and why do we care again because we saw earlier what happens if you do that the key cancels itself out You could actually earlier see the smiley face and the sandcache message here. It's not going to be so obvious But it's still a step that helps us What we need to do why? because when you take We come into this whole thing assuming something about the plain text distribution that we are going to see plain text is Different from random characters, right? You expect letters you expect punctuation you expect at any rate The distribution is different as opposed to random characters that are distributed evenly The this is not the plain text distribution. This is the extra test distribution This is the distribution that you get if you pick a random plain text character from the plaintiff distribution and then a number Another random character from the plain text distribution and you extra the two of them You get another distribution and this distribution is again different from the random distribution so It looks to us differently, right? If we look at the bite that came from a two different plain text characters being extra It's going to appear different to us from just a random bite in the long run So what are we going to do? We're going to scan this space that I mentioned earlier. We're going to first of all construct it and we're going to scan it diagonally the diagonal fashion because the Demning evidence is like a crime scene and the damning evidence where all the bites are going to look suspicious Look like they came out of a different distribution or the random distribution They are going to appear along a diagonal such as this we of course We don't have all those colors and all this color guide when we come into this All we have is the input But we know that if we scan this diagonally and it just so happens that there's curious here somewhere we're going to come across this diagonal eventually and We're going to look basically each bite is like a little piece of evidence that May be pointing in the direction that there's been curious here And we are right now looking at the two ciphertexts that had been encrypted with the same key stream excellent with each other And we're going to work along the diagonals and each time we come across a bite We're going to pick it up and look at it and say This looks like evidence for our hypothesis or maybe against our hypothesis and if we walk along a diagonal and we found We find an overwhelming amount a sufficient amount of evidence that supports our our hypothesis that there's been curious here Then we raise the alarm and we say this is enough evidence. There's no way this was a coincidence there's been curious here and the vulnerable ciphertext to the curious Exploiting attack are in this offset and this offset and their length is so and so This is the formula I warned you about it earlier and The this this is the TLDR of the math involved basically I said look at the evidence look at the evidence I'm going to have to mention what I mean by that basically there's a A Quantifier rubric for deciding how much a bite a piece of evidence Influences our hypothesis and makes us think that makes us think that the hypothesis is more likely This is basically a computation involving the disparity between the probability that this might will arise from the XOR text distribution in blue that is earlier and The probability that it would it would arise randomly I'm not going to actually go into the formula, but anyway It's important and Regarding the question of how much evidence is enough. This is an important question. You can set the bar high We can set the bar low We for the sake of the proof of concept. We set the bar such that One false positive is what we're willing to live with of course you can send set it to lower chance it depends on the context where you're going to use this thing and The question is if we set the bar of evidence that high can we actually detect something? because It may well be the case that if we're just demanding When we come across the actual thing that we're looking for the two excellent ciphertext We're not going to be able to find them because there won't be enough evidence but as it turns out there's this formula it We found it using what's called the Chebyshev's inequality the long and short of it is basically that as long as the string the ciphertext That we're looking for is long enough. Everybody's going to give us some amount of evidence positive evidence that tells us that this may be the real thing and Basically if the string is long enough, we're going to have enough evidence The only question is it's a numbers game of what is the chance that we're going to fail? Anyway, even though the string was long enough in theory and we expected it to work. This is what Chevyshev's inequality is for it Bounce from above the probability that something unlikely will happen. So if the string is long enough and if you look at the formula you will be able to infer that The long enough is logarithmic in the length of the input which is good If we double the input we just need one more character in the ciphertext for our alarm to ring and Basically, this is what it is. We look at the formula and I Don't really expect anyone here to just you know look at it and Realize how the hell we came up with this thing But it's just a proof that we looked into it. This algorithm should work in theory now That's all there nice and good but We're going to have to actually Show how it works in practice because I don't think looking at the formula convinced anyone here very much Basically, we're going to look at sort of heat map You're going to see what the algorithm sees when it operates when the algorithm Iterates over the space that we constructed earlier is going to look at different bytes and each byte is going to look like more evidence or less evidence for the Hypothesis that we're looking at the case of Kiryu's and The areas the bytes that are That contribute more evidence are going to be in red and the bytes that contribute less evidence are going to be in blue and The algorithm looks for diagonals that are basically tricks. There are lots and lots of Evidence for our hypothesis and they're going to appear in red We're now going to look at the heat map of the evidence heat map of the ram knit communication that I mentioned earlier Well First of all, there's this ignore this. This is the main diagonal This is the diagonal where the input is exerb if itself it's all now bites So of course it looks suspicious to the algorithm. It doesn't look random at all, but if you look a bit further Can you see it? Here it is. This is the along diagonal Unique diagonal of where the algorithm is going to detect the Kiryu's because there is a streak of evidence here along this diagonal This is actually elliptic for anyone for some reason can't see laser pointers and this is This is the map for the second case. It's a bit more difficult I don't know if anyone can see it here, but again, you have the main diagonal and It's trivial, but this is the heat map of two files encrypted by the dear crypt mower that I talked about earlier and the two files were The two files were encrypted using the same key stream So we should be able to see the Kiryu's if we look at this it's going to appear as a red diagonal somewhere here and it's here, right The diagonal is over. It's the red angle of where every bite basically looks like it looks suspicious looks more less like it came out not of not out of a random distribution, but out of a distribution of plaintext bytes X or plaintext bytes right So I don't know if you notice, but basically we have succeeded in our plan we have managed to just take the input not knowing anything about it from beforehand and computed all sorts of Properties regarding the X source of the different bytes and the algorithm is able just like you are able to look at this diagonal and Automatically detect where the Kiryu's is so I can the algorithm Let's see if we have a time for the demo Hmm. I see the other demo isn't working for some reason I never mind the other demo wasn't as exciting as this one because it basically it showed you a script running The script that generates this basically the Romney's malware that with earlier it Sends this communication and the script iterates over this and eventually the script run X was to actually see the script running across this diagonal and Accumulating evidence it says I see this amount of positive evidence this amount of positive evidence and it grows and it grows Eventually it terminates because it runs across the end of the input And then it says aha, I found it. I found the Kiryu's and it outputs the two offsets So actually this is the more exciting thing There's no need to look at the demo to understand what's going on here But we have succeeded in our plan by Using the game plan that I have outlined earlier and I really hope that This thing will be useful. I plan on uploading it and as At the moment that I can actually get the code to a state where I can actually give it to someone to look at and then later Look them in the eye. This is going to be uploaded for the sake of anyone wants to take a look at it and This this is basically it I hope that you now Understand better what Kiryu's is and how we detect it's using this method Okay, and No, any questions at all. Okay in the heat map This one Test I was wondering about the totally not suspicious horizontal line at the bottom. Yeah, the horizontal lines. They are probably They are artifact. Basically. What's a horizontal line? This is a specific character from one of the From the plain text X or with the rest of the decipher text It's basically it doesn't have an application to what we're talking about earlier because specifically when you extra to a cipher text It's going to appear along the diagonal Probably it's one a specific bite of the cipher text when extra with itself produced some sort of anomaly Thankfully, it doesn't appear along the diagonal. So we're not going to suffer any false positives because of it Okay, thanks once the Segments where the the same stream stream size the cipher stream the key stream is used reused Once you identify these segments, which amount of manual Decryption do you need to recover the plain text? Actually, I saw and Is I published exactly on this there's automatic methods for Extracting the plain text in this case where you already have to cipher text that you know are vulnerable to the attack It doesn't work on a hundred percent of the cases But I saw this applied to the actual case of word 2000 and free encryption and it works pretty nicely It's like you don't have to use a manual work in order to the crib is there's automatic methods for doing that Yes So you need to know the bite distribution of the plain text. Yes. Yeah. Yes, that's right You need to and actually these e2 maps were generated with Guess we came in with a guess of what plain text more or less looks like You're going to have some uppercase letters and orcas letters and characters and such and Hopefully this our guess is going to be close enough to any case of actual plain text That is the alarm is going to raise regardless of the actual precise distribution There's one question from IRC. Yes. Thanks. The question from the internet are the docs somewhere available. You refer to Are the documents available somewhere The documents No, they're not but as I said I'm planning to work this out and upload this and I will put out the notices At the moment that this will be available to Honest to finish thanks for showing these vulnerabilities with stream servers in in general today, I think For anyone the recommendation is not to use stream ciphers at all So I think if anyone including my word designers Want to design their own crypto system, which is obviously a stupid idea Then they should better be used be using these a ad ciphers Authentic encrypt encryption Cyphers yeah, this is true then because not only because what you didn't mention was Just encrypting the data in the way you did alone is not sufficient. You also need the The key message died just along with it and which which these newer cyphers would actually bring it And that's the reason why in the new versions of our transport layer security that's being worked on You don't find any of these stream ciphers anymore because they're insecure Yeah, this is true actually the malware Malware's often used stream ciphers because they're easy to implement Rc4 for example is very popular because it's easy to implement and This is why you see it as you can understand Achieving actual security good security is not the first thing on their minds I don't know what Microsoft was thinking to themselves But the malware offer doing this basically they said to themselves, okay, I'm going to use encryption But apparently he didn't go much farther than that Yeah back to three hi, so just a quick question about here Just a quick question about the visualization part So are you doing like just bit for bit because this is like two colors, right? Or is it more colors? the call basically I looked at a random distribution of RGB values from red to blue and I computed its standard deviation and its mean which is of course in the middle and Then basically I looked at the distribution of evidence along this values of evidence of the P here and I use the matching function from the first mean from the evidence array to the mean of the colors and I computed calibrated grades right Off the value of the evidence values relative to the mean of the evidence and divided by the standard deviation To come up with this is like bite for bite for bite. Yes, this is bite for bite, right? You said that this this stream ciphers like RC4 are vulnerable to this problem, but what about when you use CTIS and CTR mode or in counter mode or something like this what's also Vulnerable to this problem. I think when you I'll just explain the class of ciphers vulnerable to this Problem is every cipher where you come up with a key stream of some sort Basically, there's a random key and you get the cipher text by x-ring the plaintext with this key stream any other kind of cipher as I said earlier block ciphers or anything like that is not Vulnerable to this kind of attack But what happens when you use in the counter mode and you reuse the nouns I Think I don't I don't understand. Can you please repeat the question? When you use the counter mode and we use the nouns from I Think that's wouldn't this result in the same problem. I think When you When you use AES and the counter no, no, okay No, because that you mean because there's x-ring somewhere within the operation of the cipher No, this is really really a specific artifact of the fact that you do a linear operation This ciphertext is a linear function of the plaintext and the random key the moment that your Encryption operation involves extra operation, but it isn't wholly linear There are stages of it that make sure that it is not linear then the result is not vulnerable to this kind of attack anymore Okay, thanks. Well, I guess we're done. So thank you Ben again


Jan owns an apple orchard and it's harvesting season. She has a bumper crop and needs to calculate how many apples she should pick in order to maximize her profits. For the purposes of this example, she will sell all of her apples to the local cider mill for 50 cents each. Jan knows that to maximize her profits, she should continue to harvest apples until she reaches the point that her marginal revenue equals the marginal cost. Jan calculates her marginal cost using the cost of ladder rentals and the wages of the apple pickers. The apples on the bottom third of the tree are the cheapest to harvest at a marginal cost of 30 cents per apple. This is because her workers can pluck apples off the bottom of the tree without a ladder. To harvest from the middle of the tree, employees will take more time to pick the apples, which increases the cost of labor. Also, a small ladder is needed. This increases the marginal cost to 45 cents. Harvesting from the top of the tree would increase her labor cost per hour and also requires renting a bigger ladder. This results in 55 cents marginal cost. Since Jan can only get 50 cents for an apple, she will stop picking apples when the marginal cost is greater than the marginal revenue she receives. Thus, she will harvest the apples at the bottom of the tree and she will make 20 cents per apple. She will also harvest those apples in the middle and make five cents per apple. However, she won't harvest the apples at the top because she would lose five cents on each one. With this example, the market economy would theoretically deem it most efficient to just leave the apples high up on the trees to rot. Some people believe that the government should provide subsidies to industries that would leave food and other essential goods to waste. Subsidies, however, cost other resources and create an unfair market. Should the apples at the top of the tree be left to rot? Or should someone step in and get involved? What do you think should be done?


Sure. And thank you for this opportunity because as I reflect upon it, I know most everybody has a hero's journey, if you will. And each person's hero's journey is unique. And for some, it can be incredibly easy. And for some of them, it can be incredibly hard. I will say mine is kind of in the middle. I don't believe I've experienced some real trauma. And I mean it typically usually in the sense of physical abuse type of trauma. I really want to emphasize the empathy there in relationship to mine. Since you brought it up, so much like I'm in the tail end baby boomer right before Gen X.  And so I was following that programming. That's literally the script that I was raised with. And so I got a job in the insurance industry of all things. I was in insurance sales. And through that experience, I met a woman who happened to be in the town I lived in and we had some mutual friends and that sort of thing. And we got married, bought a house and started a family. And two things were happening during that period of time. I wasn't a very conscious husband. And I was rather hyper focused on financial success. And during this period of time, because I wasn't a good husband, my now ex-wife asked to end the marriage. And literally within the same month, the company I worked for, and I had worked my way up to a high end corporate paying job. We were talking very high end corporate pay. The company laid me off. And so I'm right in the middle of going through divorce. I get laid off in my professional capacity and right at around the same time, close to that same time, was the market crash in the late 2000s. 2008. So I was literally, I'm going through a divorce. My professional identity literally was ripped out from underneath me. And my financial, whatever financial status I had at that point was wiped out, mostly wiped out. And I was at the, I was in the pit of despair.  And I had two small children at this time. And during this period of time, I found myself doing a lot of drugs to self-medicate. I was drinking. I wasn't working. I actually had to, I found myself moving back in, by the way, really quickly, Eric, at one point during my, this experience, I had a home worth $2.2 million in an affluent area in Los Angeles to having to move in with my mother and father in a retirement community of all places.  I mean, my identity was crushed. And, and I'm doing drugs and alcohol to get through the day. Interestingly enough, at the same time, my other drug of choice was online dating. Interesting. And what I mean to say is, it was, well, when I say drug of choice, it was an addiction. But what it was, was therapy to some degree. I was communicating with women all across the country. I mean, that's the interesting thing about that. By the way, folks, this was before dating apps, you know, like the bumble and swiping.  But I think our current dating environment is quite a bit different now than it was 15, 16 years ago. Definitely.  It was like therapy. But for me, it was an addiction as well, because I was addicted to that, that connection. But through those connections, I was also actually at the same time healing through the, the talk therapy, if you will. Now, in all fairness, I was a train wreck during this period of time. And what was shocking is women were actually very accommodating to a man who was a train wreck. Yeah. Women have this beautiful capacity to be nurturers. Yes. And so, and by the way, I'm not actually in many cases, I wasn't physically dating these women. It was just talking. At the same time, what was interesting that happened was a lot of women would reach out to me and say, hey, Jonathan, would you look at my dating profile and help me make it a better, you know, like, how can you help me improve it? And all of a sudden I would start giving some advice on dating profiles. And then a few weeks would go by and I'd get a phone call saying, hey, I met a really great guy. Can you give me some advice about the guy? And Eric, I was doing this every single night for years. Unbeknownst to me, it was preparing me for my current profession, which is now a dating relationship coach. And there's more to that story of how I actually became one. But that's kind of the base. So what was interesting was I go through this absolute dark night of the soul. I went to bed wishing I didn't wake up. I'm being, you know, I was drugs and alcohol to get through the day. But at the same time there was this reparenting happening through this talk therapy, if you will, that led me on the path to where I'm at today. That's awesome. It's always interesting to me how pain can transmute into purpose. I'm curious what you think about this philosophy. I have a very philosophical side of me. I like to contemplate on why are things the way they are and what lessons, you know, what beauty is there in that. I really can find these things quite beautiful. And one of the transcendent things about pain is that, first of all, my acronym for it is I call it, for myself, paying attention is necessary. That's what pain means to me, right? Paying attention is no. Yeah, that's a good one. Like it's not there for no reason, you know, it's a signal. Whether it's emotional pain, physical pain, all that. But the invitation in pain is to, it's a message that something is not being allowed or understood or loved, which is going to come back to the self. And here you are in this situation where you had this egoic attachment to this identity of being Mr. successful with my multi-million dollar home. I did the right things. I got the woman I did. I checked all the boxes. How come my life is falling apart? And if these things don't lead to happiness, then I don't know what happiness is, I guess, you know. And of course, I guess I'll just drink, you know. And how interesting that in that spare, you started to find purpose and just, you kind of let go and started like just listening to the self. I'd love to connect with women and you're connecting with them. And then it leads to this exposure of this like quality or trait you have where you have these, this aptitude for these, this capacity to have that empathy and valuable insight and maybe give words to it in a way that other people can't. And then, so now I want to know is like, what was that moment where you realized that these phone calls every day are like is actually, this is a career opportunity or like a, how did that purpose evolve into it actually becoming like a business for you? You know, that's an interesting question because, you know, on some level, you know, they say you find your purpose on the path you didn't expect to take. So, you know, I'm like, you were correct in saying, I thought that blueprint that was passed on to me by my parents was going to be happiness. And I own that there was a huge egoic part that was going on at that point in my life. I hadn't done any real true self-reflection, any real personal development, self-help, spiritual work at that point in my life. I was driven by the ego. And when the ego got humbled and I mean, dramatically humbled. Yeah. There's something about having a humbling event that changes everything. And so with to the respect that it led me on the path that I am now as a dating and relationship coach, it didn't happen overnight. It's kind of like, you know, you have to kind of look at, there's all these little, what did Steve Jobs say when you connect the dots going, you know, there's all these little dots. One in particular that stands out in this conversation is during my dating escapades, I dated an internet marketer, a very successful woman who is a multi-millionaire and I got to see her world for a little bit.  So it was like right at that time, I'm like, why not just put a website up? And I did. And the funny thing happened three weeks later, I get this phone call saying, would you like to be interviewed for a radio talk show? I'm sorry. Yeah, my website was dating coach kind of thing. Yeah. And I'm like, first, how did they find me? Because back then it was so different. The SEO was different, you know, like it was so green back in 2008, 2009 period of time. And I'm like, I just got asked to do a radio show.  I mean, I had really no real expertise at this point. I know I was literally most of it every all my advice those early years was just intuitive perspective based on some my own anecdotal experiences. But for the most part, it was just intuitive. But one radio show led to another to another. And then I got invited to a, I got invited to a group of relationship coaches.  I had a Facebook page that was starting to get popular. And this was right at the, you know, beginning of Facebook. And I got invited to a relationship coaches dinner, which was like 25 of the top relationship coaches in LA. And I'm like, I got invited and I mean, like, I am, I mean, I was making barely any, I wasn't making any money at doing this yet. Barely was making, I was making a few dollars. But then I got connected with all these people. And then they invited me to be on their summits. And then I got invited to be on this person's summit. And all of a sudden, little by little, my business began formulating. But I realized I had no expertise per se. So I began studying every book behind me. If you can see, you know, it's just a, just a small sampling of the relationship books. I began reading and studying and watching YouTube videos and going to workshops and seminars and trainings. I mean, in the last 15 years I've gone, I've had over 3000 hours of personal development workshops, trainings that I've gone to. And participated in. And I didn't, to some degree, I was honing my craft through this deep desire to learn more about, see, let me backtrack for a second. Very few people are ever taught what it's like to be in a relationship, how to be successful in a relationship, how to learn good communication skills. None of this stuff was taught, especially to my demographic. It's starting, or age group. It's starting to change for the much younger generation. I mean, even therapy was taboo for in my, when I was growing up and now it's becoming more mainstream. So it really didn't happen. The catalyst was just a number of different things to get to me where I was at in those earlier years. What do you think were some of the, in making that transition, you and I talked about the hero's journey theme. Joseph Campbell, hero with the thousand faces. You looked at all the, we see this theme show up in Star Wars and Lord of the Rings. It's a psychological process that can fill all these storylines.   And so like, what were some of your demons or monsters that you had to kind of slay within yourself to give yourself permission to rise from that in the direction that you did? Yeah, you know, this is a great question and I'm embarrassed to say it now. It's funny. Good. So my first year, well, my first year after my divorce, I told you, I'm addicted to dating. I actually had, and this is no lie, a hundred first dates in one year. I mean, literally twice a week. By the way, twice a week isn't that hard to do, believe it or not, especially back when the, but back when online dating was so green, it was rather easy. And by the way, I was 15 years younger, so I was a little more handsome then. And I will never forget, I went on a date with a woman, great, you know, really my first date, really nice woman, great first date, but something wasn't right. And then a couple of days later, another woman, great date, nice woman, something wasn't right. And then a couple of days later, another woman, great date, you know, nice woman, something wasn't right. And after these hundred dates, I actually looked in the mirror and said, wait a minute, I'm the common denominator here. Like so, at first I was blaming everyone else. And again, these were, you know, there was a deeper issue going on for me that I had to really explore. But at first I had to be, I had to recognize that I was the common denominator. And in that began actual seeking help to look at my own stuff. And right about that time, the movie The Secret came out. I mean, I'd already been into Tony Robbins and some other stuff. It's funny, I had bought Tony Robbins CDs 10 years earlier off of an infomercial back when that's how he got started, was infomercials before the internet. And then I finally cracked it open. Like 10 years later, started to listen, but it was more about how to improve your mindset for money. That was kind of the theme in many cases within the earlier stuff of Tony Robbins. Although there was relationship stuff too. It was the recognition that I was the common denominator and then I wanted to learn why I made the choices that I did in my life. And now I'm in like right about mid 40 at this point. So it wasn't until I began doing true introspective work and learning this thing called childhood wounds and adult traumas that affect everybody. We could have wounds as oftentimes people hear the world childhood wounds or traumas and they think of somebody that was physically abused in their childhood. I was bullied in school. It was not extensively, I was just casually bullied, but that has a traumatic effect on a small child. So sometimes the most benign thing can have major consequences as adults. And so when I learned of this, I recognized that there's something I have to do for myself to heal. So the dating coaching was really a catalyst for my own healing because as I'm trying to help others, I'm literally helping myself in the process.


It's a long drop! Fun! There's a jump tower in the bay. It's like I'm inside the ring. First blood. Round one. Beginning ring countdown. Champion eliminated.


There are many areas of modern historical study, and the conclusions thereof, which not only are incorrect, but carefully planned, highly funded, and precisely executed convolutions of our true history, theft of our true origins, and what lost civilizations were once capable of creating, systematically obliterating our heritage all around us, something the channel witnesses on a daily basis. There are many possible reasons for the motivation for such callous actions, yet all are ultimately found to have nefarious intentions, greed, power, control, and paradigm, with funded academics complicit in this destruction. There is now very little M.H. has not covered, investigated, or encountered regarding antiquarian subject matter. As such, is now utterly convinced the timeline for the history of humans is far larger, far greater, and far more spectacular than any religious, geological, archaeological, historical, or any other academically funded field or institute, who greatly profit from the propping up such continued misconceptions will ever willingly admit. It is up to all of us to remain thorns in the sides of institutional liars. The truth is out there, but one must be relentless in their pursuit of it.  Yet as mentioned, these strategic moves are not only isolated to our modern era, in reality they have always been a consequence of greedy, psychopathic, power-hungry individuals throughout the ages. Incredible, still unexplained sights, re-inhabited by our more recent ancestors, whose strategically began to claim them as their work, with modern academics using a similar strategy for their own beneficial motives. The past invaders motivated by the illusionary sense of power and intimidation, which would have struck fear or respect for their seemingly magical capabilities into the hearts of any surrounding group. This power play strategy, also used by modern academia, using the vast array of said individuals artifacts, excavated at each site to support their posit for structural origin. Thus, always regardless of the complete absence of any claimed culture leaving any diagrams, messages, or anything, not one shred of evidence showing these claimed culprits knew how to construct them, a vast portion of the general public simply go away, presuming those running the studies know all about who built these sites and how. Thus, those unfamiliar with the anomalies we cover, can easily make a forgivable oversight, as these charlatans openly declare they do indeed know who built them, resulting in a mass of misplaced faith from individuals unaware of the concealed features and the hidden agenda by the institutes who bribe others through the academic funding structure. Manipulating those with limited information of such sites, academics put tremendous effort into being perceived as intellectually superior to us all. This is solely for the purpose of financial gain, as if they are perceived as being more knowledgeable by default they possess a greater influence, as such, can uphold misconceptions and concealment of the controversial and the contradictory. We often stumble upon unexplainable anomalies, sites claimed as the work of civilizations that were simply incapable of such feats, polygonal masonry, enormous megalithic block walls, and rare but crucial polygonal floors. We have also recognized signature blockwork found in many different countries, with many ancient stone-builds ingeniously put together, weight-bearing architecture such as the lintel in the Treasury of Atreus, that due to its accurate and complex design is simply preposterous to attempt to claim as the work of a group of ancestors which we know predates our own modern understandings of such techniques.  It seems that due to the fact that academia not only wants to continue to appear accurate and all-knowing in their explanations as to who built said structures, but also due to the clearly funded structure and the orchestrated efforts to conceal our past is also to possibly conceal realizations that could arise within one's ponderings from the exposure of the complete picture of inexplicable technologically advanced ruins. Not only are many of these sites ignored, but many have experienced tremendous levels of vandalism and destruction. As mentioned, many of the most impressive ancient sites have had many of their most impressive engineering legacies stolen. Lots were adapted and claimed as another's creation. The Roman road, Roman columns, blinds, etc. The Great Pyramids claimed as the work of copper-wielding ancient Egyptians. Each of these supposed accomplishments by these supposed constructors are all absent any explanation as to how they constructed such wonders and those techniques found to have been used by these groups. The channel suspects were replicated, for if they were engineered by these groups, how did they consistently make such tremendous leaps in such tiny timeframes? It seems highly illogical and convenient that these occurrences of rapid technological development have all been found to have occurred within or near these still unexplained ruins. This clearly seems to have been due to the fact that just as we don't know how they were constructed, neither did our distant ancestors. They would have undoubtedly looked upon such accomplishments with awe and respect, a reaction they eventually crave from their enemies and allies alike. However, although these unexplained ruins claimed by these civilizations are absent any explanation as to their construction, they do still fortunately possess countless features missed by the thieves of our heritage, which not only support all I have claimed for over three years. A motive for this would be an attempt to support the mainstream paradigm of the builders of such, yet it is nothing more than deceit, with modern movies involving these theaters merely an attempt to warp one's impression of their true purpose and origins. For example, Delphi in Greece, a site we have covered in the past, is one of the only sites we are aware of which still contains a near-pristine picture of the building techniques once present at sites which contain ancient amphitheaters. Segesta is still another little known rarely shared temple ruin that, due to this continued propaganda regarding Roman responsibility, is merely overlooked or rather dismissed and brushed under the rug, nothing more than another one of their many ancient ruins. However, the channel perceives such sites in a different light. Not only does it contain an amphitheater, one suspiciously robbed out of its stage stonework, but Delphi is clearly of a very similar age, with Delphi still displaying a polygonal stage floor. But at Segesta, a group of individuals, perhaps from a certain institute which shall not be named, who have for over a century been repeatedly reported as actively seeking out, buying, stealing, and eventually concealing many controversial artifacts. Yet the deliberate destruction of features, such as the stone at these sites, is beyond the pale.  The temple, although predictably now missing its roof, still contains features that not only fly in the face of academic teaching, but reinforces our conclusions of the sites having a far greater antiquity than the Greeks. And regardless of the attempts to destroy its advanced anomalies, advanced features are also found in the foundation blocks, out of reach of this group of morally deficient vigilantes. Protuberances These enigmatic notches are a signature we have already identified previously as an enigmatic feature, a signature of a lost civilization, one which we call the polygonal civilization. Additionally, the incredible levels of pitting found upon the columns is clearly demonstrative of many eons of erosion. In a mainly temperate climate, this process of erosion would be considerably slower than that of a more abrasive or damp environment, making such erosion scars much slower to form, thus much older than what would witness in a location with far greater variation in seasonal conditions. Indicative of its unimaginable age is but another structure claimed to date from the Greek and Roman eras, yet when the condition of said temple is compared to other structures known for a fact to have dated from the same supposed era, it clearly exposes not only academia's conspiracy, but that they are indeed remnants left by a now lost, highly advanced civilization. They are, undoubtedly, highly compelling.


All right, welcome, everyone, to today's Webmaster Central Office Hours Hangouts. My name is John Mueller. I am a Webmaster Trends Analyst here at Google in Switzerland. And part of what we do are these Office Hours Hangouts. Looks like a bunch of questions were submitted already, but if any of you want to get started with the first question, you're welcome to jump on in. OK, I'll start with her. OK, my name is Koji Kawano. I'm an in-house CEO. And we've been hit by manual actions back in September. We've been trying to solve this. This is a user-generated spam, manual actions.  There's thousands out there. So we had no indexed them. We have not been blocking that path in the robots.txt file. But no indexing didn't really work. So we are now returning 4.10 instead. And that didn't work. By meaning, I submitted a reconsideration request, but that didn't work. So now we are trying to, we've created an XML sitemap with some of about 3,000 URLs and have tried to get Google to crawl them and recognize that 4.10. So I don't know that we are in the correct path or how long this is going to take. OK, do you want to drop the URL of your site maybe in the chat? I can take a quick look to see what might be happening there. So without knowing which URL it is, my immediate guess would be that these URLs are still indexed at the moment. And the manual action is just in place to prevent those URLs from showing up. But this shouldn't affect the rest of the site. So let me just try to copy and paste those and work here. Let me just double check really quickly. OK, thank you very much. And we can kind of see. I don't see any manual action there at the moment. Let me see if I have the right URL. Yeah, I don't see it. Oh, wait, it's .org. OK. Yeah. That makes a difference. Yeah. What I mostly see there is a bunch of URLs that are essentially removed for spam reasons. But these are very specific URLs. So those are probably what you're seeing in Search Console or a sample of those that you're seeing. And essentially what that just means is those specific URLs are removed and everything else is just ranking as normal. So from our point of view, it's not that you need to take care of this. We're kind of taking care of it for you in the search results already. It wouldn't negatively affect your site to do something, to kind of have those removed a little bit faster. But it's not something you would urgently need to do. So the manual action that you see there, you could essentially just leave that there. OK. All right. Then why is the message staying there, though? Because from a spam point of view, we're still removing those URLs. And we're removing them for web spam reasons, essentially. Just because they could be index as well. So it's something where if you were to remove them with maybe the URL removal tool, it would be the same thing as if the web spam team removed them. We're flagging them as spam because that's kind of what they were there. People taking advantage of the search results pages on your site, that's kind of obnoxious. We're kind of used to that. And we try to kind of surgically remove those specific pages from the search results. And if we can do that, then we don't need to affect the rest of the site. OK. Do you recommend that XML site not to be left up? It's being out there for about a week now. I don't think you need that. I would just work to prevent new pages like that from being indexed. And if you're currently returning 4.10 or if you have a no index on those pages, then those will drop out of the index over time. The manual action that you have there is something that will also expire over time. But usually, that's something that expires over a longer period of time. So it's not something that the web spam team won't say, kind of like it'll drop out next week. But again, it's not something that you'd need to take care of because the web spam team is already kind of cutting those specific URLs out. And the rest of your site wouldn't be affected by that. OK, good to know. Thank you. All right. Then there's a JavaScript question that has a JavaScript dropdown that leads to product paging. Should I submit the URL? But it seems that Google can't crawl the dropdown. Yeah, regarding that question, it's wondering the hydra. Yeah, the website is using JavaScript. I'm not sure which tool I should verify it, but it's near a third party tool or I should use inspection tool within the news search console to see if the crawl will see those packing with those within the dropdown. And the dropdown is in desktop. But in terms of the mobile, there's another dropdown. So I'm not sure whether Google can identify those desktop mobile. Yeah. OK. So at the moment, the site isn't being mobile-first indexed. So we'll use the desktop version for crawling and indexing. I could imagine, depending on what all is on the site in the mobile version, it might be that we would switch that to mobile-first indexing. And then that would be something that might make it harder to crawl the rest of the website. But for evaluating when a website is ready for mobile-first indexing, we also take into account the links on the site, especially the internal links. So if, for example, those internal links are missing completely on the mobile version, where you just have a text field and you type the query rather than using a dropdown, then that's something where we probably wouldn't switch the site over to mobile-first indexing. But still, it seems like something that's probably worth double checking on your side to make sure that the dropdown also works on mobile. And then you should be able to see that in the mobile friendly test, where if you look at the rendered HTML, it should have the dropdown and the links there, too. So my guess is at the moment, it's not critical. But it's definitely something I wouldn't put off for too long. OK, yeah, but the mobile version of the dropdown is this can be functional, but just the layout that it works, interaction is kind of different. Yeah, that's fine. If it's functional, and if we can still find the internal links on the mobile version, then that's kind of what we're looking for. All right, great. We're looking into that, thanks. All right, bunch of questions in the chat today. So let me just run through those quickly. A question about structured data. In order for rich snippets to start displaying reviews instead of votes, we switched over to review count instead of rating count. But this is causing a warning to display for aggregate rating when the field is empty, when there are no reviews. How can we solve this? So that's kind of normal. If you don't have any reviews on there, then I wouldn't mark it up as such. So my recommendation would be to just leave out those that kind of structured data if you don't have content that you can fill out there. In general, if there's a warning, then that just means for those pages, we wouldn't show any rich results for that. So that's also not particularly critical. Like, we're already filtering those out, but we're letting you know that your markup is kind of weird here in that you're telling us there are reviews, but at the same time, you're also saying, actually, there are no reviews here that we can show, which is why we're flagging that as a warning. So in general, I think it's fine to switch over to that markup, but make sure that you're filling it out properly or just leaving it out when you don't have anything to fill out there. A question about Google's search engine misinterpreting what are companies selling. Could you elaborate on that? He answered it. He said to leave it out. It doesn't make any sense. Hello. OK. Hello. Go for it. Yeah, I wrote a longer explanation and submitted it via the site. But basically, we make the ingredients for biological disease research. And we've noticed that after August core update, we've lost a lot of traffic in the organic space. Couple that with what we see in AdWords, which we get a lot of ad disapprovals, thinking that we're selling pharmaceuticals. And so what we're looking for, we don't sell any pharmaceuticals, like zero. Both what we do is we sell things that go into a laboratory used by researchers to understand the interactions with particular substances with cells and genes and all that. And what we've ended up doing is we've seen in the AdWords space that they're only doing a simple string search. So if they find a word that they think is a medicine, they then disapprove the ad. But we found it in titles of publications and captions about what the testing was done, all of these kind of factors. And so that makes us wonder if there is a better way to at least start providing signals to the search engine that we're not in the medicine business. That's an interesting question. I don't know offhand what we need to do there or what we need to pick up on. What might be useful there is I think you posted in the Hangout as well. Did you include a link to your site somewhere so that we can? Well, I can put a link to our site really quickly. OK. Because I probably need to pass that on to the team to see if there's something specific that we need to do there to see if we're picking things up properly. One thing to keep in mind is that the whole ad side is generally completely separate from the search side. So the ranking within the ad side, the approvals within the ad side, they wouldn't reflect anything with how we would pick up a site for search. So if from the ad side you're seeing disapprovals or getting flagged for other things, that's kind of the ad side, maybe getting confused. But it doesn't mean that the search side would see that similar. Well, the problem is that I don't have any confidence that the search engine itself, which is used by both systems, what I've done is I've done research to find where the drug term was. And it is pretty obvious that they're picking off the drug term without understanding the context. So the context might be. The drug term used to by the drug term might be an explanation of a test result. We use this particular drug substance in the test and what it looks like in the image. It's not what we're selling. It's the word. So what I'm worried about is the context is being missed completely by the search. I could imagine that's tricky, but I'd really need to pass that on to their team here and see what they think. If we're picking that up properly or if it's something where maybe there is some additional information that you could be providing on your side that I can pass back to you, that would make it easier for us to pick this up properly. Well, one of the things we've been thinking about doing is using schema information to pass on and say, here's our. We sell to researchers. We don't sell to consumers. We sell to organizations that do disease research. Those kinds of things in the schema in the definition. I mean, would that help the search engine figure this out? Those are the kinds of tips we're looking for. Yeah, I think that would probably help to have some more structured data around what specifically you're providing there. It might also be a matter of double checking the queries that where you're seeing these issues and thinking about, is this really something where a researcher would be looking for this term? Or is this something where a mainstream user would be looking for this term and expecting, perhaps, something different? But I realize it's just. There is crossover. Yeah. I think it's a really tricky topic. So I really need to figure out with the team to see what we could be doing there differently if our algorithms are picking this up in some kind of a weird way that we could be handling better. Well, I'll give you our standing offer to Google, which is we have a PhD in biochemistry from Cambridge, a PhD in microbiology from Wisconsin, and a PhD in molecular biology from University of Washington and USC. We'd be more than happy to help teach the engine how to recognize biological reagents and targets. OK, that's cool. OK, I'll pass all that on. Thank you. All right, let me grab some that were submitted as well so that we don't exclude those completely. The first one I have on my list is sitemap URLs say discovered, but not indexed. There's no explanation why these pages were excluded. I think we covered this in one of the previous Hangouts. And Barry wrote a large article about this. Essentially, for a lot of URLs, we just don't index everything. So that's kind of normal. In the past, it was just that in the sitemaps information in Search Console, we would show you submitted so many URLs, and we index some smaller number of those URLs. And that's completely normal. We generally don't index everything that we find. So for the most part, that could be completely normal and not something that you really need to worry about. Essentially, we're trying to recognize the relevant URLs on your website, the ones that we would show in the search results, and try to crawl and index those. How do you know whether a site has been penalized by Google? We haven't had any formal notification that a site has been penalized, but I've been working for a site for a while with no return. Is there something that we're missing? So in general, if there is a manual action taken on Google's side, then that would be visible in Search Console, in the manual action section in Search Console. That is, by the way, moving to the new Search Console as well, I think, tomorrow. So that'll be slightly different in Search Console, but that should definitely be there. If there is no manual action, then essentially what you're seeing is the normal algorithmic ranking that we have for all websites. And that can be the case that we don't rank all sites highly. That's kind of normal, so not necessarily something where something is completely wrong. The question is formulated in a way that's kind of hard to understand the details, though. When you say it's like with no return, it could be anything from its index, but just not ranking. Or maybe it's not index at all. Maybe there's a technical issue behind this instead of a ranking or kind of a manual action issue there. What I would recommend doing there is going to the Webmaster Help Forum and including your URL, the queries that you're trying to target, and seeing what the experts say about this case. If there's something technical that's involved where they can pinpoint, like maybe you have this setting on your server set up wrong, or maybe Google is confused by this configuration that you're using, that's something they can flag fairly quickly and help you to resolve that. If there's something more from a quality side, then oftentimes they can give you some tips as well with regards to the direction that you could be heading. The URL inspection tool will show me a page that can't be indexed because it has a meta robots tag set to no index. However, there's no tag in place, so I don't understand why. I took a quick look at this particular URL. And from what I can tell in our systems, we last crawled or processed this URL a couple months ago. So it might be that there's no meta robots tag on there now, but maybe there was one in the past. And in general, this is something that does take a bit of time to be reprocessed. So a couple of months is kind of normal for a URL that might not be your home page or your primary page unassigned. So what will probably happen there is we'll recrawl and reprocess this at some point. And we'll see that there is no meta robots tag anymore, and we'll index it normally. You can also encourage us to do this a little bit faster by using the URL inspection tool and using the live test. And from there, I believe, submitting it to indexing. So that's something that helps us to understand, oh, this URL changed. And we should make sure that we have the most recent version so that we can reflect that in the search results. So that's kind of the direction I would head there. Can you include a link to the article from Barry about URL is not being indexed? I am sure someone will drop that link into the comments of the post. I was noticing my site was moved to Mobile First Indexing in August. In September, there were major drops in organic traffic. The contents are the same on both devices. What could be the possible reason? So in general, moving to Mobile First Indexing is something that happens very quickly. And if there were any issues associated with the site in the mobile version, then on the one hand, we would try to avoid moving it to Mobile First Indexing. And on the other hand, you would see those changes pretty much immediately as soon as we have it in the Mobile First Index version. So if you're seeing changes in September or sometime later, then those would be normal organic ranking changes as they always have. And I have seen on Twitter that I think in September or end of August, there were some ranking changes that people were seeing. So I could imagine that these are just kind of the normal core ranking algorithm changes that we always have. And it wouldn't be related to the Mobile First Indexing. Regarding rel previous and rel next indicated in the meta tag, in this case, if paginated pages are not linked on its parent page, does it impact the crawling and indexing of the paginated pages? Yes, if we can't understand which pages belong together with rel next and rel previous, but if there are no links on the page at all, then it's really hard for us to crawl from page to page. So using the rel next and rel previous link elements in the head of a page is a great idea to tell us how these pages are connected. But you really need to have on-page normal HTML links that go between one page to the next page and maybe to a view all page or something like that. So that's really still recommended. I noticed the structured data. I think we talked about that briefly. I think you had a question about some of the details that we talked about there, though. Do you want to ask more about that, the reviews and ratings? Sure, can you hear me? Yes. Hi, so I run an SEO company. And so we actually create structured data for clients who have e-commerce websites. And so when we create the structured data, we are moving over from votes to reviews. So instead of using the I think it's rating count, we're now doing review count. And now this has resulted in an error with the structured data where it says, I believe the aggregate rating field is recommended. Please provide a value if available. So basically, if the client doesn't have any reviews, then there is a warning. And we're trying to figure out how to get rid of the warnings because if we don't put any aggregate rating, that'll result in an error as well. It'll say that the aggregate rating is necessary. I would say if there are no reviews there, then I just wouldn't use the review markup for those specific cases. So if there's no reviews, don't use the review schema markup for that product page? Yeah. And that's one moment. Okay, so I was just talking to my husband. Okay, so just leave it out for that product page. Okay, I'll see if that is possible. Yeah, I mean, if it's a warning, then it wouldn't be critical. It's not that we would ignore the rest of the structured data on the site. It's just saying like, hey, you're supplying the review markup here, but you don't have all of the details that we would actually show it. So at that point, you might as well just remove the markup if you don't have any of the content that you'd provide in the markup. Okay, all right, thank you. Sure. All right. How to implement custom headers in Azure Blob? I have no idea. Maybe there's someone watching this who knows more who can leave a comment about this, but I have no idea how this is set up in Azure and how you would provide that for HTML pages. So it specifically asks about adding a canonical URL for PDF. So that would be a link element in the header of the HTTP response. But I have no idea how you would set that up, specifically on that configuration. New page, an old, completely irrelevant theme website creating a subdomain, creating a new domain, which one is easy to rank. Does Google, in this case, use a site-level ranking factor? So I think it's asking if you create a new page on an existing website, should you put it on a new domain or on a subdomain? I don't know. For the most part, I would not worry too much about the SEO side of things in that regard. If you really need to host it separately and put it on a separate domain, then sometimes that's more of a technical question or more of a policy question rather than SEO question. In general, if you set up a completely new website for content that you're providing, then that does mean that we have to first understand that this is a relevant website and figure out how to show it in the context of the rest of the web. But in general, my recommendation is usually if this is additional content that you're providing on an existing website, I would try to include that within your existing website. And instead of kind of separating things out into lots of small websites, really build a strong single website that has a concentrated value for your business. How does normal page get a benefit while that AMP version is ranking in the search results? Google treats them separately. So if you have a normal HTML page and you connect an AMP page to that, you have the link rel AMP HTML to the AMP page and the link rel canonical back to the normal web page, then essentially what happens there is we treat that as one set. So there is no specific ranking benefit for having this configuration. It just really means that if we were to show you an AMP page, we would know that for this specific web page, we have this AMP URL that we can show. And we can use the AMP cache and serve that really quickly, all of the normal AMP things that play into that. So it's not that there is any magical ranking advantage by going to an AMP page or setting up a specific AMP configuration, but rather there are multiple ways that you can use AMP. And one of them is to have a separate AMP URL from your traditional HTML page. And there's no specific ranking advantage to doing that. It's just a technical setup that you do. Does Google support nested sitemap index files? Where one index sitemap file references another one? No, we don't support that. I don't believe anyone has supported that. I believe that's also specifically called out in the sitemap spec as something that's not supported. So you generally need to set up separate sitemap files, separate sitemap index files, and submit them separately if you need to go a lot further. Clarification on pagination for an e-commerce site. What should the canonical of the AMP page in the series be from whatever research it should be self-canonical? Yes, that's correct. So essentially, the canonical should point to the version of the page that you want to have index. What should the meta-robots tag of the AMP page have, no index or index? That's a bit harder. That's essentially a question of what page do you want to have indexed in the search results? And how are the individual products on your site linked among each other? So that's something where some sites decide to say, we want to have the paginated pages indexed. And that can be perfectly fine. If you have good content on those pages and we can pick those pages up and show them in the search results separately, that's really useful to have. On the other hand, a lot of sites kind of just have, if you start scrolling down through the category pages on page 5, 6, 7, 8, you start to have kind of repetitive content compared across the different categories. You don't get a lot of really useful pages out of those paginated pages. And in those cases, it might make sense to say, I'll just no index everything after, say, page 2 or page 5 or whatever you decide. And that way, you can focus on more on the actual pages that you do want to have indexed. So there's no really hard rule there. It's really more a matter of making sure that the pages that you provide for indexing are pages that you want to have indexed and that you want your site to be found for. In my industry, we have annual enrollment periods. We have a top page that discusses annual enrollment period. I also publish new content every year, targeting the year and the query. And we've done that in 2018, 2019. Should I canonicalize these pages at some point? If so, what should be the top-level page or the most recent page? I imagine that's always kind of tricky, because on the one hand, you might want to have the older content index as well. So if people are explicitly also looking for what were the requirements back in 2004, and you have content from 2004, then that might be useful to have. On the other hand, if nobody is actively looking for this older content, then at some point might as well cut that off and say, OK, everything goes to my general page on this theme. Another idea here is to say that you have one page, which just is for the current version, and you move all of the older ones kind of to an archive version. So you have, in this case, an enrollment page for the current year, which is just on a generic URL, like whatever your website is, slash enrollment. And for the previous years, you kind of move that off to an archive version where you have enrollment slash 2017 slash 2016, the older versions. That's generally a pretty useful strategy, because that way you build up that generic enrollment page. Over the years, you'll collect more links to that page. People will see that page as being quite relevant, because it's regularly updated. It always has the current version on there. We'll still be able to find the older versions that people are specifically looking for that. But we'll always be able to pick up the current version fairly quickly. And you can use the same strategy anytime you have something that's regularly repeating. That could be an event, like if you have a conference. It could be if you have products that are regularly updated. You might have one page for, say, I don't know, iPhone. And you could have separate archive pages for iPhone 3, iPhone 4, iPhone 5, all of those older versions. So that way the generic product page would kind of grow in value over time. And the individual versions for the older ones, they would be around. If people explicitly looking for that, we can show that in search. But they wouldn't get in the way of the kind of the most recent version showing up fairly well in search. So that's a general strategy that you can use across different kinds of products, different kinds of websites, where you have kind of this periodic update of the content and always want to make sure that the current version is as visible as possible. Wanted to ask your opinion on what if we use Ajax for pagination of an e-commerce site, which would not have its own pagination URLs. And the website relies on View All and Sitemap, HTML, in order to help Google crawl and find all of the product pages. So it's hard to say how exactly you mean using Ajax for pagination. In general, what's important for us, especially for e-commerce sites, is that we can find the individual product pages and that we have some idea of their context within the website. So if all of these products are only linked from one shared Sitemap HTML page, then that doesn't really give us a lot of context about these individual products. And it can make it a little bit harder for us to actually crawl all of your content, especially if you start going from a couple hundred products to a million products. And suddenly your Sitemap HTML page is a million links to individual products, which really make it hard for us to figure out where do we stop looking for links on this page. Because all of these links are all on one single page, rather than set up in a way that you have kind of a clear category structure or even different categories and then kind of paginated pages, which would be kind of like subcategories almost. So if we can still understand the context of these pages and the links to the individual products, if you just use JavaScript for this, that could be perfectly fine. On the other hand, if you use JavaScript in a way for this that we can't actually crawl through and you require us to go through the Sitemap HTML page, then that sounds like something that would be suboptimal. And it might work for a small set of products, but it'll definitely be worse for a really large set of products. So depending on how far you want to go, how you're planning to expand, where you are now, that'd be something where I'd say, maybe it makes sense to get a clean setup rather than setting up this complicated JavaScript setup that doesn't really work in a scalable way for a lot of URLs. So JavaScript itself is not something that would block indexing, but depending on how you have this set up here, if you don't have separate URLs, for example, we can't really crawl that even if we could process the JavaScript on those pages. Let's see. We have a website that will be targeting many different countries, but at the moment, all of the content is in English. Is it fine to use hreflang to specify which is a specific URL for each country? Yes, you can do that. In practice, that seems a bit of a waste because probably what would be happening is we index all of these different versions for individual countries, and they'd all be competing with each other. So instead of having one really strong English page that would rank well globally, you start having all of these small English versions for individual countries, and they're all competing with each other for those English queries. So my recommendation there would be to try to figure out what you really want to target, where you need to have separate content, and to explicitly set up hreflang versions and pages just for those versions, not for everything that you can find. So it's generally not a good strategy to just say, oh, I have this list of 100 countries, and my content is valid in all of these countries. Therefore, I'll just make 100 versions of the same content because you just end up having content that's much more diluted, that has a lot harder in the search results to be shown. So that'd be something where you probably want to find a more strategic approach. Is it bad for Google if there's a microdata, RFD, and a JSON-LD on a product page that has the same information in the other section? So in general, that's not bad for us if we find different ways of structured data that have the same information. But usually, that means that you have to maintain separate versions of the same markup on your pages, which sometimes means that things get broken, and one version suddenly shows this markup, and the other version shows a slightly different markup. So my recommendation would be to stick to one version if at all possible. If you're transitioning between microdata to JSON-LD, then maybe you have a period in between where you have both of the versions on your pages. As long as you can make sure that these two versions have the same content, then that's generally OK. But in the long run, I'd really recommend making sure that you have one version of markup on your pages, especially for the structured data markup, and that that version is the correct version. If you have a directory site of local US businesses, should you select target users in the US in Search Console? Will that be a mistake on the off chance that you have a blog post that does well in Europe? I think you could do that. So what would probably happen there is, so essentially the setting there is for geo-targeting, which means that when we can recognize that a user is explicitly looking for content in that country and we see that your site has selected geo-targeting for that country, then we can show your site a little bit higher in the search results for those specific users. It wouldn't mean that it would be lower in other countries. It's just like more visible in the US because we see that you're saying your site is focusing on the US and we see that the user is explicitly looking for content in the US. If, on the other hand, your users are kind of just generically searching and they're not explicitly searching in a way that you could infer that they want to have a local version, then you wouldn't really see any change from selecting geo-targeting there. So if your content is generic and global and your users just happen to be in the US mostly, then that's not something where you need to use geo-targeting. On the other hand, if your users are all in one country and you can tell they're explicitly looking for local content, then geo-targeting is a good way to let us know that actually your content is really well suited for those users. Would it be fine to not reply or approve comments on a news post or how beneficial is it to allow comments on news posts? That's totally up to you. From a search point of view, what happens in general is we see this content as being a part of your page. And if this is content that you want to be found for, then have it visible. On the other hand, if it's content that you think is not useful for your site, it's not useful for users, it's not something you want to be associated with. For example, if it's just dummy link drops that people are dropping into your site's comments because they can have their script run and just drop these automatically, then that's something where it probably makes sense to block those or remove those kind of comments. So in general, if you want to be found for something, then have that content on your site. If you don't want to be found for the content that people are placing on your site, then make sure that it's not on your site. Ultimately, it's your website. You're kind of responsible for what is shown on your website. And we will rank your pages based on what you provide on your website. And if you provide us comments that are low quality, that are kind of problematic, then that's what we will use for indexing. So that's always kind of a trade-off there with regards to how much work you spin to focus on making sure that those comments are actually good with regards to approving or blocking comments and kind of maintaining all of that. And some sites just say, oh, I don't don't have time to deal with all of this. I'll just block comments completely. Ultimately, that's kind of a strategic decision on your side and not something that would kind of play into the search side directly. What will be the best way to solve search results from an Australian site coming into the American search results? Currently, we have international targeting set for the appropriate country, as well as working hreflang to both sites. Is there anything we can do? Each one of our dealers maintains their own website and targets their own approved territories. Not really sure how you mean that. I think, in general, what can be tricky is if you have separate dealer websites that are essentially run completely independently and therefore individual countries. And ideally, you'd want to have these kind of link together with hreflang to say, well, if someone is searching for this product in this country, that's the right one. And that one points to the other country versions. But that's sometimes hard to get individual websites to actually do. And sometimes these individual websites are set up in a way that you can't really map one-to-one on a URL basis between the different sites. And in cases like that, it's really hard to say that this content on this website that's not marked up with hreflang explicitly is equivalent to the content on another website. And we should be picking out which one to show in the search results. So that can be kind of tricky sometimes. A few things also worth saying, we generally crawl from the US. So if you're doing anything fancy with geotargeting on the website itself, like redirecting users to their local country version or showing a banner for local country versions, then Googlebot and crawling from the US might trigger that. For example, if you have an Australian site and it automatically redirects US users to the US version, then Googlebot would be redirected as well, which means we would have trouble indexing the Australian version. What was it? The other thing that I generally recommend doing there is if you can set that up to have a kind of a instead of redirecting users that are coming from the wrong country set it up so that there's a subtle banner on top that's pointing users to the right version. So if you can recognize that a US user is going to the Australian site, then have a banner on top saying, hey, there's a US version of this content. Click here to go there directly. That way, we can pick that up and follow that link as well. And users, when they accidentally get to the wrong version, which is always a possibility, they can still find their way to the right version. John, can I cut in with a quick question? Sure. I posted earlier in the chat, it's a screenshot related with Search Console data. Just thought to take an opinion on, so basically, average position is moving weekly down over the weekend. It's similar with traffic, which is really, I mean, not strange, but you don't see every day average position moving in a cycle like that. And it does overlap a lot with CTR, which is also strange. That CTR is also dropping a lot only over weekend, and so is the average position. Is it possible that only CTR is driving the average position to drop that much over the weekend, or what would be an explanation for that? My guess is that the queries change slightly. So I wouldn't expect to see a ranking drop over the weekend. I mean, I don't know for sure. But as far as I know, we don't have anything in our algorithms that are like, oh, this website is of this type. Therefore, on the weekend, we'll rank it completely differently. I don't think we would have anything like that. But what I do see a lot is that there are different user patterns in that people search in different ways, and some sites get a lot of traffic during the week. Some sites get a lot of traffic during the off hours and during the weekends. And those patterns can be quite visible, and they affect which queries usually people are using. And it might be that maybe on the weekends, people are searching for something where your site isn't ranking that well. Therefore, the average position is down. Whereas during the week, they're searching for something where your site is ranking well. Therefore, the average position is higher again. Is this true? But it's the same type of URLs and queries. Just the user intent is changing over the weekend. So they have a different behavior as far as browsing, like a user experience within the site. And again, CTR, it's really impacted over the weekend. But the query and the URLs are more or less the same. I would still suspect that it's more of what users are actually doing. I really don't think we would have any algorithms that would try to figure out, is this a weekday or a weekend site and treat them differently? But is it possible that CTR is driving that? So CTR, because CTR is lower, it's driving the web. I suspect it's more a matter of people just searching differently. Because if they're really searching in the same way, then the click-through rate would be kind of the same. So that's something where I suspect if you drill down and look at the types of queries that are happening, you'd also see the number of impressions going down. You might see some queries going up more on the weekend, others going down more on the weekend. So that's something where, at least from the sites that I've seen over time, that there is a very visible effect there with regards to weekday and weekend. And some are just more visible on the weekend. Some are just a lot less visible on the weekend. So CTI, although it's a ranking factor, it's not that powerful to really drive the query. I don't know if we would call a CTR a ranking factor. So I'd really just assume this is a completely normal ranking change. I mean, not ranking changes, but essentially based on what people are searching for. Yeah, usually in time this is different. Thanks a lot. All right. Wow, time flies. We just have a couple minutes left. So I'll open it up for more questions from your side. If there is anything specific. I don't. This is Sebastian from Argentina. Can you hear me? Yes. Ah, thanks. Well, talking about performance, what is the most important metric that you're taking into account from Google's perspective? I mean, is the first paint, is the page, it's what? Or is a mix of everything? The last, yeah, kind of a mix of everything. So we try to take into account various lab measurements, which we can kind of algorithmically determine. And we take into account various what we call the field data points that we have, which are also visible in page speed insights, to see what is happening in practice. So it's kind of a mix there. We don't point at any specific metric that we say, this is exactly what we use for ranking, partially, because we need to be able to adjust that over time. OK, thank you very much. All right. Let's see, maybe one more question if anyone has something. Well, if no one goes, I go again. OK. Is there any faster way to push content to Google than the Google News side map? I mean, we work specifically with digital newspapers. So our most critical aspect is to push everything to Google. But is there any way to push it faster than the Google News side map? Usually the News side map is the fastest way. So that's something that we can crawl fairly quickly, because there's a limited size. And we should be able to pick that up fairly quickly after you ping the side map URL. OK, that's good. Thanks. Cool. All right. So I need to jump out. So I can't stay a little bit longer, but I think on Friday we should have a little bit more time. If there's anything on your mind next Friday, I'll also be doing one in-person here in Zurich. So there are probably some people from Zurich and from the region coming to join in. I'm sure that will be fun as well. Apart from that, thank you all for joining and hope to see you all again in one of the future hangouts. Bye, everyone. Bye-bye. Bye-bye.


My personal experience, but something that you learn in a social way you learn more deeply because you can connect it to people a time and a place and Remembering that you really disagreed with somebody in the class about one instance Or maybe you felt really validated when five people responded to your did he really say that what kind of comment in the margin Makes that real to you in a way that kind of trying to get through your history reading You know when you're tired at night, and you don't know anyone in the class Maybe doesn't make it as memorable and as enriching