Comment by pdkl95 | Hacker News Reader

Comment by pdkl95 | Hacker News Reader

Lets say I ran a well-known business that sold a some sort of physical product.

It could be a toy, a common household tool or appliance, or anything else that is small and inexpensive. It more-or-less works as intended, but it also included a small robot. The packaging and marketing would be designed so you weren't supposed to notice the robot, but the packaging included the necessary fine print and an explanation that this robot was just there to make sure you got the best experience possible for anybody that spotted this "extra feature".

Unrelated to whatever it was that you bought, at night the robot would install a device on your phone that re-routed all your phone calls through my office (a MITM attack). The phone still works ok, except now calls to your favorite pizza deliver restaurant seem seem to be re-routed to the competitor across town. Some time later a neighbor complains that he can sometimes when he checks his voicemail, he gets your phone conversations instead.

After finishing with the phone, the robot does the same thing to your cable TV.

Some days, the robot would go through your (physical) mail and place stickers with new advertisements into your magazines. Occasionally one of those stickers would end up on your electric bill, obscuring important information. The power company has a similar logo to one of the sticker-ads, so the robot probably confused the two logos. Even if the robot didn't have any stickers to place, it would still open your mail and leave it (opened) on the ground near your mailbox for anybody to see.

If I rand a business that did this - possibly as my main (or only) product - how long would I be able to run this scam before someone threw me jail?

--

Intentionally breaking TLS with a MITM attack goes way beyond the usual scam/trojan. This isn't even the usual negligence that we see in the "security" of a lot of products. Creating a certificate that lets you MITM any domain is very obviously a willful act.

Why hasnt companies like Download.com and CNET been dragged to court yet beats me. People have had to pay hard cash just to have their systems purged many have lost priced documents and information while attempting resets because of this.

Is this some sort of favorable treat?

Or at a more simplistic level, why haven't Google, Firefox et al simply blocked download.com as serving malware? Even something that simple happening far more frequently, might mean sites carrying ads gained some ethics. Maybe some of the ad networks would then be held responsible for the crap they regularly carry.

...and sites whine at the unfairness of the growing number of adblocking users. Right.

This is something I have been curious about as well. It seems like Google at the very least should be blacklisting download.com or at least showing the message they show for "bad" sites: "Warning: Visiting this site may harm your computer!"

Then start reporting it:

https://www.google.com/safebrowsing/report_badware/

Thank you for the link. I just reported it. I hope many more people here will do the same. Who knows, maybe something will change.

I reported cnet several times. It still has a top spot in the Google search results and no warning whatsoever.

You really want Google to be the custodian of all things bad?

Besides, does Download.com, the site, actually give you malware? No. So why do you think Google should blacklist it?

"Custodian" is a strong word. Let's back up.

Download.com doesn't write the malware, it just serves it. Are they a custodian? The argument here is that download.com knowingly serves malware to make money.

By that same argument, if Google knowingly serves a link to download.com to make money, how is this different?

At the end of the day, online businesses serve things to customers just as venues serve performing acts and stores sell goods. There is some expectation of due diligence over what they provide.

We can argue about whether they should be legally compelled to not serve malware, or whether we should simply stop doing business with companies that serve malware, but it's reasonable to consider them responsible for the things they serve to make money.

I'm not sure if it is still the case, but being hosted on download.com used to have a cachet over other sources. Today, their about us page has this to say:

"All products in our library go through a rigorous testing process."

> At the end of the day, online businesses serve things to customers just as venues serve performing acts and stores sell goods. There is some expectation of due diligence over what they provide.

Devil's advocate: where does this line start and stop?

I'm not advocating for download.com. Stores aren't held responsible for bad products. Physical stores like Walmart and Target as well as digital entities like Amazon and Newegg have shelves full of products designed to break under minimal use, high markups for mediocre products, and products that have been cleverly advertise to look better than exected. This is not completely analogous to serving malware, but the onus is not on the store to vet the products before selling.

Why should download.com be held responsible for hosting crapware when we don't hold stores pushing goods liable for selling us gold-painted trash?

Devil's advocate: where does this line start and stop? Stores aren't held responsible for bad products

I don't know about the US, but in the UK and Europe they are. The contract is with the retailer, so you can sue them. There is an expectation that things we get are safe. They are frequently crap, but rarely damage your other things or injure you. If something breaks after minimal use it would not be of "merchantable quality" and you'd be entitled to a full refund from the retailer. Likewise claims and statements to the public and in advertising must be true. (IANAL)

Now, Download make a big deal of being a trusted source, and will not accept "Software that installs viruses, Trojan horses, malicious adware, spyware, or other malicious software at any point during or after installation". There's a very lengthy list of what they don't allow and how they are curating their offerings. They have, for quite some time, been failing in this. For pity's sake they even have dark patterns and show ads with prominent download buttons, which aren't.

As they want to be a trusted source, and have lengthy text telling us they won't accept malware and that they curate everything, I think they should fall foul of the browser's safe browsing filters.

http://www.donotlink.com/framed?614744 Their malware policies.

If, on the other hand they said plainly "we make only limited checks, downloader beware", fair enough. Just like a forum disclaiming views of posters.

TL;DR Yes, they should be held responsible for what they serve, or stop claiming to be so trustworthy and "We test all submitted software products according to comprehensive criteria.".

> Stores aren't held responsible for bad products

I certainly stop shopping at supermarkets that sell me tainted food.

> Devil's advocate: where does this line start and stop?

I would say that it stops as soon as the venue starts doing any reasonably in depth vetting -- or even more, actively curating -- what they're serving. In this case, Google already has a malware detection service that is hooked into their browser, and this malware detection service can reasonably be expected to catch sites like download.com that serve trojans.

Download.com actively choses what to provide for download, and actively makes sure it has malware.

> This is not completely analogous to serving malware, but the onus is not on the store to vet the products before selling.

Sure it is. If the store sells low priced crapware, then it's 100% the responsibility of the store. The difference here is that the crap that they sell is legal, non-intrusive, and can generally be returned for a refund.

> Why should download.com be held responsible for hosting crapware when we don't hold stores pushing goods liable for selling us gold-painted trash?

There is a vast amount of difference between download.com hosting a binary and Walmart hosting a product. In the latter, there is a due process whereby any defective goods could be returned to the manufacturer. More importantly, a manufacturer's guarantee/stamp is involved.

If the binaries are signed by the original developers' public key, then I can agree somewhat to your analogy. Otherwise, its download.com who is 100% responsible.

So, Google should blacklist most torrent sites as well, then?

See, I think Google's job (let's call it that for lack of something else as I'm typing) is indexing the web and showing me relevant links based on what I search for. And that's basically it. If I choose a wrong word and a naughty site pops up, hey, that's my bad. I don't think Google should filter that for me (unless it's an option that I can opt in). Similarly, if I search for software, i don't want Google giving me a curated list of vendors. Good, bad or otherwise.

The point is that they're not showing you what you wanted - if you search for Firefox, I'm pretty sure you don't want a malware-infested version. You want plain old regular malware-free Firefox.

So Google isn't showing you what you searched for.

If you search for torrents or illegal downloads well that's different, isn't it?

I _WANT_ every available option shown. They can sort by relevance, but I best darn well see Download.com on some page of the returned results. I _don't_ need Google censoring the internet.

> You really want Google to be the custodian of all things bad?

I expect them to manage their products (chrome, search) in an ethical way. If I'm using their search, then yes, I expect that they'll give these warnings. If I'm using Bing, then I expect MS to do the same.

If you install uBlock Origin at least, it will flag the entire site by default.

It is very easy to add new things to the list too (e.g. right-click an offensive pop-up and "block element").

I even told it to block my ISP's ridiculous typo-redirector.

Yep, but I would not dare suggest ublock origin to any of my non-techie friends or relatives as my unpaid support load would go up hugely. Adblock is far enough for them! I run it always, but one thing it is not, in any respect, is non-techie friendly.

I love that it tells me what triggered a block, and which filter it pulled it from, but Joe User would be baffled. Then clicking random buttons to make it go away (likely disable strict blocking, permanently), or phoning their ISP because the Net's broken...

The sort of person who installs uBlock Origin is also generally the kind of person that knows to avoid these websites. However, people like my mother don't know how to install uBlock, and don't know to avoid download.com (I mean, with a domain name like that, it has to be legit!).

This is what uBlock shows me when visiting a page on download.com [0]. It also changes the URL to "chrome-extension://cjpalhdlnbpafiamejdnhcphjbkeiagm/...". If my mother saw this, I'd get a phone call right away that some virus was stopping her from downloading something. It looks scary, and the most visible information is the most obtuse, while the most useful information is grayed out on the page.

If the most prominent text was something like "We've blocked this page, because it matches our list of 'Badware risks'." I'd feel better about installing uBlock for a casual user. As it is now, I only install Adblock Plus because it hides malicious ads and fake download buttons without also presenting scary things to the user.

[0] http://i.imgur.com/DUdRCSc.png

You're right, that's why you should install uBlock Origin for your grandmother

and everyone else's grandmother, i suppose

One grandmother at a time, we can cure malware

blekko penalized most of the downloading sites for that reason.

Well maybe if it was a new site with no backing, they would block. Unfortunately Download was part of CNET. CNET was purchased by CBS. This is CBS serving malware.

They know what they're doing. It's probably the only portion of the CNET properties that makes a good amount money in CBS's eyes.

Because they are owned by CBS. That way they can also encourage, supply, and track downloads of "illegal" music/video sharing apps :^) https://en.wikipedia.org/wiki/Download.com https://en.wikipedia.org/wiki/CNET

Because you have to prove damages from your data loss or web tampering. So, you got redirected to a different site. Maybe your credit card number got sold and bought a few dozen times until some time 2 years later, someone started charging it, so your bank cancelled it and reissued. There's a lot of maybes and tenuous connections.

Nobody would take that case.

There's a problem with our privacy protections in the law.

If you read the text on some of those dialogs it states pretty clearly what they're going to do to your computer when you click accept: ...collect your IP address, URLs of the pages you visit and other personal information including the content of encrypted web pages...

The problem is most users can't understand or don't even bother to read it (http://arstechnica.com/security/2008/09/study-confirms-users...)

Watching non-technical folks try to install software is like watching baby seals get clubbed. Even the supposedly trustworthy software vendors (Adobe Acrobat, Oracle Java) all install shitty toolbars and adware.

No doubt! Say what you want about how much the Apple App Store for OS X sucks, but it has never downloaded anything I didn't want, and I've never been hit with malware using it. Nor has my father-in-law who often gets malware from web pages he visits.

Its because a lot of windows users are just plain dumb. Not all of them of course, but barring a few users, most just don't care about adware as long as their work gets done. I know too many friends and relatives whose laptops were riddled with all kinds of adware that shipped by the courtesy of download.com, CNET and similar others. When I mention it, they just laugh about it, such is the divide between power-users and noobs of the windows world.

What is needed here is providing them education and information. I try my best to bring them to Ubuntu/LinuxMint after explaining some basics, but its only a small minority that gets converted. But the ones that do switch, never look back after that!

Barely anyone cares about online privacy. MS found that out with the failed Scroogled campaign which they scrapped after it tanked. People value free stuff more than privacy.

There are some interesting court cases going on though, with the analogs of your scenario but with student data.

https://www.washingtonpost.com/news/grade-point/wp/2016/02/0...

http://www.edweek.org/ew/articles/2014/03/13/26google.h33.ht...

https://www.eff.org/press/releases/google-deceptively-tracks...

>MS found that out with the failed Scroogled campaign which they scrapped after it tanked.

it tanked because it was a terrible campaign not because people don't care about online privacy. The fact that it was MS all of companies running it made it even more terrible.

Do you think that if Mozilla ran a similar campaign it would see more success? Somehow I don't think so.

Considering google was paying mozilla to be the default search engine in firefox, most tech savvy folks would of seen it just as silly.

actually that campaign was a full success - it made MS realize no one cares about privacy, this led to Win10 spying on _everything_

> this led to Win10 spying on _everything_

and no one is complaining about that /s

> Barely anyone cares about online privacy.

I suspect you are confusing not caring about privacy with a feeling of powerlessness mixed with a general ignorance of any alternatives (which might not exist in some situations). The meme that people want to give up privacy in some kind of barter for services is just projection and wishful thinking in most cases.

https://www.asc.upenn.edu/news-events/publications/tradeoff-...

> If I ran a business that did this - possibly as my main (or only) product - how long would I be able to run this scam before someone threw me jail?

If you put a reasonable amount of effort into legal defense, you could get away with it indefinitely. The US criminal justice system is non-functional in more ways than one.

Reply on news.ycombinator.com