Hacker News Reader

Comment by greenyoda | Hacker News Reader

The title of this article is deceptive clickbait.[1] The problem has nothing to do with the Edge browser, it has to do with search results returned by Bing, which happens to be Edge's default search engine. If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? So "stop using Edge to download Chrome" is not useful advice. Better advice would be to check the URL and certificate information before downloading anything from any site.

And the problem seems to have been fixed. When I search for chrome download on Bing, the top result is https://www.google.com/chrome.

[1] Successful clickbait, too. Writing an article with "download Chrome" in the title apparently got them the top spot in Bing's "News about Chrome Download", so anyone who searches for "chrome download" will see this article near the top of the search results page. Very clever.

View on HN

> And the problem seems to have been fixed. When I search for chrome download on Bing, the top result is https://www.google.com/chrome.

Which could be faked, as seen in the referenced tweet: https://twitter.com/GabrielLandau/status/1055300918101598208 Yes, they show the word "Ad", alongside the domain name "google.com" - except the user doesn't end up on "google.com".

Perhaps the ad was using one of the Google redirect tricks? There’s a few google.com endpoints (if I recall) that you can abuse to redirect to arbitrary URLs.

At first I suspected this as well, but apparently it was a link to itracking[.]services and Bing pre-resolved the redirect chain.

You can spoof any domain you want in Bing Ads without needing an open redirect.

> You can spoof any domain you want in Bing Ads without needing an open redirect.

Is that a bug or a feature? It seems like the kind of thing that could erode user trust

It's a feature, Google allows the same. Basically advertisers want to set the links to be tracking links and stuff which may be through third parties which then redirect to their site.

So both ad services allow the advertiser to display one URL while directing users to another.

Surely they're doing some verification to ensure that either the redirect lands on the advertised TLD, or alternatively that you're at least "in control" of the TLD you're advertising as (similar to GAnalytics verification -- via meta tag, DNS txt entry, etc)?

Google does.

Doesn't seem to work much better than whatever solution Bing uses, see https://news.ycombinator.com/item?id=18317051

Though that was 2017, and Google might've improved their protections since then.

Data point: For me, the first result for 'download Chrome' is a legitimate ad that directs to google.com

> If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"?

Simply visit Google.com, Gmail, Youtube or any other Google-site and await the Chrome-spam 100% guaranteed to appear in any browser not Chrome.

My favorite one: “Upgrade your browser”. Not misleading at all, eh? How about “no”?

This is a tangent/pile-on, but this is not the only dark pattern google engages in. I absolutely do not want YouTube Red. Any software that respects the user would let you dismiss the offer with an option for “do not ask me again.” And yet, because the software is not respecting the user, YouTube asks me ad nauseum if I want to upgrade to YouTube Red. No. I do not. But I don’t get an option for no. There is something like “yes” and “maybe later.” No google. My answer is no. Please respect me enough to let me make that choice.

Ad-supported software has ads. No liking the ads and refusing to pay for the product isn't a grand moral stand.

This isn’t the same thing. Some people are happy with viewing ads in general, but are not happy with aggressive pop-ups that tell them to upgrad. In essence these alerts are saying their choice is the wrong one, even though it’s a choice that YouTube itself gave them.

More specifically: "good" ads aren't modal and don't force you to click through to continue. If YouTube just mixed YouTube Red ads in with all their other ads, I doubt that anyone would be complaining. (Except for the people who want everything to be free without any ads.)

A good ad is a blocked ad.

Would you like to try YouTube Red for 30 days?

No thanks (again and again) :-)

YouTube red spam is obnoxious. Same with apps that ask for a review and the options are "not now, or not right now"

I'm never going to leave a review.

Funny, when an app is obnoxious about asking for a review, I always oblige.

My review will of course focus mostly on my most recent experience with the app, which was "getting annoyed with an obnoxious pop-up". I hope that this discourages app authors from doing that.

I should start doing that. I do occasionally fill out the stupid lengthy third party form sites use. It has a red logo, I forget the name of it. But in the free form comment section I explain how obnoxious it is. Also that company will hopefully go bankrupt asap.

Presumably they just dump your review.

Try buying a Nest camera and NOT buying their "Nest Aware" subscription. You'll be stuck with a massive bar on the bottom of your camera web views -- cannot be dismissed: https://imgur.com/a/iR5C9bH

Their support team responds to (numerous) requests from multiple users about it saying roughly "cannot be disabled without buying but we'll let engineering dept. know you want that". Yeah, right, like it's an engineering problem.

Worse yet -- if you have >1 Nest camera, and you DO pay for Nest Aware on some but not all of them, the banner still shows up on any camera views you aren't subscribing for.

It's really crappy because the bottom bar is a fixed height, so if you shrink the browser window it can easily take up >=50% of your viewport. Absolutely absurd -- only option once you have their hardware is to use a plugin/bookmarklet to kill the nag bar's CSS. =(

Tangential on top of the pile-on: when using a "not-logged into google services browser that is not Chrome" the Google captchas produced are at times never ending for me (i.e. I will never spot enough traffic lights and cars for them to let me past). Would be interested in whether others have had similar experiences?

I'm not a fan of the tactic either but MS does the same thing all the time.

Also FF, Chrome and Safari ARE upgrades to Edge/IE by any reasonable metric.

You've probably never had to write a non-trivial cross browser app. Try it and then let's see how you feel.

Yeah, picking on the upgrade wording is tricky, and cuts both ways. It has a common, semi-specific meaning with computers, but has also been used for far longer in the more general way it's used here.

If you say "I upgraded my stereo system", I would consider the chance you meant that to imply you got better versions of the same devices from the same manufacturer to be essentially nil.

I'm that respect, it may seem misleading if you do a lot of work with computer or have for many years, buts maybe it isn't much to a layperson?

If you said you upgraded your stereo, though, I’d expect you bought something pretty clearly nicer, eg by moving from a pair of PC speakers to a professional hifi. I wouldn’t expect that you’d have moved from one well-respected hifi manufacturer to another with different tradeoffs. Admittedly IE is pretty awful, but Chrome and FF are effectively comparable; “upgrade” is too strong a word for switching between them.

> I wouldn’t expect that you’d have moved from one well-respected hifi manufacturer to another with different tradeoffs.

I think you either have more respect for manufacturers and how they advertise, or have a higher estimation for people's ability to successfully wade through marketing bullshit than me.

Here's a question, is replacing your stereo cables with gold plated monster cables an "upgrade"? What do you think the average person thinks.

> Chrome and FF are effectively comparable

that depends quite a bit on the criteria used to judge them. If you value your privacy, I don't think the are comparable (as a synonym for similar) at all.

I don’t use Edge, but it’s unfair to characterize Edge as a “downgrade” for all people. The average user cares much more about being able to annotate webpages (for example) than having access to the latest web standard. So the “upgrade” you’re talking about is only from the point of view of the web developer, which is usually the wrong way to think about this kind of stuff. If you go far enough along the path of prioritizing the developer over the user, you end up with stuff like Electron, which penalizes users for not “upgrading” to Chrome and deciding they wanted a native app instead.

>The average user cares much more about being able to annotate webpages

You grossly overestimate what the average user wants to do. The average user doesn't even know the difference between browsers, rarely (if ever) uses bookmarks, and considers printing a web page an advanced task.

Annotating webpages is something that a tiny sliver of power users will use.

Are you from 1999? You sound like you're from 1999. It's 2018, and a significant chunk of users are younger than the browsers we use, and especially people still in the education system often use browsers - and computers in general - in fairly fancy ways.

Chrome isn’t an upgrade to edge anymore. Chrome is the new ie6. But I’m on FF now so I don’t care.

This is a "bing" issue, not an "edge" issue.

I hear your intended point, but the question was "how else..." which your answer didn't address. "Simply visit..." implies use of a browser, and for a new Win10 machine that browser will be Edge.

Sure. But searching bing is not needed.

Compared to edge, calling it an "upgrade" isn't really lying.

> The problem has nothing to do with the Edge browser, it has to do with search results returned by Bing, which happens to be Edge's default search engine.

I think you're slicing this too thinly. This has everything to do with Edge, which is purposely configured to use a search engine that creates a liability for users.

I would agree that "stop using Edge to download Chrome" is not useful and probably clickbait-y. A better guide would be "Be careful when downloading a different browser on Windows 10."

this same thing happened to my older co-worker who was using chrome and google to get firefox and he downloaded it from a top ad link that was a malware'd firefox...

Microsoft could just as well ship Firefox with Bing as the default search. The problem is Bing.

Why would Microsoft do this?

> Why would Microsoft do this?

Because Google Chrome is a greater threat to them than Firefox, so promoting Firefox helps them even if it hurts Edge, as long as it also hurts Chrome.

Also because if they preload Firefox with Bing as the default search engine then Firefox users may leave it that way.

I'm really not clear why they don't. Apart from driving traffic to bing, what advantage do they gain by developing edge? How does edge drive more traffic than a customized firefox?

The only thing plausible thing I can think of is hoping to execute another round of embrace extend extinguish on the web, putting other desktop operating systems at a disadvantage. With google chrome's dominance that seems unlikely to work.

Besides being a stepping-stone to the desire for full vertical control of the user experience Edge components are also integrated into other portions of Windows. This is similar to the situation with Internet Explorer.

If I recall correctly UWP uses Edge's rendering engine (EdgeHTML) and JavaScript engine (Chakra). Edge integration/embeddability is also available to Win32/WPF/WinForms applications past a certain Windows 10 version. It makes some sense for them to develop something they have full control over if they use its technology in other core components/libraries of their operating system.

They could, but it looks like an in-house browser is the biggest boondoggle that Microsoft has.

Except that Firefox blocked the site in question.

Does Edge not use the same safe browsing filters? I thought they were shared by all major browsers.

This might be a bit obtuse of me to say, but:

> This has everything to do with Edge, which is purposely configured to use a search engine that creates a liability for users.

You could say the exact same thing about Chrome and not be lying.

(The obtuseness being likening Google tracking to malware ads)

Ok, we've changed the title to the subtitle.

I suspect that as a general matter, headlines are attention-catching gimmicks and subtitles are more likely to proper titles for an article.

Yes, that's quite right.

I remember having great fun some years ago when my friend's Internet Explorer somehow broke in the Win95/98/ME days.

So I tried to guess ftp servers from the DOS prompt.

I think I managed to connect to ftp://ftp.opera.com and install Opera.

Update: looks like it still works today. Anyone looking for a 2004 BeOS version?

You could just get a free AOL cd at the gas station, it included Internet Explorer.

Maybe in USA.

There are actually two problems here:

1. Bing allowing malicious ads

2. Edge not marking malicious sites

Problem #1 has nothing to do with Edge (other than Edge using Bing by default) and I’m sure Google may let malicious ads through from time to time.

But problem #2 is entirely Edge.

> The malicious URL that Bing is happy to promote can’t fool Google or Firefox. When I simply type the above URL into my Firefox browser I’m faced with a bold red page declaring “Deceptive Site Ahead” completely with details and an option to go back.

The recommendation to stop using Edge to download Chrome is indeed wrong though.

Edge does mark malicious sites ("SmartScreen filter"), it just failed to have this in its index.

You're making it sound pretty difficut. Just tell them to type chrome.com into address bar. Redirects to Chrome download site on Firefox. Many lay people will actually try this on their own since they assume (term).com will often work. A dangerous assumption but wouldve worked here.

So, we just spread the word to use the actual URL when possible (been doing that) instead of search and that chrome.com works for Chrome.

I don't agree with you that the article is "deceptive clickbait". What is true though, whoever uses Bing for searches instead of Google gets served by subpar search results, hence the chances are great to get served malware. That is common knowledge today. Who uses Bing anyway, even on Edge? That's what the article gets wrong.

>If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"?

Use Edge to download Firefox, and Firefox to download Chrome ;)

Just use ninite

https://ninite.com/

How would I download this, without using Bing in Edge to download the installer for this?

Just go to the site directly? You don't need to search for it.

So why not just do that for Chrome directly?

Toward the end of the article, he asks the question, "Or is it?". That is an ongoing issue with Bing.

It does come with Internet Explorer too, but I'm sure that also defaults to Bing.

It's not irrelevant. Bing is what Microsoft chooses to use a default search engine. Edge does not warn of a malicious website. Chrome and Firefox do.

This has everything to do with Edge.

This is an ad I once saw on Google Search which worked the same way: https://plus.google.com/u/0/115181074626403443464/posts/fSPm...

As I noted back in 2017, Edge flagged the destination site as malicious, Chrome did not. Warning on malicious websites is, in fact, done in Edge. But as with Chrome and Firefox, it doesn't catch every one of them.

Is microsoft: dangerous together better? Microsoft's web infrastructure, including Bing and edge and advertising on their properties are not controlled by Microsoft? They could fix this. One could be pedantic and say the entire Microsoft web stack is dangerous together, if you interrupt the default flow with a different browser, different search engine or different os this wouldn't happen (cause edge is only on Windows and edge defaults to using dangerous Bing). I'm sure it sucks but the all Microsoft combination together exposes you to this.

Reply on news.ycombinator.com