Hacker News Reader

Comment by 0-_-0 | Hacker News Reader

This is due to people sharing malware:

https://www.techradar.com/news/mozilla-suspends-firefox-send...

The content can't be scanned server-side because uploaded files are encrypted

I mean... Were they really suprised by this? An encrypted file sharing service, of course it's going to be used for sharing malware and illegal content.. I'm not sure what would've been the solution for this issue, but it was pretty clear that that was gonna happen...

Exactly. Most definitely bad actors would use this free encrypted file-sharing service. But I suspect that this wasn't even sustainable for Mozilla to begin with.

The road to hell is paved with good intentions here.

Only allowing one time downloads seemed reasonable to stop 1 and 2 stage payloads. Doesn't help exfiltration, but theres so many options for that anyway. One time downloads may be annoying for non-web savvy people, but seemed like a reasonable tradeoff.

This seems like a feature, not a bug. People can send things privately to you. It's important, therefore, to verify who you're talking to. Maybe instead of blaming it on the lack of server-side malware scans (which are always easily defeated) they could blame it on lack of an appropriate way to build a framework of trust between endpoints?

You're assuming the good case of people sending naive users a virus. But think of two consenting parties sharing cp or something else. It's a legal hell hole.

Why would it be mozillas fault? If someone sends cp via snailmail, will the postal service get sued?

I wonder how mega.nz managed to withstand what killed send.

But it tarnishes their name. People who get malware through Firefox Send will associate Firefox or Mozilla with viruses because that's where it's being served from. It doesn't matter to them that it's fully the fault of the person sharing the malware, they expect that if a site is serving them content then that site can ensure that it's safe.

I wonder if renaming the domain from send.firefox.com to fileshare.com or something like that would have helped with that

untrustedusercontent.com

WeTransfer has been abused the exact same way for as long as they existed even though I don't think they have the e2e encryption. They are still operational.

That is, it's an issue with the file transfer services as a class that can be managed, but Mozilla decided against wasting time/resources on that and just nuked it instead.

How unpredictable! Where have they been since the Internet started being around?

Bant they just scan them on receiver side? Like how it scans dowloaded files

Terrible shame how lame people somehow always find a way to ruin everything good they find online for everyone else without a second thought about it. :(

So the problem is that people used a service for doing what it said it should be used for? Private file sharing.

A person abusing the privacy features of a file sharing platform to send unwanted files that damage people's computers is in fact, a bad thing

That is not an argument against privacy but it does make it harder to provider private services

How do related products, like Mega, deal with this?

Require accounts, tracking, no throwaway emails, heavily logged, no anon uploads, fingerprinting clients on register to prevent multiple-account freeloading, making money off plans to have full time abuse team

Reply on news.ycombinator.com