I think another take away from this article is “don’t allow users to upload malicious files that you then host from your domain”
This seems easier to do than jumping domains.
This seems easier to do than jumping domains.
I disagree, at which point did we all accept Google's role as defacto regulator and arbiter of the Internet? Why should we tacitly accept the constraints they deem as appropriate and modify the way we build the web?
In other words, those are our domains, our apps, our systems and we'll do as we please; that includes worrying about content moderation, or not.
When and why did we accept google as the Internet's babysitter?
Apologies if this sounds aggressive, but your takeaway reflects an appalling and quite fatalistic mindset; one which I sadly believe is increasingly common: big corporations knows best, big corporations say and we do, big corporations lead the way.
On the other hand, probably I'm just biased and tired considering how tiresome it's been to explain to my friends and family why Signal is the better alternative after the WhatsApp/Facebook fiasco.
/EndRant
For all you "use Firefox [etc], don't use Chrome" pundits: it also uses Google Safe Browsing [0], and for that matter so does Safari, which may compound it by using Tencent version instead if you happen to be in China [1]
[0] https://wiki.mozilla.org/Security/Safe_Browsing [1] https://support.apple.com/en-us/HT210675
One of the reasons why users decided to jump ship to browsers implemneting more advanced security features (which invariably including some sort of malware/phishing actors filter) was the realisation that even a site that has been safe to visit before may serve you malicious content. PHP.net, for instance, was compromised in a way that is eerily similar to what the author here describes - JS files were variably serving malware depending on certain conditions [0], and the first warning anyone got was GSB blocking it. You can read and compare the outrage that 'it can't be true' that particular blocking has caused at your own convenience [1].
Whilst you can convince the users to jump ship to some fringe browser that does not use the technology (and I do invite you to try to find one which does not use either Google, Microsoft or Tencent filters and has at least 0.1% of global usage!), it is a losing proposition from the start. The take is: the vast majority of users is actually comfortable and happy to get this message, as long as they can trust that it is warranted.
Should filters be hosted and adjusted by a major technology company like Google? Probably not, and some indepdendent non-profit hosting them (for the sake of the argument, even StopBadware that kick-started the whole mess [2]) would be welcome to try to take that responsibility. But the filters are here to stay until we come up with something better as a solution.
[0] https://news.ycombinator.com/item?id=6604251 [1] https://support.google.com/webmasters/forum/AAAA2Jdx3sUpuLmv... [2] https://www.stopbadware.org/
The implication that less than 1% of Chrome users are old enough that Chrome didn't exist when they were in school is laughable.
Also, if that kind of familiarity rendered feature comparison irrelevant, Mosaic would still have a healthy share of the browser market.
If you enter at site that hosts articles on malware and it allows you to download the malware assets to play with for yourself, you should be a fool for not understanding that the site hosts malware and is not adversarial.
What if someone made a site that inspected malware and went in depth on how it worked and allowed you to download the malware to inspect yourself so you desire. Google would flag this site as bad and blacklist it, but in reality it's a research site.
Encrypted zip files with the password listed on the website is the easiest one that comes to mind. I wonder if googlebot will some day decrypt those files because a lot of pirated software is distributed in encrypted zip files. Scanning those files for viruses would be pretty useful for the average user.
I guess captchas are the only bulletproof solution
I would like to emphasize of course they have good stated reasons for warning users before accessing websites. The issue is that they are a private company whose behavior affects all major browsers and (for kicks) they have an extremely opaque review process.
If you ran a "divest from Big Tech" website which started gaining steam they could delist like this and the only real force stopping them is public backlash. If you think you can effectively sue Google to stop them I have a bridge to sell you.
That is definitely a good idea, and I recommend it. But that should not be the main takeaway.
In our particular case, that was not found to be the problem (we think it was some sort of false positive), and there are valid reasons for users to do that anyway (upload a phishing email attachment onto an IT support ticket, for example).
> Google literally controls who can access your website, no matter where and how you operate it. With Chrome having around 70% market share, and both Firefox and Safari using the GSB database to some extent, Google can with a flick of a bit singlehandedly make any site virtually inaccessible on the Internet.
> This is an extraordinary amount of power, and one that is not suitable for Google's "an AI will review your problem when and if it finds it convenient to do so" approach.
Real businesses can (and often do) host malware too. There was a notable event where php.net was hacked and hosting malware, which Google flagged. The owner of php.net was pretty mad at first and claimed it was a false positive. It wasn't.
At my local faculty there were at some point not less than 6 different malware serving sites (Wordpress, Drupal and some similar unpatched sofware), which were happily delivering all that data from a university domain.
What's the easy way to distinguish between "malicious" and "non-malicious" files?