Comment by jdsalaro | Hacker News Reader

Comment by jdsalaro | Hacker News Reader

Parent Full thread

> I think another take away from this article is “don’t allow users to upload malicious files to your domain”

I disagree, at which point did we all accept Google's role as defacto regulator and arbiter of the Internet? Why should we tacitly accept the constraints they deem as appropriate and modify the way we build the web?

In other words, those are our domains, our apps, our systems and we'll do as we please; that includes worrying about content moderation, or not.

When and why did we accept google as the Internet's babysitter?

Apologies if this sounds aggressive, but your takeaway reflects an appalling and quite fatalistic mindset; one which I sadly believe is increasingly common: big corporations knows best, big corporations say and we do, big corporations lead the way.

On the other hand, probably I'm just biased and tired considering how tiresome it's been to explain to my friends and family why Signal is the better alternative after the WhatsApp/Facebook fiasco.

/EndRant

When you installed their browser.

I didn’t install their browser.

Your users did decide to use it, though - and this particular feature is one of the reasons why that particular browser if popular. It was one of the major differentiators of the "better" browsers in the sad old IE days.

For all you "use Firefox [etc], don't use Chrome" pundits: it also uses Google Safe Browsing [0], and for that matter so does Safari, which may compound it by using Tencent version instead if you happen to be in China [1]

[0] https://wiki.mozilla.org/Security/Safe_Browsing [1] https://support.apple.com/en-us/HT210675

This is a weak take. Are we saying that any feature built into a web browser is desirable by virtue of the products popularity? 99% of chrome users use it because they recognize the interface from school laptops. Do you really want to live in this world where massive corporations can put whatever they want in their products and the justification is “yeah well people still downloaded it?”

> 99% of chrome users use it because they recognize the interface from school laptops.

The implication that less than 1% of Chrome users are old enough that Chrome didn't exist when they were in school is laughable.

Also, if that kind of familiarity rendered feature comparison irrelevant, Mosaic would still have a healthy share of the browser market.

No, we are saying that a site owner should not get to choose which features of the browser the users decide to use. It's the same reason why HN is dogpiling on any site that announces "Only works in Google Chrome", "Best viewed in Safari" or, for older users, "Designed for IE".

One of the reasons why users decided to jump ship to browsers implemneting more advanced security features (which invariably including some sort of malware/phishing actors filter) was the realisation that even a site that has been safe to visit before may serve you malicious content. PHP.net, for instance, was compromised in a way that is eerily similar to what the author here describes - JS files were variably serving malware depending on certain conditions [0], and the first warning anyone got was GSB blocking it. You can read and compare the outrage that 'it can't be true' that particular blocking has caused at your own convenience [1].

Whilst you can convince the users to jump ship to some fringe browser that does not use the technology (and I do invite you to try to find one which does not use either Google, Microsoft or Tencent filters and has at least 0.1% of global usage!), it is a losing proposition from the start. The take is: the vast majority of users is actually comfortable and happy to get this message, as long as they can trust that it is warranted.

Should filters be hosted and adjusted by a major technology company like Google? Probably not, and some indepdendent non-profit hosting them (for the sake of the argument, even StopBadware that kick-started the whole mess [2]) would be welcome to try to take that responsibility. But the filters are here to stay until we come up with something better as a solution.

[0] https://news.ycombinator.com/item?id=6604251 [1] https://support.google.com/webmasters/forum/AAAA2Jdx3sUpuLmv... [2] https://www.stopbadware.org/

The problem is that the process is opaque so you aren't even given a hint as to why the site is blacklisted. Security filters, fine, but at least tell the developers what the violation is so that it can be fixed. It's the same in the play store controversies, the developers aren't told what's wrong, the app is just taken down. This lack of transparency is the real issue.

Sorry, but you don't get to tell me I am obligated to browse your site without being notified if you have malware.

Might have, judging from this story.

Assuming that this site "serving malware" isn't doing it purposely.

What if someone made a site that inspected malware and went in depth on how it worked and allowed you to download the malware to inspect yourself so you desire. Google would flag this site as bad and blacklist it, but in reality it's a research site.

There are standardized ways to share malware downloads. Google likely respects them.

What is that standardized way?

Encrypted zip files with the password listed on the website is the easiest one that comes to mind. I wonder if googlebot will some day decrypt those files because a lot of pirated software is distributed in encrypted zip files. Scanning those files for viruses would be pretty useful for the average user.

I guess captchas are the only bulletproof solution

Usually people use a zip file with the password "malware".

You are not obligated to browse anything. In fact, you as a human is obligated to very little. Perhaps keeping yourself alive (which somebody might even oppose as an obligation).

If you enter at site that hosts articles on malware and it allows you to download the malware assets to play with for yourself, you should be a fool for not understanding that the site hosts malware and is not adversarial.

Reply on news.ycombinator.com