Hacker News Reader

Comment by hedora | Hacker News Reader

In this particular case, I suspect a trademark complaint against Google would make sense.

Google misrepresented the ad as the product of the Gimp project, and were paid as a result. They usually use an "obeying the law would not scale" type argument in court, but that would clearly be bullshit in this case. They have a business relationship with the ad buyer, and should have verified their affiliation with gimp.org. Also, a simple string match on the URL would expose the attempted fraud on Google's end.

I'm not sure how to check if Gimp is a registered trademark in the US. This page kind of implies it might be (or that the author of the page does not understand trademarks):

https://www.gimp.org/about/selling.html

View on HN

Having the actual url be completely different from the displayed url simply shouldn't be possible. Allowing that invites scams like these. At the very least, they need to be the same domain.

Yes! This is crazy to me. How can this not be a thing that has already been discovered and instantly fixed?

Many ad buyers are not-so-sophisticated...

They might work for BigCo, but rather than have the ad point to bigco.com/product they instead have the ad point to tinyurl/bitly so they can track how many people click the ad and repoint it to another URL easily.

There is a whole industry of these redirection services that gather stats, direct users different directions based on mobile/desktop or country. It isn't rare to bounce a user via a whole chain of them.

To support all those users, ad networks have to allow the apparent URL and actual link target to differ.

If google gave a shit (obviously they don't) they could whitelist a few tinyurl/bitly/etc sites then follow those redirects themselves to verify they eventually landed on the displayed domain.

No, ad networks don't have to allow any of that. And they shouldn't. Ad buyers should either not track, or do it properly. Demanding massive security holes because you can't be bothered to learn the right way to do it is unreasonable.

It's a "feature". So you can link to blafoo.advertisinganalytics.com/weird-looking?tracking=link but what the user sees looks like normal and "safe" brand.com

You should still somehow be able to prove ownership of the domain you want to display, that’s the problem.

Redditor RawPacket writes[1] that it's probably an IDN homograph attack[2]:

  the g, i, m, or p are replaced with characters from a different character set. Looks right, but the domain is registered with a different character.
  
  Example: * gіmp.com is fake. * gimp.com is real.
  
  They look the same, don't they? But if you click on the fake gіmp.com, your browser will take you to the domain xn--gmp-jhd.com as it is using the і from the Cyrillic character set.

[1] https://old.reddit.com/r/GIMP/comments/ygbr4o/dangerous_goog...

[2] https://en.wikipedia.org/wiki/IDN_homograph_attack

For a moment I was thinking "But then the second screenshot would read "xn--gmp-jhd.com", not "gilimp.org" -- but that would be easily hidden by making the former immediately redirect to the latter.

(Mostly I mention this because someone else might be thinking at as well.)

Are different character sets allowed in urls? Because that too sounds like a massive mistake inviting these sort of scams. Sorry, but stick to ascii.

Modern browsers won't show those characters in the address bar, exactly to avoid this issue. Which is maybe why the ad points to gilimp.org instead of the gimp.org lookalike.

That's a good theory, but I don't think it's what happened here. The ads are gone for me now so I can't verify, but when I did get the ad I checked the network monitor and I'm pretty sure there were no redirects via lookalike domains. Also, I'm pretty sure I copy and pasted the display URL and it was plain ASCII.

> obeying the law would not scale

I don't know why, but that sentence terrifies me. It's like the silicon valley version of a dystopia.

Some laws were put into place before the current internet scale was imagined and would probably not be made today

That's still the exact same dystopian take: complying with the law is too hard for Google so the law should change to the detriment of smaller entities.

So it’s a valid defense to say complying with the law is hard, that’s why I didn’t?

Shouldn’t the right course be to change the law before taking such actions?

Indeed. Saying: “Obeying the law doesn’t scale.” is an admission of guilt with pre-meditated intent to break the law. I keep hoping the courts will drive that point home at some point.

If you lead with the big ask, you frame the entire conversation around it. One should always start one's argument with question-begging, and disqualify people who don't accept the question begging as not serious about having a discussion.

"The laws are impossible to follow at scale. How do we fix that."

Or as a thinktank feeds it to a speechwriter to a politician: "Our antiquated laws have failed to keep up with the speed of technological development, and are now becoming an active handicap on progress. We need a set of laws that are as forward-thinking as our best selves hope to be, and a set of legislators that are responsive to the energy and creativity of the young while respecting the intelligence and hard-earned wisdom of the old."

I think politicians might even be willing to try to do that, but I doubt that regular people would be on board with that. This would most likely involve permitting a lot of things in society that we consider immoral right now (or at least objectionable to some extent).

If you tried to buy ads claiming to be Google.com but pointing to shadyweb.xyzjsiebsk.net you'd find out real quick that Google's legal ability scales just fine

Waiting for the law to change doesn't scale. Gotta be an asynchronous call. Just epoll the legislators.

I don't think "move fast, break things" meant the law, did it?

Of course that's not a valid defense.

It's not uncommon to evaluate the value of enforcing the law. DAs do it all the time.

It's absolute BS. If a citizen were to come into a court and were to express the quantity of state and federal laws, those which compete with each other, and beg the court forgiveness based on, "There's so many laws I can't possibly be made to keep track of them not to mention the laws that are no longer actively exercised in courts" they'd laugh at you.

A corporation like Google does it and the court agrees. Corporations are not people in the worst way possible.

it depends on your lawyer and on your face/outfit really

Which is also weird, because it is a far better reason for an individual than for a corporation. An individual is limited to their own time and expertise, whereas a corporation is only limited by their willingness to hire additional workers and expertise.

Internet scale companies like Google happily embrace intellectual property laws when it's their IP on the line, they just don't care about anyone else's. And it's not an issue of "can't scale": Google's ad revenue is bigger than the entire GDP of Kentucky--they could literally hire 1% of the US population to work in fraud management and still turn a profit.

How would you manage a fraud department of 3 million people?

Your business doesn't have an inherent right to scale

Then your business is not actually scalable.

> I don't know why, but that sentence terrifies me. It's like the silicon valley version of a dystopia.

because it is true.

We have seen the same pattern in copyright infringement handling, spam or fake news control, user support...

It may be true, but why a judge or jury would accept it as justification is beyond me. "My business model requires me to break the law." is a condemnation of the business model, not a justification.

The problem is that the legal system is flawed in such a way that the wronged parties rarely have the time & resources needed to actually put the issue in front of a judge. If it actually does get in front of a judge (in reality it would get settled out of court if it actually gets anywhere close) I would indeed expect their argument to fall apart.

This is something that ideally the government (its consumer protection branches like the FTC) should be policing proactively, filing suits preemptively against systems that are trivially exploitable.

Agreed -- there's also little recourse for many forms of online fraud, as there's no capacity for law-enforcement to investigate at scale.

Definitely agreed. I think it also stems from laws that define explicit and measurable harm as the only types of harm. For false advertising and fraud, it usually requires proving that they was financial harm done as the result of the false statements. Because creating an environment in which fraud is cheap and easy doesn't count as "harm". Because false advertising doesn't count as "harm" in itself, even as imposes the burden of scrutinizing all claims from previously trustworthy sources.

Because if you tried to actually police this then everything in life would grind to a halt. It would be like expecting the government to deal with every single crime.

It's particularly problematic when a business is providing a platform for other entities to post a message. We don't hold the post office liable for transferring copyrighted/trademarked content, do we?

This case is more akin to a TV network, since the ad is publicly broadcasted based on what people are watching/reading. It’s not private correspondence.

It is the reason for the existence of the dmca.

Now I take a rather dim view of the dmca. But the general concept is to move enforcement of the law out of the normal slow bureaucratic channels. Now enforcement is handled directly by the injured party. Much more efficient.

If you immediately see how ripe for abuse this system is. congratulations. you are now more far sighted than the originators of this system.

Now to it's credit, the dmca limits the enforcement(I think, I have never read the law) to a formalized version of "if you stop doing it we won't press charges" however this is still widely abused.

There is a whole genre related to this kind of dystopias, cyberpunk. Its predictions from 1980s and 1990s turn out to be increasingly true, sometimes in the grim parts, too.

We are already living in a dystopia.

Google does not allow trademark infringement in ads [1] and provides tools for trademark owners to prevent their trademarks from being used improperly.

The issue here seems to be that the Gimp team does not have a registered trademark for "Gimp" (at least not in the U.S). This can be verified at the USPTO website [2].

[1] https://support.google.com/adspolicy/answer/6118

[2] https://www.uspto.gov/trademarks/search

All ad companies need to respect trademarks and allow opt-out of reserved terms as a first class feature.

It's disgusting that a competitor can buy an ad for your brand on Google, Apple, etc. and place their result before yours. This is especially harmful for new, up-and-coming companies.

I've had competitors buy ads in our name before. It's a shameful tactic.

It's beyond unfair when these monopoly-like ad companies spent hundreds of billions to co-opt the web and personal mobile computing and shackle us to this fate. It's the nightmare Microsoft and AOL once envisioned, yet now it's actually come to pass.

We already pay for domains and trademarks. We shouldn't have to keep paying protection money to defend ourselves when we're already having to jump through the platforms' obtuse rules and pay their outrageous taxes.

Trademarks should be sacred, and no company should be able to profit off of yours.

> “obeying the law would not scale”

I’d love to see them trying that one out in an EU courtroom

> Also, a simple string match on the URL would expose the attempted fraud on Google's end.

I feel like your general argument is proving too much: Google clearly indicated this is an Ad, and you couldn’t reasonably hold Google or any other publisher of ads responsible for every claim made in every ad. However, I agree that the domain part is troubling, and even seems like a potentially misleading representation by Google — I’m surprised you’re able to set this arbitrarily. However, as discussed in a thread below, maybe you can’t and this is exploiting an open redirect in gimp.org? I think some details would be needed before you can jump to assigning blame so quickly.

> and you couldn’t reasonably hold Google or any other publisher of ads responsible for every claim made in every ad.

Why not?

This simply ends advertising, and publishing generally. I’m not saying that gross negligence is okay, but I don’t think verifying every claim is a reasonable standard (it would be impossible).

> "obeying the law would not scale"

Then don't scale...

> "obeying the law would not scale"

How can anyone argue against blocking ads when this argument is used literally in court as explanation for why they are unable to police the ads they're putting on their own platform?

GIMP is not a registered trademark anywhere in the world. Unfortunately. Which made it possible for a number of scammers to be really bold (and be punished in the end, on one of the occasions).

How much money should they bring to successfully fight this case?

Reply on news.ycombinator.com