Hacker News Reader

Google is doing the same business with VirusTotal.com. We're hosting malware as zipped files, and providing passwords to users. It's not possible to accidentally run the malware as user.

And the problem is not about this, we removed all the files and Google said you didnt. They're not saying you're not trustable website, they said you still have the files but we haven't.

View on HN

You have to agree that verifying a website is free from a malware is not possible, while verifying that it has a malware is easy. If I play devil's advocate and say that:

1. A bad actor is publishing a malware at example.com/malware-a.zip;

2. The antivirus measure block them;

3. They move it to example.com/malware-b.zip but tell Google that the site is free from all malware, because if Google hit the old url `example.com/malware-a.zip` it is a 404;

Should Google give the bad actor the benefit of the doubt, unblock them/ or keep blocking them?

Again, I'm not downplaying the shittiness of the situation both you are in right now, but again, this is the default behavior we are all expecting from any antivirus measure.

Reply on news.ycombinator.com