How I advertise malicious software on Google Ads
xlii.space
xlii.space
1st time: Uploaded 4 photos, local business info, current charger prices, and GPS coordinates. Google replied this would be sent to human review. It was rejected within 6 minutes.
2nd attempt: Uploaded 6 more photos, including shots of local business hours and info, and current prices. Rejected in 6 minutes.
3rd time: One photo of a new charger, no description. Rejected in 6 minutes.
4th time: Appended all above details to local business info. It went live within a minute.
5 days later: Supercharger location was added by ??? and included no info at all and the pinpoint was off by 100m.
Kudos for you for trying 4 times.
If it’s a small or local business that I like patronizing then I might do something small for them out of generosity and a desire to see them succeed in place of some large chain or corpo.
So what I've taken to doing is adding the business without photos (almost always accepted), and then trying to attach the photos later after that goes live (mostly works). But I agree, their process is completely broken, and I doubt they have any incentive to fix it.
But when I've submitted updates to road changes a couple of times, they did go through
Or, perhaps a part of the process that is two or three teams away, like photo attachments being deemed too large (getting passed from Maps UI through internal task queues to some abuse analysis, or even as early as the frontends that take the request). Plausible, especially as phone photos have steadily increased in size while some thresholds remain ossified.
I'm outside that world now so I can't investigate or effect change.. there used to be people there who care about these things. I suspect there still are.
Even more likely is that other priorities exceed the capacity of the headcount on the relevant teams. I don't know if that counts as the company not caring. It's hard to attribute intent on corporate-scale embodiments. Perhaps that's the root of the problem, I wonder if any collective that reaches hundreds of thousands of members can ever exhibit that. Maps is a huge product that a small competitor could hardly compete with but I'd love to be proved wrong (either on the smallness or considerateness aspects).
Now, I'm enough of a fan of decentralization and the destruction of these massive sites with way too much control to say that I'm perfectly comfortable saying that they should be mandated to handle these things more sensibly and with more humans. That such a plan would have the side effect of breaking them up into vastly, vastly smaller pieces, causing an technological Cambrian explosion of various sites and diversity resulting in the parasites no longer being able to focus all their firepower on a very small set of targets, is for me a bonus, if not the main goal. However, I, and anyone who agrees with me on this, is rather clearly in the minority.
In the meantime, if we're going to have things the size of Google or Facebook, there simply is no solution where we all get human review whenever we ask for it, because instantly every spammer and abuser will ask for the human review. There just isn't a solution. It looks like there is an obvious solution when you consider "how will Google review this one application" but that's not the landscape Google faces. They have to solve the problem of how to deal with the entire landscape of requests they face at once.
Which doesn't seem like such a bad idea now that I've said it out loud.
"Alphabet, Google's parent company, reported $112.1 billion in profit for the three months ending in June."
Ah yes, they definitely can't afford it.
I genuinely cannot grasp how someone who is capable of 1. finding hackernews 2. creating an account 3. writing a coherent English comment, can come to such an absurdly wrong understanding.
Scammers generating things in fractions of a second is an incredibly well understood problem that affects every single surface of the earth that has a "submit" button. Even completely anonymous services have largely managed to solve this. Google Maps requires a verified account, meaning it's entirely solvable. It's a non-issue.
Give me $112.1 billion every 3 months and I'll solve it for you, no worries.
I bet they'd care if their data started going stale because nobody bothered to update it.
(To be fair, on a laptop - I'm sure Google Maps is more straightforward on a phone. But for someone already prepared to invest this much effort, editing OSM should be well within range. And if you just enjoy contributing to maps, for a phone I can highly recommend https://streetcomplete.app.)
Isn't it fair use, like training data?
I guess that some may be calling it overdoing in direction opposite than Internet Archive did.
It is at least partially caused by fact that OpenStreetMap Foundation budget is laughably small.
And doesn't that mean that terms of use can never impose restrictions stricter than copyright?
Enforcement can be quite challenging because typically if you provide a service over the Internet you don't have any idea who is using it beyond their IP address and any registration data they provide, but this also means that when companies do have a known violator and can show significant monetary damages, their legal departments come down like a ton of bricks.
The issue most ToU violations have with enforcement is that it's hard to show damages. If you just accessed their service with a fake name or downloaded some data for personal use, you haven't really harmed the company. So what are they gonna do, spend $10M to sue you for $0? So they just handle it internally by banning your account and discontinuing your use of the service.
But if, say, you did a DDoS attack that caused an outage costing them $100M, or you did large-scale scraping to set up a competitor that puts them out of business, and they can identify you, they absolutely will come after you in court for that money. The economics is different: now the damages they show is much more than the cost of litigating the case.
OSM doesn't have the resources to fight Google or similar if they are threatened, so it's better to just avoid using data you don't have the right license for.
They also only email if your contribution is successful. If it's declined you'll only know by looking inside Google Maps.
Contributing to an open dataset also feels really good.
Oh, for the simpler days when not everything required an app.
It feels like editing a database, without any affordances for easily making common updates.
If the hours of a store are wrong on Google Maps, I just upload a photo of their store, and it'll be corrected quickly.
On OSM, well, most things are out of date. There's no simple 'update this business' flow, just a database editor. And a map that feels like I could break anything by clicking in the wrong spot.
OSM is a cool project, but it isn't straightforward. And unlike Google and Apple maps, most of the businesses in my area are years out of date, so I can't effectively use it to find information either, so I just don't have any reason to interact with it. Plus no aerial/satellite/streetview imagery, which I understand is probably infeasible, but ultimately it just means OSM is a niche product that won't replace Google.
So yeah, I'm propping up Google, but I get way more benefit out of it than having an open data set used to power Amazon's delivery driver routes or whatever.
there's at least three user friendly and better than google maps UX clients.
but i guess they didn't bundle with your pixel nor have all the darkpatterns you got used to.
In OrganicMaps/CoMaps I click "edit place" > "Business hours" and get a nice vidual editor with checkboxes for each day it's open and boxes to put in times.
Same in OsmAnd, but editor looks a bit different.
Cartes.app has the "imrpove this place" screen where opening hours is one of the options, but it takes a few more clicks.
Openstreemap.org's web editor also does open hours quite well, but it does have a much complex submission process (it also asks for an edit message and edit tags).
Cartes.app has sattelite imagery as a "premium" option if you donate because they probably have to pay for it. OsmAnd also does, but I don't know if it's free because I paid for it years ago.
When it comes to fixing opening hours, https://streetcomplete.app does really make that about as straightforward as can be.
Edit: ah, I just noticed I forgot to prepend the * to my remark in parentheses. I did mean to emphasise that generic edits are only straightforward on a laptop, and only guided edits are straightforward using StreetComplete.
have you tried StreetComplete or EveryDoor?
Or at least GoMap!! or MaComplete ?
There are few contributions around there, mostly automated imports from like 2012.
This was made 2-3 years ago, probably worse today. Absolutely horrific experience, and they have zero motivation to fix it, because people like us still want to be on Google Maps, especially if you're not in a super good location, so people can actually find you.
Literally nothing could get delivered to me if they used a Google Maps address bar. My address just didn't exist at all to that search bar. It could be found on maps, just not on that little search bar widget.
I ended up just putting my neighbors address and either intercepting delivery drivers or putting in the notes that I was at the half address next door.
Moral of the story: check your potential address BEFORE you move in
A lot of problems would just be solved by trust-but-verify information. If a user wants to put non-sense in a text box, that should be a 'them problem' but a service that presumes all email address end in .com or that a user doesn't know their own address is worse. With that said, I understand why services do it because the Venn diagram of "will type non-sense into a field then wonder why it didn't work" and "will email into support and be the reason someone drinks" is largely a circle.
We have had solicitors walk through our side yard convinced they are going to the 1/2 address (which we don’t have).
Maps seems to show them all correctly.
I had a very factual 3-star review on a hotel that was supposedly very quiet, but was super noisy and the AC was not working. And there was literally nobody at the reception at the time of check-out and nobody picked up the phone either. All in all, nothing serious, but worth a review. Purely factual stuff, nothing bad-mouthed, just my experience and three stars.
A few months later the review was removed because it was "defamatory". I was able to get it reinstated by sending them proof of payment to the hotel and proof that I was there. A few months later, it was removed again! That same dance was repeated six times..... What a weird system.
Only sure fire way I've found is to leave a two star review with no body. One star without a body is also shadowbanned for me.
The reviewer isn't contributing to Google's revenue at all, so his honest review is only worth something if it makes the advertisers happy.
In theory, good reviews drive traffic to Google because people come to trust it as a dependable source of important information. In reality, Google is big enough that they don't have to care. They figure that people will keep using Google no matter how many times Google lies to you. Seems like they're right because their AI overviews lie constantly. https://arstechnica.com/google/2026/04/analysis-finds-google...
This is not the old Google run by engineers. Stop expecting that and you will experience less frustration.
After all, there are many customers like you and me. If we’re gone, someone else can fill the gap. Not saying I condone it. I dislike it. But I understand.
Four times my friend had to take a video: you have to start by standing on the street on the nearest intersection, film all the street signs around you to prove your location, then he had to walk down the street, show the gate with the business name on it, the vehicles with the business name on them, open the front door with the business name on it, give them a tour of the working office and show them invoices and bank statements laid out on the desk with their logo etc on it. Three times they came back and said it wasn't enough to verify.
At the same time you can go on swapd and buy GBP verification for $500 and have it verified in an hour by someone who fakes the entire thing.
I submitted the correct location and it said the change required manual review. Then a few days later I got an email that the change has been accepted. But opening google maps it was still in the same wrong location, and it's still wrong now.
And heaven help you if you choose to get an office on an upper floor where an elevator ride is required, or you get a space in a building that also has/had a co-working space in it.
Meanwhile on YouTube when I’m not getting questionable medical drugs and gadgets advertised at me on YouTube… I’ll also get what seems like just porn.
I got one that I’m pretty sure was heavily hinting at “find under age girls”… I shit you not. The pic was disturbing.
My YouTube history, cats and coding music…. I don’t get it.
At some point it may be necessary to add the requirement for large companies to have a both human contact point and perhaps a requirement for specifics on account terminations and the like, or at least a way to request them, to the letter of the law.
If I wasn't as idiotically stubborn as I am, I would've given up a month into the 8 month ordeal it eventually turned into. I guarantee you the vast majority of people wouldn't bother escalating to their CAA, or contact the relevant courts or authorities, which is what these scummy tactics are designed for. They would've been ignored like I did, then they would've given up because what's even the point?
The fact that we're allowing companies to get away with bullshit like this is ludicrous to me
If they decide to not reply it becomes much more resource consuming to go down the legal road.
I had this with DoorDash, even if you call they just say some specialised team needs to look at it and they'll email you back, surprise, they never do.
That was the most recent time, but I've done it a couple of times. I do everything digitally, so it's always easy to prove my case.
Cell phone accounts: no regulatory oversight
This pattern of deregulated modernization isn't just a pattern. It's a scandal.
Hope you're not voting for any parties that don't explicitly run on a platform of stopping companies getting away with bullshit.
I'm pretty sure the Netherlands does have at least one such party, as other European countries I'm more familiar with do, no matter how small they might be.
If they don't show up, doesn't that mean you win by default? (And then you can indeed send a bailiff to seize a plane...)
We got an admittedly very good deal to switch cell carriers. Part of that deal was receiving a debit card with my phone's trade in value loaded. That card turned out to be digital. I put it on my phone without thinking too much of it. However, given my lack of experience with Apple Pay, I didn't realize that I now didn't have access to my own card number. When I try to use the debit card, I am asked for a PIN that I've never been given an option to set up. When I call the card provider, the automated system demands a card number. Which I don't have.
Granted, it was my ignorance as a user that is responsible for some of this but it's pretty clear that the lack of access and support is intentional.
Yes, Ryanair stole 100 euro from me once, but if next flight is 50 to 250 euro cheaper than competition...
I did some big projects motivated entirely by spite (project was overall helpful, but I would not do this if someone would be less nasty). But I still would use Ryanair.
I swore off them a few years ago.
Plane started boarding around when it was due to land. We got on, seeing about 3cm of snow around. It went to the runway, whereupon the weather wasn't good enough so the plane waited. And waited. And waited. And then the pilot turned off internal power because we were waiting so long. And then the airspace was closed for the night and every Ryanair plane did what we did and taxied back to the airport and deplaned all of us, creating a queue at the help desk that didn't clear until 8am the next morning, or at least that was when I got to the front having stood up all night.
I was supposed to be back in the office and working by this point.
They told us to check online for rebookings: couldn't do that, their website was overloaded, though I could sometimes get as far as the schedule before it failed on me, and the next official opening was about 5 days later at the start of the queue and 7 days later when I reached the end. Other airlines were now charging £1000 for next-day flights.
Got a standby ticket for a few hours later. Went through security again. It was also cancelled.
At this point I went to my brother's place near Portsmouth, slept enough to recover, took the ferry to France, and took the train from Caen to Berlin, and this was still both cheaper than any replacement flight and faster than waiting for Ryanair to offer another flight that would also be subject to the same general climate.
If the plane had landed on time before it got to us, it would've taken off before the weather got so bad.
Had a very understanding boss at the time. I miss working with him.
The banking industry has been hostile toward poor people for ages. When I was in my early 20s, an employee at a bank let me open a savings account without meeting the minimum balance for an instant penalty.
Of course, I'd get that shit reversed on that person's dereliction of duty to warn me when we were discussing how much I'd allocate to it if it happened today, but I was young and dumb and didn't know how to stand up for myself at the time. This was early 2000s, so hardly a recent change.
Sometimes it's because they don't have a choice.
Case in point, since we're already talking about them: Ryanair. I'd cheerfully never fly with them again after, several years ago, they denied my wife and I boarding to a plane despite the fact the screens round about were still saying final call. Not just us either: about half a dozen other people missed that flight because the screens in the main terminal only updated with the departure gate a few minutes before final call and we happened to be quite a long way away when that happened. I've never had anything like it happen at any airport before or since.
Be that as it may: we can't practically avoid using Ryanair. My wife is from another country and Ryanair is one of only two airlines that fly there from the UK at all and the only airline that flies there from the nearest international airport (roughly half an hour away as opposed to 2+ hours away).
So we fly Ryanair even though neither of us want to: there simply isn't another practical or sensible choice.
These companies have correctly figured out that it's much cheaper to buy out governments so they won't actually punish them for all the regulations they break or institute new such regulations.
That's the weird timeline we're on. Governments willingly ignoring large scale violations by large corporations who actively harm their voters they're supposed to represent.
"Your Instagram account has been suspended. This is because your account, or activity on it, doesn't follow our Community Standards on account integrity.
If you think that we made a mistake, you have until 8 March 2027 to appeal."
I've now uploaded my drivers licence, a photo of my passport and still apparently that's not good enough for them.
My latest rejection says I have only one more chance. No idea what the transgression was, but apparently there is no recourse.
I guess it's a good thing I don't really give a crap about Instagram in the first place, isn't it.
That's not a good practice to begin with. Your insta account doesn't matter but your privacy and government-issued documents do matter.
Sounds like its working as designed. This is why you never cross streams between work and personal life.
There are a gazillion accounts that do this constantly, and all of them appeal.
If you were willing to upload your driver's license and passport for a mere chance at getting back an account you don't give a crap about I'd hate to see what you'd do for one you do care about! Facebook demanded my driver's license at one point out of the blue. I simply abandoned the account, I was already pretty over them at that point anyway. About a year later it let me log in just fine and had forgotten all about how badly it had needed a scan of my license for security. In fact I didn't even remember the password, it just auto logged in from an email link.
You kind of confirm what I suspected though, that they'll just keep asking for more stuff leaving you more exposed and they're under no obligation to actually give you the account back no matter what you do.
I don't use discord but IIRC I read that if your account was banned they were asking for a mobile number to get it back. Instead of getting it back if you complied they just added the mobile number to their ban list so you couldn't make a new account with it.
But if you go on Swapd right now and pay a Meta employee $500 while it's still in appealable state you'll get your account unlocked in an hour.
Make it make sense.
After the recent news about >150 million drivers' license photos being stolen from an ID verification service, I'd be very hesitant to do this for anything I didn't absolutely need. ID theft is a lot easier when someone has a photo of your sensitive documents.
No appeal process.
Luckily she didn't use Facebook much.
This is already implemented, under the EU's Digital Services Act, you can appeal and get specifics about account terminations - see https://digital-strategy.ec.europa.eu/en/policies/dsa-out-co...
Also their explanation for the lockout was that I failed the verification step too many times, which I don’t recall failing even once.
I guess I shouldn’t have expected any differently when their income is dependent on displaying those scam ads.
Make them liable for what they show, and watch them suddenly discover they are able to care a lot.
People who never do any sort of blocking are the most valuable ad-targets, and hence get the highest bids when their views are auctioned. They get Toyota, Coke, and Downy ads.
Scam advertisers are bottom feeders and the "advertiser of last resort". Google doesn't really care that much about people with blank profiles, and why would they, these people use their services and contribute nothing back. I don't think Google is vindictive, but it just doesn't make business sense to put a lot of resources into cleaning up ads that pay google nothing and mostly go to people who temporarily disabled their ad-block.
These scam ads are trying to play the numbers game that email spammers do. So they just bid on everyone at the minimum bid. For people with fleshed out ad-profiles, the big advertisers that pay decent money will buy those slots. The auctions almost never fall through.
For people with no profile, no one bids, and the auction falls through to the scammer who will pay $0.00001 for their ad to load.
So ironically, the (second?) best way to remove scammy ads from google is to keep loading ads from google.
The protest of the ad-economy is boycotting ad based services. Not using those services while blocking the ads. That just sends the signal that there is demand for free shit, which is both obvious and meaningless.
Let's be truthful and honest. It's something to not like ads - I don't like ads - but you have no reason to muddle and distort a sensible conversation.
I see where you are coming from, but getting burned by a scam Google advertised to me just pushed me to cutting Google out of my life completely. If it were the occasional bad actor slipping through I might have been more forgiving, but the scam that got to me had become well known for at least the last 18 months. If Google doesn't care enough to keep the well known bad actors off their service, then I protect myself & my family by blocking Google.
Low quality ads should be the bottom of the barrel. Actual criminal activity should not be anywhere in the barrel.
I can also assure you that scammers don't payout more than Coca-Cola or Proctor and Gamble for ads.
If we lived in a sane world, Google would be held accountable for every scam they advertise. It doesn't matter if you think someone deserved to get scammed for using an ad blocker, because they never would have been scammed if Google didn't choose to put them in danger for the sake of profit.
"But they can't possibly review every ad before publishing" they say. If that's the case, then they should scale down the amount of ads they allow until it reaches a manageable scale (eg every single ad can be reviewed by a human employee). They might make less money, but it's an expectation we have of nearly all industries (eg commercial truck drivers have to follow extra restrictions in addition to regular speed limits)
They are heading pretty steadfastly into multi billion dollar lawsuits the way they are going.
This is some proper, indoctrinated, corporate bootlicker mentality.
95% of the phones on the market will spy on you, send your data back to the mothership, and they will sell your data to 3rd parties, and they cost $1400-$2000. You pay for the phone which is not even yours after the purchase, and then you still get ads, spied on, and your data sold. Google has a very large monetary incentive already to protect their customers and they do jack shit about the malware/adware in the play store.
TVs are even worse. LG TVs were just found to spy on you and nearby devices while they are off. Do you think those TVs are free? No, they also cost a fortune.
The current state of the world is that even if you pay you will get ads, spying, and malware. Get your head out of your ass.
Sergey's flotilla needs a new vessel this year though, so can't do that.
It's not, it never is; it's a lie on the level of "Poland attacked first". Say, if someone was offering you $40+ billion every 3 months to solve the issue, do you think you could? It's a ridiculous question, of course you could.
That defense doesn't work either way as they (and Facebook) also reject manual reports from users.
Each and every single human on the planet has made a contribution to Google in the form of their data — whether they wanted to or not! What more must we give for the great and all-knowing Google to contribute ANYTHING back to the commons? Remember when CAPTCHA was meant to crowd source the deciphering of old books for the good of all?
Remember “Do no evil”?
I mean for fucks sake are you a Google agent? Or even a human?
What a wildly twisted statement. More accurate to say these users refuse to be exploited and thus have little monetary value.
I mean how often do you see an ad for a product, buy it (not even from the ad itself, maybe from a recommendation from a friend) and you are happy with the product and think the ad was truthful?
On one side I'm happy it happened, on the other, it's a shame that it took complaining on the internet amplified by HackerNews to get this problem fixed...
The cause was that the site was in fact compromised and at a certain very discreet URL it hosted a bunch of pages for legit products that linked to external shady sites. They got in through some PHP hole. Got lucky they didn't do more damage. However as per various Google pages and dashboards no issues were present except being tagged as a malware distribution site.
The remedy was to audit the site, clean it up and then re-submit the appeal. Got the tag cleared in a couple hours.
I've reported the ads multiple times, but new ones still end up being promoted. I'm sure these companies have mined and sold thousands of SSN/address/DOB info from unsuspecting users.
We need a .QUANGO domain for stuff like that :p
So it is unclear how you determine that they are definitely scams, unless you have attempted to trace each one through referrals or official links from the government office they are representing. Some don't have any link, though: the passport assistance services may be operating independently as middlemen. Is it worth paying someone to assist you with paperwork? Do you only speak Laotian?
In general, for any government service, there are usually middlemen who'll assist you in filling out paperwork and getting approved. That includes Medicaid and the IRS and Social Security. Of course, some of those assistors have licenses, or represent a facility. The passport agencies may not need any bona fides like that.
On the other hand, if a service is advertising "TSA PreCheck" services (and not simply intercepting your keywords to advertise unrelated stuff) then there are only three authorized partners: IDEMIA, CLEAR, or Telos. But I bet you that your keywords are simply triggering some adspam.
People with influence to fix bureaucracy don’t suffer through it because they can afford the middlemen.
I got one from passportsfast or something. Highly recommended (if it's registered)
> https://travel.state.gov/en/passports/apply/get-fast/courier...
also, searches for dmv related content
It's hard finding a good Command & Conquer server nowdays
https://successfulsoftware.net/2015/03/04/google-bans-hyperl...
A joke comes to my mind:
A man tells his friend "You know, I don't think we can be friends anymore. Some money went missing from our house.." - "What?! Me? I'd never seal money from your house!" - "Yeah, we found that money, so that's not a problem. But you know... the whole thing left a sour taste."
By the way - which company removed ublock origin from Chrome? Could it have been a certain adCompany that does daily deeds of Evil?
https://www.cannonade.net/blog/why-i-turned-off-google-adsen...
I'm now a huge supporter of any initiative or law that attempts to break Google's stranglehold on online advertising. They have placed too much responsibility in their broken automation, and they are a bad faith actor in the space.
One day I got a message that my account was closed because of a violation of the TOS. No explanation what it was that I violated. No chance for appeal. No chance to communicate with a human about it. It was explicitly stated that it was impossible to reinstate the account. To this day I have no clue what it was in the 20 or so timelapse movies taken from a small sailing boat that offended Google.
It was a good lesson to never trust Google.
it used to be common but more of an exception, but now it feels like everything is a scam
Have you (anyone) actually sticked to the way of working this enables, or is this just a gimmick?
I kept macOS surface isolated and constrained on purpose (and also have my own rendering engine) so it should be rather easy to make it run on Linux. The biggest obstacle is that it's hard for me to test (I have a gaming rig on Linux, but I don't use it often lately..).
So i tried appealing using another console account. After about a week i got the usual automated response stating that my previous report was auto-translated into english (i wrote it in fucking english of course) and some generic babble about what happened.
To which i replied that i have no problem opening a new account using the old email, but i'd want to know beforehand if i'd keep, or how to retain, the package IDs so it's not going to be a fucking painful mess to tell customers to reinstall.
And of course i got the same autogenerated email, with a couple new lines summarizing the first part.
I feel for the author, it is literally impossible to talk to a human there.
yes please!
Google is not great but we all can’t have nice things because of thieves and criminals.
Also why use Google Ads in the first place? Given that HNers and technical users are extremely allergic to that?
Pretty sure they are not targeting the general population with this product.
That is definitely not the case. At least 90% of google results are AI slop now.
People are people, life happens, job happens, but unfortunately some of these roles have real external impacts on other people. One demotivated employee at a Google* can radiate their unhappiness onto great number of others because of the circumstantial power they have at their disposal.
At the very least they could copy & paste the exact reason for the ban, but no, they'll drag people through mud and automated replies, etc.
Oh, you expected them to care about users? Lol, lmao even.
And then the design and implementation of the process itself is split across access silos mediated by lawyers and program managers. It's deliberately physically impossible for a motivated employee to improve the system for users.