3 ms·

> With powerful new protections, we disabled more than 10,000 sites offering unwanted software, and reduced unwanted downloads via Google ads by more than 99 pe

> With powerful new protections, we disabled more than 10,000 sites offering unwanted software, and reduced unwanted downloads via Google ads by more than 99 percent. Yet when I search for "download Firefox", the thing I see is malvertising. https://i.imgur.com/IRQ85fx.png https://i.imgur.com/IRQ85fx.png

Klathmon 11y ago
You can't just call it "malvertising" when it's just not what you wanted... I just went and downloaded the app from that add and compared the checksum against the APK on my phone of the same version (version 42.0.2, downloaded from Google Play) They both match. (Both SHA256 checksums are D0B5A524ABFD5AD9D73DFF4DA398423CB7B337797FBA0C039F3A44CAE259B4B0, if you want to verify it from me as well) So that site is providing an untampered download of firefox, so there is no "malware" anywhere. In fact that site (HTZapps) seems to be a curated list of "safe" apps available to download, an alternative app store much like fdroid or the amazon app store. It even follows the Adsense guidelines on their download page (clearly called out advertisements, no more than 3 on the page, only one above the fold, they don't interrupt the flow of the page, etc...)
- endemic 11y ago
  I have to say, props for doing your homework. At first glance, however, you have to admit that "HTZapps" seems a bit dodgy.
  - Klathmon 11y ago
    Why? It's no more dodgy than "FDroid"... Their home page looks like what i'd expect an app store's home page to look like, full of apps. There's not even any ads on the home page! And besides, i don't care what it looks like "at first glance". if you are going to call out someone's website as "malware" then you'd better do your damn homework first.
- discreditable 11y ago
  > You can't just call it "malvertising" when it's just not what you wanted... It's an advertisement which seeks to get users to download software from an unofficial source. The site does not provide links to the official sources. The advertiser has paid money to get users to go to their site instead of the official source. The advertiser seeks to misdirect users into visiting their site (which is loaded with ads) instead of the official one. I consider this misdirection to be malicious.
  - seangrant 11y ago
    By that logic, every mirror site with advertisements is malicious. Don't be ridiculous.
    - TeMPOraL 11y ago
      Are they official mirrors? Linked from the official site? If not, I'm not trusting them. Incentives are not aligned properly. Also notice, that the more ads are on such a site, the less trustworthy it is. Do you think CNET / download.com are good places to get your software from?
      - seangrant 11y ago
        CNET and download used to be, sure. Maybe not so much anymore. I'm just saying official or not, if the checksum matches - it's not malicious. End of story. You're correct though in that just randomly picking mirrors is a bad idea. I seriously doubt your average person is utilizing checksums.
        TeMPOraL 11y ago
        > I seriously doubt your average person is utilizing checksums. Sure, if you're utilizing checksums the way they should be then go ahead. But honestly, even I don't care that much - my ad-heuristic was sufficient so far :). I should probably start using them. I guess it's like with all things crypto - the UX sucks so bad that most people don't bother.

Klathmon 11y ago

You can't just call it "malvertising" when it's just not what you wanted... I just went and downloaded the app from that add and compared the checksum against the APK on my phone of the same version (version 42.0.2, downloaded from Google Play) They both match. (Both SHA256 checksums are D0B5A524ABFD5AD9D73DFF4DA398423CB7B337797FBA0C039F3A44CAE259B4B0, if you want to verify it from me as well) So that site is providing an untampered download of firefox, so there is no "malware" anywhere. In fact that site (HTZapps) seems to be a curated list of "safe" apps available to download, an alternative app store much like fdroid or the amazon app store. It even follows the Adsense guidelines on their download page (clearly called out advertisements, no more than 3 on the page, only one above the fold, they don't interrupt the flow of the page, etc...)

endemic 11y ago
I have to say, props for doing your homework. At first glance, however, you have to admit that "HTZapps" seems a bit dodgy.
- Klathmon 11y ago
  Why? It's no more dodgy than "FDroid"... Their home page looks like what i'd expect an app store's home page to look like, full of apps. There's not even any ads on the home page! And besides, i don't care what it looks like "at first glance". if you are going to call out someone's website as "malware" then you'd better do your damn homework first.
discreditable 11y ago
> You can't just call it "malvertising" when it's just not what you wanted... It's an advertisement which seeks to get users to download software from an unofficial source. The site does not provide links to the official sources. The advertiser has paid money to get users to go to their site instead of the official source. The advertiser seeks to misdirect users into visiting their site (which is loaded with ads) instead of the official one. I consider this misdirection to be malicious.
- seangrant 11y ago
  By that logic, every mirror site with advertisements is malicious. Don't be ridiculous.
  - TeMPOraL 11y ago
    Are they official mirrors? Linked from the official site? If not, I'm not trusting them. Incentives are not aligned properly. Also notice, that the more ads are on such a site, the less trustworthy it is. Do you think CNET / download.com are good places to get your software from?
    - seangrant 11y ago
      CNET and download used to be, sure. Maybe not so much anymore. I'm just saying official or not, if the checksum matches - it's not malicious. End of story. You're correct though in that just randomly picking mirrors is a bad idea. I seriously doubt your average person is utilizing checksums.
      - TeMPOraL 11y ago
        > I seriously doubt your average person is utilizing checksums. Sure, if you're utilizing checksums the way they should be then go ahead. But honestly, even I don't care that much - my ad-heuristic was sufficient so far :). I should probably start using them. I guess it's like with all things crypto - the UX sucks so bad that most people don't bother.