4 ms·

> Google needs to actively monitor all extensions for ad injection and tracking code (where are their AI experts on that?) All the AI experts in the world won'

by hannob 10y ago

> Google needs to actively monitor all extensions for ad injection and tracking code (where are their AI experts on that?) All the AI experts in the world won't be able to solve the halting problem. What you're asking for is impossible.

nitrogen 10y ago
All the AI experts in the world won't be able to solve the problem of people thinking a problem is equivalent to the halting problem. You don't need perfect performance, you only need to stay ahead of most of the attempts. Fighting fraud is similar -- it's not possible to stop 100%, but you can get close, and try to make it easy to minimize/undo the damage done by the false negatives.
- codedokode 10y ago
  You are probably over optimistic about what AI is. AI is not a human-like mind that sits inside a computer and solves any problem you give.
  - nitrogen 10y ago
    I am aware :). But don't you think that a finer grained permissions model, combined with even a simple Bayesian classifier (or a NN classifier) that triggers manual review, could catch a lot of suspicious extensions? E.g. P(malware|reads url+calls third party) > P(malware)
    - codedokode 10y ago
      There will be ways to bypass those checks. The easiest is to wait a week after installation before doing anything bad. Or extension could download and execute code from remote server that would serve one version of code for users from Mountain View and another version to everyone else. Or the code could check whether it is run on a real device.
      - nitrogen 10y ago
        This is where the classification heuristics and fine-grained permissions come in. Code that does anything conditioned on dates is higher risk. Code that uses location services is higher risk. Also, many of these checks can be done by the browser in situ, so an extension that suddenly changes its behavior can be flagged for review. And pre-release malware scans can be run on banks of actual hardware that simulates different dates and locations. Sure, there will be an arms race, but that's better than an anarchical free for all.

by hannob 10y ago

nitrogen 10y ago

All the AI experts in the world won't be able to solve the problem of people thinking a problem is equivalent to the halting problem. You don't need perfect performance, you only need to stay ahead of most of the attempts. Fighting fraud is similar -- it's not possible to stop 100%, but you can get close, and try to make it easy to minimize/undo the damage done by the false negatives.

codedokode 10y ago
You are probably over optimistic about what AI is. AI is not a human-like mind that sits inside a computer and solves any problem you give.
- nitrogen 10y ago
  I am aware :). But don't you think that a finer grained permissions model, combined with even a simple Bayesian classifier (or a NN classifier) that triggers manual review, could catch a lot of suspicious extensions? E.g. P(malware|reads url+calls third party) > P(malware)
  - codedokode 10y ago
    There will be ways to bypass those checks. The easiest is to wait a week after installation before doing anything bad. Or extension could download and execute code from remote server that would serve one version of code for users from Mountain View and another version to everyone else. Or the code could check whether it is run on a real device.
    - nitrogen 10y ago
      This is where the classification heuristics and fine-grained permissions come in. Code that does anything conditioned on dates is higher risk. Code that uses location services is higher risk. Also, many of these checks can be done by the browser in situ, so an extension that suddenly changes its behavior can be flagged for review. And pre-release malware scans can be run on banks of actual hardware that simulates different dates and locations. Sure, there will be an arms race, but that's better than an anarchical free for all.