13 ms·
Is Firefox lying to users about viruses in downloads?
- morganvachon 8y agoSite is down, archive.org cache here: https://web.archive.org/web/20180704124718/https://www.theindy.us/is-firefox-lying-to-users-about-viruses-in-downloads/ https://web.archive.org/web/20180704124718/https://www.thein...
- woofcat 8y agoIt's dead Jim... https://webcache.googleusercontent.com/search?q=cache:https://www.theindy.us/is-firefox-lying-to-users-about-viruses-in-downloads/ https://webcache.googleusercontent.com/search?q=cache:https:...
- Piskvorrr 8y agoSpoiler: no, sometimes flags safe content from shady sources.
- moepstar 8y agoSaved me some time reading, thanks (also, Betteridge's Law)... Guess it's the same for IE - i've had a few issues with executables that probably don't see many downloads... ...no, i don't use it voluntarily - but sometimes have to at work...
- klez 8y agoIn my book, flagging as malware something that is not malware is lying, or at least a false positive. So, spoiler: it's a bit more nuanced than "yes" or "no".
- ska 8y agoIn my book, there is a lot of distance between "lying" and "false positive"
- klibertp 8y agoWhich really shrinks when it's about presenting the known-failible process as 100% reliable, which the wording/UX seem to suggest in this case. I can understand the reasoning behind this, I've seen it done multiple times to my own projects by the UX guys. I don't really know if it's net-positive strategy or not, but the fact that there is a lie involved at some level is undeniable. At least to those who didn't drink too much Kool-Aid and don't think the average user is too stupid to comprehend the truth, and therefore that it makes no sense to present it to the users. I may be biased in the other direction, but every time I see a discussion about "dark patterns" in UI I get a feeling that they differ from the "light" ones only in what is the goal of the manipulation, but with methods surprisingly similar on both sides.
- yjftsjthsd-h 8y ago... so, materially yes? As a user, I don't care that they have an excuse, I care that they said "this file is a virus" when the file was not a virus.
- Piskvorrr 8y agoNot really. "Lying" includes an intent to deceive. I would have been okay with "raises false alarms", "generates false positive" or even "confuses and/or misleads users". As a user, I want to be better safe than sorry - but would perhaps be happier with a finer classification than "no problem/OMG VIRUS!"
- themarkn 8y agoI agree that finer classification is needed. However: if you decide to declare to a user that every individual file that might contain a virus does contain a virus, that's intentionally deceiving them. It's deciding "X% of the time, this statement will not be true, and we are ok with that" instead of building the uncertainty into the statement itself. So I don't see how this can not be considered lying, unless they believed there would be no false positives.
- xg15 8y agoUntil the moment where you really need that file.
- howard941 8y agoThis. Firefox has become far more aggressive in policing use. For ex., if HTTPS is misconfigured 60.0.2 no longer offers an option for one time exceptions, now there's only 'get me out of here' and 'report to mozilla' buttons. Perhaps someone more familiar with ff's config knobs will post the knob name.
- Liquid_Fire 8y agoI'm running 60.0.2 and I still have the option to add an exception, under "Advanced". What you describe only happens when the site is so badly misconfigured that no connection is possible (e.g. protocol errors).
- sus_007 8y agoFirefox isn’t necessarily scanning the files for viruses, they’re often just using databases that list domains suspected of hosting malware. IIRC, Chrome does the same thing too. I think it's not much of an issue for Firefox to flag stuffs downloaded from suspected URLs as a malware since it's not uncommon to have one's system infected from those sites' content. Firefox is just trying it's best to prohibit any sort of system infection through itself.
- yjftsjthsd-h 8y agoThen (as the article suggests) Firefox should actually tell the user that it is the site that is untrusted and not the file, and allow the user to save it so that they can actually scan it themselves.
- klez 8y ago> Firefox is just trying it's best to prohibit any sort of system infection through itself. In that case I would change the wording from "contains malware" to "may contain malware". Also, they're prohibiting nothing. They still give you the option to open the file (which, as explained by the article, opens a whole different, albeit small, can of worms)
- Viliam1234 8y ago> In that case I would change the wording from "contains malware" to "may contain malware". Or even more precise: "may contain copyright infringement".
- mc32 8y agoI wonder why they can’t integrate some service like VirusTotal into their downloader. Sure, for heretofore new objects it’ll take longer, but they have a long list of many many file hashes and their reputation dB .
- chmod775 8y agoBecause I don't want Firefox to send what I download to some (third party) company. Or anywhere for that matter. Their (and chrome's) current solution to block malware domains use a client-side bloom filter afaik. If you'd try to build the same client-side into firefox, you'd have just built another (bad) antivirus software. Might as well integrate clamav into firefox then.
- MaxBarraclough 8y agoI recently stumbled across just such a false positive, in the NextCloud showcase, no less. Not much they can do about it, as far as anyone can tell. https://github.com/nextcloud/server/issues/9916 https://github.com/nextcloud/server/issues/9916
- hashhar 8y agoThis is how every other browser does it too. I'd be more alarmed if my browser had an inbuilt antivirus.
- Trellmor 8y agoLike Chrome? https://motherboard.vice.com/en_us/article/wj7x9w/google-chrome-scans-files-on-your-windows-computer-chrome-cleanup-tool https://motherboard.vice.com/en_us/article/wj7x9w/google-chr...
- Spivak 8y agoYou would be alarmed that the largest attack vector decided to build in a system to detect attacks?
- rileymat2 8y agoIt would be an interesting experiment to see if being direct and clear but at times inaccurate protects more novice users than being a little more wishy washy but accurate.
- yodon 8y agoIf only the voting public understood about statistics, false positives, and false negatives. Even if Firefox did a full virus scan, there would still be false positives and false negatives in the results. The system designer always has to put their reporting threshold somewhere, and that always means making a decision to bias towards false positives or false negatives. Eliminating false positives means exploding the number of false negatives. Unfortunately, people like the OP don’t understand this, and yell angry things like “Firefox is lying to me!” Others here suggest FF should inject a bunch of weasel words like maybe and could and might. That’s a seemingly rational thing to do if you believe you’re informing a customer population that understands things like false positives and false negatives, but we have pretty clear evidence that they don’t. So FF makes a conscious informed decision to prefer reporting false positives over false negatives and then allows the user to override if they believe they know enough to do so. Sure, there are some costs to false positives, but they are dwarfed by the cost of false negatives.
- rileymat2 8y agoI would suggest it might also force some sites to more actively police their site for malware to get off of the list.
- xg15 8y agoAnd if only developers understood UX. The "lie" the author was complaining about was that Firefox is miscommunicating what it did: It warned that a concrete file was containing malware when it actually found a suspicious domain. Depending on context, that might make a huge difference - e.g., if a user got such a warning for a file they uploaded themselves, they might get the wrong impression that their system is compromised. As the author noted, simply describing the actual threat would clear this up. > Sure, there are some costs to false positives, but they are dwarfed by the cost of false negatives. This strategy has blown up a number of times already. If you present too many false positives, users might lose trust in you and ignore your predictions altogether.
- deathanatos 8y ago> And if only developers understood UX. I've upvoted you, since I think your point is good, I'd just add that as a developer, I've found myself on more than one occasion pushing for the type of UX being advocated here, and getting pushback from designers/PMs. Typically, the issue I run into is a desire for the UX to be "simple", sometimes simpler than the system underlying it actually is (or is even capable of being), and so instead of clear and correct messaging, you get simplified and incorrect messaging. (My current example of this would be ZIP codes. People like to simplify them to a geographic area in their heads, and then think of them as polygons, and then from there, think you can ask "is this lat/lng inside this ZIP?"; ZIP aren't polygons (they're defined as segments of roads) so answering that question requires approximations; those approximations are sometimes wrong.)
- beezischillin 8y agoI'm not as bothered by the main point of the article but it does raise an interesting point that was missed by the comments so far is near the end: If you're flagging files as potentially harmful, giving a user a choice to either execute it or delete it is kind of bad design!
- huhtenberg 8y agoNo, it's not "bad design". If there's an uncertainty in detection, there are false positives and letting the user decide is the only correct option. Edit: Nevermind. Re-reading the article - they should indeed allow saving the file in addition to deleting or opening it.
- jkirsteins 8y agoThe implied better alternative is to allow saving, instead of opening, so users can scan the files themselves.
- deleted 8y ago[deleted]
- lucb1e 8y agoSo it's whatever list they use of malware hashes that's the issue, not Firefox, right? It's probably publishers that are adding their pirated works to it, not Mozilla. Or does Mozilla maintain it themselves for Firefox in particular?
- davidsong 8y agoThere are several ebooks that have been uploaded to libgen that contain PDF exploits, and from what I understand there's no way to remove them. The way that their library database works is by linking a book number to a file's md5 sum. On the filesystem they are stored something like `$drive:\$batch\$sum` where `$drive` is a Windows drive letter, `$batch` is the primary key of the document rounded to the nearest 1k, 10k or 100k depending on collection and `$sum` is the `md5sum` of the file data. The archive's file data is shared via torrents, usenet and other means in those batches, and to keep that in sync they have a policy of the primary key and sum of each file being immutable. So if you do happen to download the literary works of mankind via their torrents, you have to do so with your antivirus turned off and hope nobody has uploaded anything too illegal over the last decade.
- mediocrejoker 8y agoI could be wrong but I think technically a PDF exploit only affects a single viewer program, like Acrobat on windows, right?
- davidsong 8y agoWell yes, and in this case we're talking files that contain an exploit for a version of Acrobat from 2006 or so and an infection vector that only works on Windows XP, and connects to a botnet that is either long dead or now an NSA/CIA asset. But Windows Defender quite rightly still quarantines the file.
- heathl 8y agoIt would depend on the exploit. For a simple example, an exploit that was a result of a flaw in the file specification could result in it being cross platform. It's going to be rarer to find something of that scope, maybe even to the point of you being effectively right.
- davidsong 8y agoAlso dodgy files can contain multiple exploits, potentially for different platforms. Problem here from the malicious actor's point of view is that each vector for attack is also a vector for detection, so rather than a cesspool of exploits it makes more sense to use single new and mostly unknown exploit that targets software used by the greatest number of victims.
- pjc50 8y agoI'm now wondering what happens if I start posting the string "X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" to various places. Would it result in the site getting flagged?
- shittyadmin 8y agoIf anyone else doesn't like this behavior of sending hashes for everything you download to Google, set: browser.safebrowsing.malware.enabled=false And if you don't want phishing warnings either: browser.safebrowsing.phishing.enabled=false
- owly 8y agoWho cares? Flagging sites probably provides an overall benefit for people to be careful on sites where viruses have been detected. People pirating books will still download them ‘cause if they are on a know pirate books site they’ve already accepted some risk. People who don’t know what their doing will still get infected.
- klez 8y agoIn part I agree, but then again, it can become a problem à-la windows security prompt, where people have learned to basically ignore it and give permission to mostly anything. In other words, in my opinion, don't cry wolf unless there's an actual wolf, or at least something that could reasonably look like one.
- daviddahl 8y agoThe history of Google's "SafeBrowsing" with respect to Firefox is a real mixed bag. The privacy protections Mozilla asked for from Google were begrudgingly implemented. As a Linux user, I used to just turn it off.
- franga2000 8y agoI agree that straight up calling it a virus is wrong. "This file comes from a suspicious source and might be dangerous" would be much better wording. Enough to make the user cautious, but not scare the shit out of them (yes, I've literally seen people jump out of their seats and scream when they saw a virus warning).