15 ms·
Bing has been serving up malicious Google Chrome ads for months
- nhkssol 8y agoBing makes it clear when a site is promoted by prepending "ad" to the search result. Other search engines such as DuckDuckGo and Google do the same. It is near impossible for Bing to manually review every advert so perhaps it would be beneficial for search engines to provide a way for users to report rouge promoted links, similar to how YouTube allows you to report its sidebar ads.
- chris_wot 8y agoReally? If I go to the site in Chrome, it tells me it's a malicious site. If they can do this, then I can't see why they can't handle it when serving out advertisements.
- sorokod 8y agoIf you roll with pigs, you are bound to get dirty , if you promote links for profit, your reputation may suffer.
- ravenstine 8y ago> It is near impossible for Bing to manually review every advert Why? Are there hundreds of ad campaigns being created per second?
- deleted 8y ago[deleted]
- nhkssol 8y agoIt would be possible to handle the quantity of ad campaigns, but not without false positives or missed fraudulent ads. If you paid a person or a team of people to remove adverts promoting fake websites, the person reviewing the advert would have to understand the product being sold, the company selling the product and the companies real website. For Chrome this may be easy, but for more obscure projects such as a cryptocurrency wallet or email client it'd be hard for a person to distinguish between real and fake continually over the course of an 8 hour work day. People who are searching for a product already understand that context and so will be able to make a less erroneous judgement on whether a promoted link is real or fake.
- deleted 8y ago[deleted]
- pavel_lishin 8y ago> It would be possible to handle the quantity of ad campaigns, but not without false positives or missed fraudulent ads. That calculus applies to just about everything.
- beager 8y ago> Bing makes it clear when a site is promoted by prepending "ad" to the search result. Other search engines such as DuckDuckGo and Google do the same. They very specifically do not make it clear, they (and I mean all of them) intend to make sponsored results look as identical as possible to organic results to improve the likelihood that you'll click them. They only have subtle markings showing that they're ads because if they didn't, such an abuse of trust would be ruinous to any search engine. What's even worse here is that in the linked video, the Bing ad shows the domain as `google.com`, which is something you expect to be accurately represented in any listing, organic or paid. That's the sort of thing that should be ruinous to Bing.
- vezycash 8y ago>the Bing ad shows the domain as `google.com There's a reason for this - ad tracking for conversion, performance or even to make sure the advertising network is honest. The ad tracking domain is not always the same as destination domain. AFAIK, this problem seems easily solved. All Ms has to do is flag ads whose displayed URL do not match the final URL for manual review. Or simply ban it.
- larkeith 8y agoThis does not excuse displaying false information, especially when that information misleads users into downloading malware.
- greglindahl 8y agoBing and Google have always paid a lot of attention to the "landing page" for search ads, and they have a lot of technology to make sure that the landing page for an ad doesn't change after they've reviewed it. Still, fraudsters have ways of changing the landing page to something different. In this case someone seems to have successfully convinced bing that the landing page domain is google.com -- it's unlikely that it's "easily solved". Or that the next one will be easily solved.
- Sephr 8y ago> All Ms has to do is flag ads whose displayed URL do not match the final URL for manual review. Or simply ban it. The ad did match the final URL, it just selectively redirected to the legitimate or malicious page based on user agent. See https://twitter.com/sephr/status/1055751684146655232?s=19 https://twitter.com/sephr/status/1055751684146655232?s=19
- vezycash 8y ago>It is near impossible for Bing to manually review every advert I don't agree with this. Reviewing ads should be a straight forward process, much more so than reviewing an app submission. Plus, obvious issues can easily be automated, reducing the load of manual reviews.
- mikeash 8y agoIt’s easy for Bing to manually review every ad. What’s hard is manually reviewing every ad while maintaining their current prices and profit margins.
- pavel_lishin 8y ago> perhaps it would be beneficial for search engines to provide a way for users to report rouge promoted links You're absolutely right - it would be beneficial for them to dump their responsibility on the end users.
- NelsonMinar 8y agoGoogle Adwords has the same problem but, um, much bigger. They manage to review ads and mostly prevent malware much more successfully than Bing does.
- greenyoda 8y agoThe title of this article is deceptive clickbait.[1] The problem has nothing to do with the Edge browser, it has to do with search results returned by Bing, which happens to be Edge's default search engine. If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? So "stop using Edge to download Chrome" is not useful advice. Better advice would be to check the URL and certificate information before downloading anything from any site. And the problem seems to have been fixed. When I search for chrome download on Bing, the top result is https://www.google.com/chrome https://www.google.com/chrome. [1] Successful clickbait, too. Writing an article with "download Chrome" in the title apparently got them the top spot in Bing's "News about Chrome Download", so anyone who searches for "chrome download" will see this article near the top of the search results page. Very clever.
- chris_wot 8y agoIt's not irrelevant. Bing is what Microsoft chooses to use a default search engine. Edge does not warn of a malicious website. Chrome and Firefox do. This has everything to do with Edge.
- ocdtrekkie 8y agoThis is an ad I once saw on Google Search which worked the same way: https://plus.google.com/u/0/115181074626403443464/posts/fSPmYYLu2pH https://plus.google.com/u/0/115181074626403443464/posts/fSPm... As I noted back in 2017, Edge flagged the destination site as malicious, Chrome did not. Warning on malicious websites is, in fact, done in Edge. But as with Chrome and Firefox, it doesn't catch every one of them.
- flipp3r 8y ago> And the problem seems to have been fixed. When I search for chrome download on Bing, the top result is https://www.google.com/chrome https://www.google.com/chrome. Which could be faked, as seen in the referenced tweet: https://twitter.com/GabrielLandau/status/1055300918101598208 https://twitter.com/GabrielLandau/status/1055300918101598208 Yes, they show the word "Ad", alongside the domain name "google.com" - except the user doesn't end up on "google.com".
- natuz 8y agoThis has been happening for so long that it's hard to believe Microsoft is not aware of it.
- ocdtrekkie 8y agoGiven the malware Google's ads also ship, which Googlers here on HN have tried to have removed only to return an hour later, suffice to say malicious ads are an industry pervasive problem, and the solution is to kill the online advertising market. Aggressively. In fact, when I tried to look for a specific class of malicious ads (looking for "mapquest") recently, DuckDuckGo was even as bad as Google, it was Bing who gave the least malicious results. But obviously they've failed here. Automated advertising platforms have been overrun by malware and no automated solutions are going to fix it.
- derekp7 8y agoOne solution that would go part way there is signed for browsers to only run signed javascript when it originates off site. Common libraries that are distributed via CDNs can be signed, and any javascript that ships with ads would have to be signed too. And any CA that signs too many malware (too many meaning more than one) gets their cert revoked.
- jamieweb 8y agoNowadays it's impossible to support the creators you enjoy online by whitelisting ads without exposing your device to multiple megabytes of untrusted, vulnerability-filled JS and iFrames with links off to malware sites. I think that the sponsorship model many YouTubers use these days works really well, because there isn't any code involved that I have to run.
- ocdtrekkie 8y agoYeah, there's a few YouTube creators and a few coders I've added to Patreon from time to time. I'd much rather toss someone a dollar a month than watch a dollar worth of ads, where 70 cents goes to a FAANG company.
- jamieweb 8y agoUsing browsers to download software should never have become the standard practice... Linux got it right with the built-in package repositories. Unfortunately Windows and Mac have never really adopted the super-easy "apt install this" style.
- redial 8y agoHow would you know what "this" should be without using a browser?
- s3m4j 8y ago1. You search info about "this" in your browser 2. You install "this" with your package manager 3. Even if the "this" installed wasn't the "this" you read about in your browser, it still came from your package manager repos, which you could consider safe, and you'll be able to uninstall it cleanly. Then I look at the Windows Store and weep.
- orev 8y ago“apt search this”
- Xylakant 8y agoapt search chrome. Good luck with that on a default Debian install.
- jamieweb 8y agochromium-browser is the one. Although on Ubuntu it's in the Universe repository, so you have to add the chromium-team ppa in order to get on-time updates. I will admit that Chrome/Chromium is one of the few things you can't easily get from the repos, on Ubuntu at least.
- Xylakant 8y agoSo how does that prevent a malicious PPA or repo that the attacker could push up in the search rankings? Just like the attacker here pushed up a malicious download page in the search rankings?
- vijaybritto 8y agoThis was bing's shit to begin with. Anyway no one ever uses it. This is serious but limited in attack surface I would say. BTW: forbes can fuck off with their auto play videos shit. Even on mobile. Who really thinks this is a good strategy?!!?
- sparkpeasy 8y agoNo one uses Bing.... except every user of Windows 10 by default
- a3n 8y agoIndeed. Any poster on HN should consider that, relatively speaking, we are the no one.
- quickthrower2 8y agoExcept me, I am on HN and I use Bing.
- jccalhoun 8y agoMe too. I've made at least $50 in amazon gift cards from bing rewards.
- dunpeal 8y agoMicrosoft back to its old tricks, I see.
- michaelmrose 8y agoSo basically Microsoft's browser isn't even safe to use temporarily to download a real browser. In 2018 can we stop pretending that any web browser is a safe effective way to acquire any software. While it can be done people have been consistently getting pwned for decades now. Software should be distributed via apps stores. Preferably vetted lists as opposed to free for alls you can post malware to for $25. Linux has been doing this correctly for a long time. Any time you guys at Microsoft want to rip this off properly would be absolutely fantastic.
- jamieweb 8y agoThe scariest thing about this example is that the green "URL" below the ad says "www.google.com". Who thought it would be a good idea to allow advertisers to fake the URL like that? Unless it's an IDN homograph attack?
- ocdtrekkie 8y agoThe issue here is a broken functionality that I've reported on before with Google Ads which Bing mirrors: Allowing advertisers to lie about the destination URL of their ads. Here's a screenshot of the same exploit on Google: https://plus.google.com/u/0/115181074626403443464/posts/fSPmYYLu2pH https://plus.google.com/u/0/115181074626403443464/posts/fSPm... (The included hijack was blocked as a malicious site on Edge, but wasn't on Chrome.) Ads should always be forced to display in the URL text the actual URL the ad directs the browser to. Maybe as a side bonus, less tracking URLs will get used to keep it looking cleaner.
- a3n 8y agoAds considered harmful.
- michaelmrose 8y agoPerhaps since MS makes only a tiny minority of their income from ads they can ship an effective adblocker with their default browser. It could be great opportunity to lead the market in a customer friendly way.
- greglindahl 8y agoAll of bing's revenue comes from ads. Somehow I don't think Microsoft is planning on disabling bing ads in the Windows default browser.
- ledriveby 8y agoToo bad Edge doesn't support Safe Browsing mode. IIRC the API is publicly available too; MS doesn't want to swallow its pride and implement a client for it.
- beagle3 8y ago.. and that's why running an ad-blocker these days is not even a moral question; It's proper hygiene. I don't eat without washing my hands first, and I don't browse without an ad blocker.
- pavel_lishin 8y agoBut if you don't eat with filthy hands, you'll be putting antibiotic content creators out of business!
- gpm 8y agoAlso your immune system - which might be a bit of an issue.
- jakear 8y agoThis metaphor is actually quite apt. If you aren’t accustomed to mentally filtering out ads from content, you may be more likely to be swayed by sponsored content and the like.
- pavel_lishin 8y agoSure, but in this particular metaphor, we don't sterilize our environment, but still wash our hands on a regular basis.
- fjsolwmv 8y agoSponsored content isn't the main problem here. All content is opininates. The problem is anonymous 3rd party malware running on a site.
- EForEndeavour 8y agoIn my experience, whenever I browse without an ad blocker (e.g., someone else's computer), the flurry of intrusive ads shocks me out of information-absorption mode, and just prompts me to think about how best to suggest to the computer owner that they use an ad blocker.
- partycoder 8y agoWhat you get for using Mediocresoft products.
- simongr3dal 8y agoI never quite understood the appeal of giving some unknown third-party the right to put links and text and javascript onto your site. It might be labour intensive to have human eyes on every ad that is sold when you're at Google, or even Bing, scale. But it seems a little bit too hands-off, and irresponsible, to take money without vetting the input and then letting every scammer get into that very "blessed" and visible top spot of a search page. If you want something done right, do it yourself. You can't expect scammers to not to be scamming.
- arminiusreturns 8y agoI spent some time trying to understand googles ads and seo structure for a project, as a sysadmin. My conclusion was the reason greyhat and blackhat techniques werent dealt with was because they make too much money from it... I wrote a big report on it, but that was the gist. Im sure the same is true of MS et al.
- solarkraft 8y agoIf the report is public, would you link it?
- arminiusreturns 8y agoIts not, sorry, I dont even have a personal copy, but it could be worth redoing it publicly on my own.
- mikeash 8y agoA lot of tech company woes come down to an insistence on automating things that really need human attention. Your recommended children’s videos are actually disturbing parodies? Easily solved with human curation. Some Alex Jones story makes its way into your news aggregator? Having people check the story would fix this. Scammy or malware-ridden ads on your site? See above. Obviously this isn’t practical for everything, but tech companies take it way beyond what’s necessary, then act like the problems are impossible to avoid.
- 8y ago
- Sephr 8y agoExplanation for the spoofed domain name: https://twitter.com/sephr/status/1055751684146655232 https://twitter.com/sephr/status/1055751684146655232 Bing can easily fix this domain spoofing vulnerability. I've reported this vulnerability to MSRC previously but received no response. This is also why open redirects can be so dangerous. Even if this domain spoofing vulnerability is fixed on Bing's end attackers can abuse open redirects to achieve the same result.
- nielsole 8y agoI don't think they will fix the underlying issue now. I've had the same issue ( literally trying to download chrome) in 2014. Now that they have public pushback they will fix just this ad placement. I wonder what makes them think this is acceptable.
- OliverJones 8y agoIt's possible to install Google Chrome on a Windows box with chocolatey, the Windows answer to apt and brew. But, still, Microsoft's browsers still aren't good. In my workplace (where we do some complex cross-browser work) they're an enormous nuisance to development and QA. I wish Edge were far better than IE, but they're both quirky. Firefox and Google Chrome ordinarily work predictably. Safari has a few quirks, Edge is really quirky, and IE is a narrow gauge steam train, all different. Why doesn't Redmond stop throwing good money after bad and just license Firefox? Are they stuck in the sunk-cost fallacy?
- discreditable 8y agoChocolatey is very handy but has a few warts. It can't tell if the underlying app has self-updated. When Chrome autoupdates after choco install, the next time you run a choco upgrade, it will unnecessarily upgrade Chrome again.
- kayone 8y agotake a look at appget, we use windows itself as the source of truth. so even if an app self updates, or you have installed the app manually or even using chocolate, appget will know the _currently_ installed version. also, we don't run some random PowerShell script written by god-knows-who on your machine. All installs are driven by pure data, so the only thing you need to trust is the appget client itself. e.g. https://github.com/appget/appget.packages/blob/master/manifests/slack/slack.yaml https://github.com/appget/appget.packages/blob/master/manife...
- beatgammit 8y agoMicrosoft wouldn't even need to license Firefox, they could build their own browser on top of it and do minimal work. They already do that on Android (Chrome) and iOS (Safari), and once GeckoView stabilizes, they can even use that on Android. However, I think it's more of a branding thing. Microsoft wants a complete experience when you install their OS, and they want something that will keep users on that platform. If they build IE, they can control the platforms it runs, which means users will feel uncomfortable on anything else.
- azifali 8y agoUnfortunately the problem is not with Bing alone. There are multiple ad networks including admob owned by google, who will serve a url, or sometimes a script for an ad. That is unfortunately just how advertising works. The industry never matured (to handle spam, malicious content or fraud) thanks to the Duopoly of Fb and Google, and even the biggest players are not immune to these issues as the onus is on the user to not to click on ads that offer to upgrade browsers, or any system software through ads. It is the same systems that served malicious election results, the same systems that contributed to the echo chambers that impacted recent elections.
- wtracy 8y agoIronically, this should have been an opportunity for Bing to differentiate themselves: Create a "safe" ad network that is not a vector for drive-by downloads or privacy violations, and go after publishers that are being hurt by ad blockers or experiencing reputation damage from security breaches.
- pishpash 8y agoGiven the cutthroat short term metrics these companies' employees operate under, do you really think such strategic thinking would have ever been incentivized? It's a question whether any salutary effects can even be reliably defined and measured to justify such a project to your boss.
- AzzieElbab 8y agoBing is likely to return spam and scams on any search. There is no conspiracy against Chrome.
- userbinator 8y agoIncidentally, the relative lack of filtering/censorship also means I've had far more luck "Binging" obscure/fringe/questionable-content sites than with Google. I suppose them receiving fewer DMCA takedowns also contributes.
- AzzieElbab 8y agoI guess there is an upside to everything. I would definitely use bing if I wanted to compile a list of scammers or something along these lines
- the_clarence 8y agoFWIW Google also returns malicious chrome ads. My father had a brand new laptop and the first thing he did was to google chrome. He got a bunch or malware by clicking on the first link.
- EpicEng 8y agoThere was a short time about seven years ago when Google was returning a malicious link for Blizard's BattleNet. Had my WoW creds stolen and I wasn't what you would call naive on a computer.
- bhauer 8y agoThat sucks. I know it's a tired point, but it nevertheless amuses me that someone would search for BattleNet. The name is literally the domain name: battle.net.
- slavik81 8y agoThat's not an assumption you can make in general. For example, paint.net is not found at paint.net.
- sp332 8y agoOk but there's no way to know that without searching. Unless you have one of these https://mobile.twitter.com/PulpLibrarian/status/844278365590863874 https://mobile.twitter.com/PulpLibrarian/status/844278365590...
- gpm 8y agoI mean, you could guess. The name even hints at it for anyone aware of the `.net` tld. That's not a great solution, since many people are barely aware what at url is, but I think it should still be one that you and I (as people who are) use. Similarly the article is fixed by guessing that google chrome is probably at chrome.google.com (also chrome.com), firefox is probably at firefox.com, cnn is probably at cnn.com, gmail is probably at mail.google.com, gmail.google.com, or gmail.com (actually all 3), hacker news is probably at hackernews.com (oops), etc.
- Tsubasachan 8y agoI am always amazed people actually fall for these.
- codedokode 8y agoI remember when several years ago I typed "download Flash" in Russian Google, there were non-official sites in top results. Now Adobe's site is the first result. Also I tried to experiment a little. If I type "download flash player" in Russian, official Adobe site is only on the 3rd position [1]. The first and second results are "adobe-flash-player.ru.softonic.com". [1] https://www.google.com/search?q=%D1%81%D0%BA%D0%B0%D1%87%D0%B0%D1%82%D1%8C+%D1%84%D0%BB%D0%B5%D1%88+%D0%BF%D0%BB%D0%B5%D0%B5%D1%80&btnG=%D0%9F%D0%BE%D0%B8%D1%81%D0%BA&gbv=1 https://www.google.com/search?q=%D1%81%D0%BA%D0%B0%D1%87%D0%...
- kerng 8y agoThis is another reason why the ad business is flawed.
- rustcharm 8y agoThis one is especially bad, but there's a major problem in general. I have to constantly warn people not to "google" for printer drivers or video drivers, etc, because the links they'll get from any search engine are almost certain to be malware.
- zawerf 8y agohttps://www.youtube.com/watch?v=g-U7a04GTpk https://www.youtube.com/watch?v=g-U7a04GTpk
- vxNsr 8y agoI usually use ninite to set up first time downloads, it's great because you can just run it again every couple weeks to make sure all your software is up to date. It avoids using malicious options accidentally and it also means I don't need to go through each installer. Plus I can just send the file to friends and family when they get a new comp. edit: just wondering why people disagree with this idea?
- holri 8y agoThe real problem here is that a system allows users to install unsigned software.
- porlune 8y agoFrom the article: >>> The download itself is called "ChromeSetup.exe," but examining the digital signature reveals "Alpha Criteria Ltd." >>> It was signed, but most users won't catch that it's signed by the wrong party.
- emmelaich 8y agoI mentioned this in a comment over a year ago in a story about paint.net. https://news.ycombinator.com/item?id=14338174 https://news.ycombinator.com/item?id=14338174 > The Bing search engine is about as bad. A close friend used IE to get Google Chrome. They clicked the first result and luckily I was able to stop them before starting the install on some crapware. So I asked them to be careful to ensure the download site is correct and left them to it. I came back to find they had downloaded some other crapware. I checked the search results. The ENTIRE first one and a half page of results were advertisements for versions of crapware which may or may not have been Chromium or Chrome lookalikes with lots of malware.
- baud147258 8y agoI've just checked on bing with IE and the first results are: - ad by Google for Google Chrome - ad by Mozilla for Firefox - 2 result on Google's site - one download site (didn't check if it's crapware) - two wikipedia links - the same ads at the tops
- kup0 8y agoIn one case, I saw where it looked like an ad by Google for Google Chrome- but once clicked, it actually led elsewhere (to a very well-constructed fake Google page)- even though on the result page the URL looked legitimate
- amarant 8y agoMakes me wonder how Microsoft ranks search results. Surely if they were counting links to a page from other pages (like Google does), Google would've come out on top? Or does noone link to Google anymore since people tend to find their way there anyway?
- nl 8y agoAds aren’t ranked like pages.
- 8y ago
- bencollier49 8y agoHave to say, I was looking for a way to get away from Google, and I found that Duckduckgo's results didn't work for me. Bing, though, does the job nicely.
- SyneRyder 8y ago+1 here. I switched to Bing back in April when a Google algorithm update really trashed Google's results for me (it felt like I'd suddenly gone back to the days of Altavista & HotBot). At first my switch to Bing was out of spite, but 6 months later I'm still using Bing & I love it. I really like how it breaks out code snippets for StackOverflow results, for instance. So it's frustrating to see Bing hurt their reputation with something as stupid as this. If Microsoft want more people to switch, they've got to be at 100% in all areas, they can't afford to let Bing Ads ruin the whole service.
- red_admiral 8y agoIt always used to be fun to count how many malware sites appeared before the real one when you searched for "download vlc" with yahoo. They've fixed that one now, but in 2017 it was still definitely a problem.
- weinzierl 8y agoCall me paranoid, but every time I install software on Windows [1] I do the following dance: 1. Search for the name of the software on Google [2]. 2. Open link to software in separate tab. 3. Open Wikipedia link (usually on the same SERP) for software in separate tab. 4. Compare domain name from direct link with the domain name from the Wikipedia article. 5. Open another tab and type domain name manually. 6. Find download link manually on domain[3]. I do this since a family member got burned badly by a malicious OpenOffice install many years ago. [1] Sometimes I do it on Mac too, because the App Store has it's own issues (e.g. upgrades are often cheaper if you buy software directly). On any other system I use the package manager. All of this makes the effort bearable because I only have to do it rarely. [2] I'm usually on DuckDuckGo, but for this I always used Google. The reason is that I had hope that they'd remove malicious results quicker. It's manual work after all and Google has more resources. This whole thread makes me doubt though. [3] I'd do this anyway because I usually don't want to install the version that is automatically suggested, but decide myself which specific version I want to install. Most of the time the reason is the language.
- 0xfeeddeadbeef 8y agoI would also add: 7. Scan installation package using VirusTotal (Ignore ClamAV and Chinese A/V results).
- jobigoud 8y ago> 5. Open another tab and type domain name manually. I think this point is vulnerable to typosquatting and could actually reduces the overall security of your approach. I would say if the Wikipedia link matches the search engine link you are good to go.
- weinzierl 8y agoMy reasoning is that someone could change the Wikipedia link to a look-alike domain and that this could easily go unnoticed for some time. Even if the domains visually match they don't need to be identical (Unicode Confusables [1]), but the plain ASCII version that I can type on my keyboard is probably the right one. [1] http://unicode.org/cldr/utility/confusables.jsp http://unicode.org/cldr/utility/confusables.jsp
- xmodem 8y agoI often dig into phishing and malware spam I receive, reporting it to the abuse@ address for the sending network, and reporting any links hosting malware. I frequently come across malware hosted on onedrive and I've stopped bothering to try to report it, its still there months later and I've never received a response from Microsoft.
- nobody271 8y agoIt looks like they've fixed it but a few months ago I googled "Microsoft Customer Support" and the top results were all to obvious scam sites.
- iamgopal 8y agoFor the all the shit Google taking lately, we should give them a big shoutout when their own cloud pages and other product pages rank way down in their own Google search ranking.
- JCSato 8y agoThe argument to ditch Windows felt kind of shoehorned in. If Bing is returning malicious search results, that's a reason to stop using the search engine, _not the whole OS_. The October update fiasco is a reason to stop using Windows. These are separate issues in separate projects made by separate teams, happening at separate times. The implication is that everything MSoft touches is insecure or otherwise out to get me is weakly supported. It may or may not be true, but a quick toss in of one data point about how Windows is bad and oh by the way Ubuntu is better isn't convincing.