4 ms·

Well, here goes... I'm "investing" $20 for the rest of HN to find out how accurate it is. Okay so it's scanning... it has found a bunch of development things,

Well, here goes... I'm "investing" $20 for the rest of HN to find out how accurate it is. Okay so it's scanning... it has found a bunch of development things, gifs from my website work which isn't porn -- recycle binned stuff -- okay watching this, it's just bringing up every single file that contains a list of extensions; it's included under "videos" things like "DVDMaker sample" which certainly aren't porn. I don't think "passwordField.png" located in programData/skype is pornographic. The websites it has found don't appear to be any I have ever visted, although some are (and they're popular sites) about half aren't. Either it's fabricating the websites or I've visited sites that embed data from these other sites? Plausible I guess. What an awful product, albeit effectively marketed.

wr1472 15y ago
So you admit to having porn on your PC? I think it has done what it claims. :D
- deleted 15y ago
  [deleted]
_delirium 15y ago
Sounds pretty fraudulent in that case, since the advertising materials clearly imply that it's detecting porn, not just listing all image files on the computer. I mean bad classification would be one thing, but not even attempting, while claiming that it does, seems like another. Maybe demand your $20 back?
- citricsquid 15y ago
  I probably should, here's an example of the images it returned as porn: http://screensnapr.com/e/PEB3NG.png http://screensnapr.com/e/PEB3NG.png
  - sramsay 15y ago
    Yeah, but what exactly is happening in "foliage grass short?"
    - citricsquid 15y ago
      NSFW http://i.imgur.com/1W609.jpg http://i.imgur.com/1W609.jpg
  - rsanchez1 15y ago
    WHOA, would've appreciated an NSFW.
vaksel 15y ago
I'd check my PC to see if it was infected if I were you.
- heelhook 15y ago
  I bet he did it in a throw-away virtual machine. That thing has spyware written all over it.
jonmwords 15y ago
Do you have any way of capturing the actual JAR? Our Sophos security friend wants to analyze it, but we don't know how to get it.
- citricsquid 15y ago
  edit: http://pastie.org/private/jun6syyaoe2uynjbrla4a http://pastie.org/private/jun6syyaoe2uynjbrla4a
  - verroq 15y ago
    Not a professional reverse engineer. But the jar is not obfuscated and is fairly easy to understand. The jar loads a "model" which is a serialised version of a class containing keywords from a url constructed from the applet params "codebase" and "getmodelurl". It looks into 1. Chrome, firefox, and IE histories Matches history with sites in the "model" 2. Main filesystem It enumerates all the files in the file system, checking if it is either a picture, or a movie, then checks if the filename matches the list of keywords obtained from the "model". >".bmp"".gif"".jpeg"".jpg"".png"".tif"".tiff"".3g2"".3gp"".aaf"".asf"".asx"".avi"".flv"".mkv"".mov"".mp4"".mpeg"".mpg"".rm"".vob"".wmv" The only filetypes it'll match. I didn't see anything malicious.
therandomguy 15y ago
Thanks for doing this.. for science
alex_c 15y ago
Just for kicks, did you check if it even looks at hidden files or folders?
allwein 15y ago
I'll admit it's probably finding a lot of false positives, but I could make an argument for many of the files you said it flagged. Contains "ass": ui-bg_glass_55_fbfgee_1x400.png Path contains "x", contains "butt", "up" could indicate up-skirt: combo-button-up.png Contains "stroke", contains "16": stock-selection-stroke-16.png Contains "cock", contains "x": xlr_pro_mortal_cocktail.png Contains "hole": whole.png So basically anything with an x, a possible age, and any number of flagged words/slang/abbreviations, etc could be causing these to be flagged.
- CWuestefeld 15y ago
  That's plausible, but suggests that the creator never tested it on real-world data. Either way, it's really bad development work.
  - seiji 15y ago
    Methinks you misunderstand. This is a money-at-all-costs gambit, not a pinnacle-of-science-and-engineering product. It could have been made by someone following popular HN advice: a.) target women by b.) preying on a weakness (here, a sense of insecurity) then c.) extract money.
    - scoot 15y ago
      I'm not so sure the advice is popular, so much as it get's repeated ad-nauseum by an individual with little else to offer.
      - statictype 15y ago
        it get's repeated ad-nauseum by an individual with little else to offer. You've been on HN for less than an year. I'm not sure you're ready to start passing judgement on how much one of the most helpful contributors has to offer.
- deleted 15y ago
  [deleted]
zellyn 15y ago
citricsquid - thanks for the info. Did it give any false negatives for you? To all complaining about the product giving false positives: think about it from the user's perspective. If you ran this program, and it showed you no results, you'd probably just think it didn't work. Showing you a scattering of false positives "proves" that it at least did something. And checking down the list makes you feel like you completed your audit.
middus 15y ago
Thanks! Now ask for a refund or file a chargeback with your CC company, because it did not work as advertised.

wr1472 15y ago

So you admit to having porn on your PC? I think it has done what it claims. :D

deleted 15y ago
[deleted]

_delirium 15y ago

Sounds pretty fraudulent in that case, since the advertising materials clearly imply that it's detecting porn, not just listing all image files on the computer. I mean bad classification would be one thing, but not even attempting, while claiming that it does, seems like another. Maybe demand your $20 back?

citricsquid 15y ago
I probably should, here's an example of the images it returned as porn: http://screensnapr.com/e/PEB3NG.png http://screensnapr.com/e/PEB3NG.png
- sramsay 15y ago
  Yeah, but what exactly is happening in "foliage grass short?"
  - citricsquid 15y ago
    NSFW http://i.imgur.com/1W609.jpg http://i.imgur.com/1W609.jpg
- rsanchez1 15y ago
  WHOA, would've appreciated an NSFW.

vaksel 15y ago

I'd check my PC to see if it was infected if I were you.

heelhook 15y ago
I bet he did it in a throw-away virtual machine. That thing has spyware written all over it.

jonmwords 15y ago

Do you have any way of capturing the actual JAR? Our Sophos security friend wants to analyze it, but we don't know how to get it.

citricsquid 15y ago
edit: http://pastie.org/private/jun6syyaoe2uynjbrla4a http://pastie.org/private/jun6syyaoe2uynjbrla4a
- verroq 15y ago
  Not a professional reverse engineer. But the jar is not obfuscated and is fairly easy to understand. The jar loads a "model" which is a serialised version of a class containing keywords from a url constructed from the applet params "codebase" and "getmodelurl". It looks into 1. Chrome, firefox, and IE histories Matches history with sites in the "model" 2. Main filesystem It enumerates all the files in the file system, checking if it is either a picture, or a movie, then checks if the filename matches the list of keywords obtained from the "model". >".bmp"".gif"".jpeg"".jpg"".png"".tif"".tiff"".3g2"".3gp"".aaf"".asf"".asx"".avi"".flv"".mkv"".mov"".mp4"".mpeg"".mpg"".rm"".vob"".wmv" The only filetypes it'll match. I didn't see anything malicious.

therandomguy 15y ago

Thanks for doing this.. for science

alex_c 15y ago

Just for kicks, did you check if it even looks at hidden files or folders?

allwein 15y ago

I'll admit it's probably finding a lot of false positives, but I could make an argument for many of the files you said it flagged. Contains "ass": ui-bg_glass_55_fbfgee_1x400.png Path contains "x", contains "butt", "up" could indicate up-skirt: combo-button-up.png Contains "stroke", contains "16": stock-selection-stroke-16.png Contains "cock", contains "x": xlr_pro_mortal_cocktail.png Contains "hole": whole.png So basically anything with an x, a possible age, and any number of flagged words/slang/abbreviations, etc could be causing these to be flagged.

CWuestefeld 15y ago
That's plausible, but suggests that the creator never tested it on real-world data. Either way, it's really bad development work.
- seiji 15y ago
  Methinks you misunderstand. This is a money-at-all-costs gambit, not a pinnacle-of-science-and-engineering product. It could have been made by someone following popular HN advice: a.) target women by b.) preying on a weakness (here, a sense of insecurity) then c.) extract money.
  - scoot 15y ago
    I'm not so sure the advice is popular, so much as it get's repeated ad-nauseum by an individual with little else to offer.
    - statictype 15y ago
      it get's repeated ad-nauseum by an individual with little else to offer. You've been on HN for less than an year. I'm not sure you're ready to start passing judgement on how much one of the most helpful contributors has to offer.
deleted 15y ago
[deleted]

zellyn 15y ago

citricsquid - thanks for the info. Did it give any false negatives for you? To all complaining about the product giving false positives: think about it from the user's perspective. If you ran this program, and it showed you no results, you'd probably just think it didn't work. Showing you a scattering of false positives "proves" that it at least did something. And checking down the list makes you feel like you completed your audit.

middus 15y ago

Thanks! Now ask for a refund or file a chargeback with your CC company, because it did not work as advertised.