19 ms·

Until further notice, think twice before using Google to download software

329 points by satya71 4y ago

GavinAnderegg 4y ago
Google's search product has become a shadow of its former self. Every year it seems harder to find what I'm looking for. The top half of the first search result page is now (potentially malicious) ads, and what follows is likely SEO spam. I need to add "reddit" or "stackoverflow" to half my searches these days so I'm not served nearly useless results. It's a sad decline from 10+ years ago when I'd type a half-formed thought into the search box and I'd get the answer.
- realusername 4y ago
  They pretty much lost the war against content farms already. I'm not sure the content indexing & crawling model they have is even adapted to the current web.
  - beefield 4y ago
    What makes you think they ever waged a war? I never saw any indication.
    - CalRobert 4y ago
      Well, there were algorithm changes like Panda 12 years ago...
      - mc32 4y ago
        12 Years is a long time... fighting "the previous war" doctrine type results. Not to dismiss any non-public changes, but never the less, search results quality has suffered. Maybe search results isn't their funnel to relevant ads but rather they want to serve up ads while skipping the quality results step most people expect.
    - patja 4y ago
      Matt Cutts made it seem like they were serious about it. On reflection, his departure seems like a turning point, albeit perhaps coincidental.
    - realusername 4y ago
      I think they did at the beginning, there's been a lot of algorithm changes before but once they realized they were losing, they just gave up. The incentives are just not aligned anyways, Google Search gets its money from the ad links on the top, they don't really lose anything if the links below are half terrible...
  - csdvrx 4y ago
    They will never fight that war again. Just follow the money: google has all the reasons to tolerate SEOs, since these SEO linkfarms are filled to the brim with ads, conveniently sold by google! I'd be surprised if anyone at google would understand that to be a problem, because "It is difficult to get a man to understand something, when his salary depends upon his not understanding it."
- mmcgaha 4y ago
  I was looking for info about an online acquaintance that I used to game with 20+ years ago. His handle is pretty unique but google would not return anything. Bing on the other hand had me finding all of his old post leading to his real name and now I am back in email contact. I get the feeling that google is just filtering out anything over a certain age and below a certain level of popularity.
  - BizarreByte 4y ago
    Google heavily favours newness, I am sure of that. It used to be easy to find very old, but relevant results. The content still exists, but even with date filters it’s hard to find now. It’s made supporting very old things (products, code, computers) extremely difficult.
- deleted 4y ago
  [deleted]
- iggldiggl 4y ago
  And some small pages seem to have gone missing entirely – some "humorous" typos that I distinctly remember used to return a small handful of pages now return nothing on Google, even though the page(s) in question still exist(s) and is/are still indexed by Bing.
  - solarkraft 4y ago
    Bing used to be a joke, but nowadays they actually do a decent job for cases in which Google fails.
    - pessimizer 4y ago
      Watch them sneak in and steal search. Over the years, Google lost any sort of moral moat that put them above Microsoft. Does anybody think that Microsoft is more intrusive and user-aggressive than Google any more? It's six of one and a half dozen of the other, and if I use Linux or a Mac at home, Microsoft doesn't seem overly interested in me at all aside from trying to sell me Office. Google's probably trying to figure out a way to license my brainwaves.
      - dvngnt_ 4y ago
        yeah. windows is crazy with ads embedded in the OS. they even install tiktok by default
- unity1001 4y ago
  > It's a sad decline from 10+ years ago when I'd type a half-formed thought into the search box and I'd get the answer. Incidentally the first algorithm updates to 'combat spam' came around by then, starting with 'Penguin'. They were supposed to cut the spammy sites from search. All that they did ended up being removing small sites, blogs and ecommerce businesses from search results for the benefit of mega companies at the cost of search quality...
- dahdum 4y ago
  > I need to add "reddit" or "stackoverflow" to half my searches these days It feels truly absurd how many queries I need to append "reddit" to get something useful. The web has changed but Google isn't keeping up.
  - i_am_proteus 4y ago
    Of course, SEO blog spammers are learning to add these terms to their sites.
    - lotsofpulp 4y ago
      The problem is they spam the actual forums themselves. I assume all those posts such as “what did buy (for less than $x) that you find most useful” are spammers so they can reply with their own products. And I am sure they are making posts asking for product/restaurant/etc recommendations and then replying to themselves.
      - ChrisMarshallNY 4y ago
        I remember encountering this in LinkedIn groups. I had joined a few (like The Swift Programming Language), and would see questions like "I have this problem <Detailed description of the issue>, how can I solve it?" Since (in at least one case) this was a problem I had easily solved, years before, I would provide a detailed, concise, answer, showing how to deal with it in a few lines of code. My answer would get ignored. Instead all these replies would show up, saying things like "I added the <XXX Library>, and it solved the problem!". These would get voted up, and the original poster would actually engage them. After seeing a few of these, I realized that LI groups are dumpster fires, and quit them all.
    - ryandrake 4y ago
      As long as "site:" still works (limiting your search scope to a particular domain), then the SEO'ers can pound sand. Pretty much 100% of my google searches these days are scoped to a particular domain. This is because my search needs in 202x are very different than in 200x. Back then, I wanted to find the right web site for X. Today, I know the best web sites for X, and I always want to search for that exact X on that exact site. I am no longer interested in discovering new web sites. The established ones are known to be good, and any new, unknown one is almost 99.9999% likely to be SEO spam. For example, I'm not interested in Dropshipper 45512's automatically generated web store where he gets a commission to ship you Alibaba goods, and that's really all you get in the long tail of shopping searches. Search engines need to pivot away from helping people find new web sites (since they are mostly crap) and instead help to curate the best content from existing known-good ones. Yes, it sucks if your new site is legitimitely one of the 0.0001% that are human-made and awesome. Sorry, but I'm not going to find you through search. Don't worry, I'll find you through word of mouth if you are actually high quality.
- Loughla 4y ago
  Every google search has to have either "+reddit" or "+stackoverflow" depending on what I'm trying to accomplish. And EVERY search for products needs to say "-pinterest".
  - voytec 4y ago
    Another example: music videos may require "-reaction -reacting". But it's the same or worse with DuckDuckGo.
    - csours 4y ago
      The information landscape is hostile, your attention is valuable, so there is motivation to hijack it.
      - gumby 4y ago
        Sadly there’s disproportionate value. Your attention is only worth a few cents, the criminals' (SEOers, scammer ps etc) cost is miniscule per user, but the cost to each user of the misinformation and wasted time is larger. Like breaking a shop window to steal something small and easily transported/resold.
        csours 4y ago
        I think this is why there is value in moderated spaces like reddit [complex feelings here], the moderators and team/tribe mentality ensure that there is informational value to at least that group [more complex feelings here].
    - Akronymus 4y ago
      For music, also adding -extended feels necessary. Along with -60fps for anything anime related.
      - OmarAssadi 4y ago
        Oh my GOD. The 60 FPS 4K memescaling shouldn't drive me as insane as it does, but jesus christ, the amount of times I have wanted to show someone some opening, gone on YouTube, and literally everything is some tweened upscale. I usually give up and end up having to go and StackOverflow the ffmpeg filters I'll never remember for burning in subs just to clip it myself -- `ffmpeg -i episode.mkv -vf "subtitles='episode.mkv':si=0" -c:v libx264 -preset slow -crf 18 -c:a aac_at -b:a 320k -ss start_duration -t opening_duration output.mp4` [1]. I think it bothers me even more given anime is rarely even natively fully 1080P 29.97/30 FPS, let alone 4K 60. I try my best to live and let live, but it's my biggest pet peeve. It drives me nuts that basically all TV manufacturers do this too now by default -- everything I've purchased over the past ~10-12 years or so comes preset with """"smooth""" motion and a billion other video "correction" modes enabled, despite it just artifacting or making everything look straight up worse [2]. I'm genuinely really curious, does anyone here on HN use and enjoy those modes? Maybe there is something I'm missing. Or maybe I'm just hyper-sensitive to that kind of thing. It made me laugh when I moved back to the US after school in Russia; family had gotten a new TV and within like seconds of being home and trying to watch a movie together, I'm immediately sitting there fiddling with the sittings, meanwhile no one else apparently even noticed the frame interpolation was on in the first place. Anyway, sorry for the rant ;-) ‎ [1]: OK, this time it was from memory, so it might not quite be right. But maybe I've finally memorized the correct incantation? [2]: good video on the topic - <https://www.youtube.com/watch?v=m1nUCyC8hGA https://www.youtube.com/watch?v=m1nUCyC8hGA>
- grishka 4y ago
  It's gotten so bad that there's now an ad blocker filter list that removes the StackOverflow clones from search results.
  - flangola7 4y ago
    Do you have a handy link?
  - BizarreByte 4y ago
    I’d love a list of URLs for low quality stuff like GeeksforGeeks so I can block them all.
  - Smilliam 4y ago
    I'm not OP, but for those of you who saw this comment and were hoping for a link, the one that I use is https://github.com/quenhus/uBlock-Origin-dev-filter https://github.com/quenhus/uBlock-Origin-dev-filter
    - ben174 4y ago
      Any other external filter lists that are useful?
      - Smilliam 4y ago
        Not software dev specific, but I also use Peter Lowe's ads and trackers blocklist (https://pgl.yoyo.org/adservers/serverlist.php https://pgl.yoyo.org/adservers/serverlist.php). Note that this one can be a bit aggressive (blocks url shorteners and clickthroughs on google ads even if they are the correct place you want to visit because, well, tracking), but it is well maintained and generally a fantastic addition to the default ublock origin lists imo
        ben174 4y ago
        Is this a hosts file only? It doesn't seem to want to import into uBlock.
- pessimizer 4y ago
  Altavista was better. It would certainly return more than the 5 SEO stained results pages that current search engines are repeating over and over again, pretending that they're bigger than they are.
  - egberts1 4y ago
    Too bad that Yahoo! absorbed Altavista then made that site defunct since 2013.
  - acdha 4y ago
    Google was better, too. This is because someone decided it was better to sell ads than give people the most relevant results. It’s not like it’s an unsolved problem in computer science to block persistent spam / scraper / cloaking domains — someone at Google told the people who used to do that to stop.
- Foobar8568 4y ago
  Unfortunately reddit is spammed with promoters
  - piva00 4y ago
    Still much easier to parse through reddit's comments and try to identify astroturfing than going through Google's results figuring out what's not SEO-spam or sponsored reviews... It takes me much less effort to do the former than the latter.
    - itchyouch 4y ago
      For products, I'll find suggestions from reddit, signal it with the conversational quality, then corroborate it against other places that reviews may exists like forums, youtube, facebook, instagram, etc. Usually, a great product will have enough activity surrounding it that it's difficult to fake with bots. Especially, Instagram profiles with <1000 followers + non-seo-optimized stories/posts raving about something signals that the the <joy-from-product> is organic rather than manufactured. I think the strongest signal for legitimate IG accounts is the ephemeral nature of the 24-hour IG stories. I suppose someone enterprising could auto-build hundreds of personas that post stories daily, but a random profile with stories posting activism, their morning latte art, a selfie with some friends seems doesn't fit in the ROI of a scalable marketing strategy across a ton of accounts. Maybe I could be wrong?
  - SamBam 4y ago
    I think this is truer and truer. Part of the issue is our built-in bias towards thinking of other Reddit users (and HN and whoever) as people just like ourselves. That means we give undue weight to their recommendations. I definitely find myself being more swayed by a single user's recommendation with maybe a few dozen upvotes, over SEO-gamed websites and Amazon reviews. But in reality, that's a ludicrous assumption, since advertisers knows it too, and it only takes 5-10 fake accounts to create that kind of pretend consensus. In many ways, Reddit is far easier to spam.
- eino 4y ago
  I used DDG which was slightly better; but for a couple of months, I've switched to kagi, and it's been a revelation. It's much better than both, it's google from 15 years ago. Drawback is that unlimited searches needs a subscription (10$/months). But I personally think it worth for the time and focus gains.
  - neodymiumphish 4y ago
    Have you done a side by side against Neeva? I've been on Neeva for long enough that it's not worth testing against competitors; it's very good, but I'm always interested in how well others compare.
    - eino 4y ago
      I haven’t but I will a try! In the last years the only that I found equivalent was cliqz, that unfortunately closed 2 or 3 years ago and which I still regret.
- MrFoof 4y ago
  Which, hilariously, is what got people to use Google in the first place. What made Google take off was not only was it fast, but you also got what you were looking for in the first page of results — if not the top of the first page. No more carefully crafting queries to try to filter out the chaff. What you wanted, fast, and easy enough that someone not versed in how to carefully structure queries could be immediately successful. - - If some search engine or other tool can get us back to that point, that’s not only what will eat Google’s lunch, but devour it - and quickly.
- whoisthisguy 4y ago
  Kagi is the way to go. Search results are more useful, and I'm rarely faced with spam sites.
- 5350-uiop-1130 4y ago
  at this point Google is more of a brochure than a search engine "here are some ads that match your search query"
- deleted 4y ago
  [deleted]
- klyrs 4y ago
  > I need to add "reddit" or "stackoverflow" to half my searches... The perversity is that site-local searching used to be better when it existed, but people (users and web devs both) came to rely on google. It's a sorry state that google remains the primary interface to sites that should know their data better them google...
- stasge 4y ago
  Personalization could be a reason of getting bad results. I'm always using https://google.com/ncr https://google.com/ncr in private mode and I don't think I've noticed any degradation in search quality so far.
waselighis 4y ago
All the more reason to use an adblocker. Online ads are the most common way that malware gets injected into otherwise trustworthy websites.
- RajT88 4y ago
  Yeah! I recall discovering recently my father had a coin miner malware on his laptop, which had been acting slow for a while (a year). Upon discovery, my mother gave him some hard side-eye. But I explained the whole malvertising thing, and that seemed to placate her. Don't get me wrong; he probably was looking at naughty pictures. But I actually think he's more likely to have gotten that from a legit site.
  - acdha 4y ago
    I’m reminded of the time I opened nytimes.com and the ad Google served started a download for a .exe file. It wasn’t well targeted to my Mac but if you do that to a million people the number who’ll think it’s a trustworthy site and run it will be greater than zero.
- scarface74 4y ago
  And how does that help when organic search leads to malware?
azangru 4y ago
Took me a while to understand what "using Google to download software" means. Was there a hidden functionality I wasn't aware of? Turns out, what they mean is "don't use Google to search for software you wish to download".
- coldpie 4y ago
  Yeah, I love Ars, but Dan is definitely their weakest writer. The article is about scammers buying ad space on google to rank their malware above the legitimate google search results. Installing an ad blocker is a great solution.
  - macintux 4y ago
    Typical ad blockers surely don’t filter out Google search results.
    - coldpie 4y ago
      The search results are not the problem. The ads are. Ads are placed above search results, so users are more likely to be mislead by them. Installing an ad blocker removes the misleading ads, leaving only the legitimate search results.
      - whstl 4y ago
        Not entirely, unfortunately, at least on my experience. Putting the keyword "download" after the name of software, ebooks, or music will lead into weird websites that distribute malware, and they rank very high. I just tried searching for an old Game Programming book I happen to have. There's two piracy sites, then one site with a "Download" button that gives me a DMG with an executable. Those are above Archive.org, the official github repo of the book and the official website. For music download, I searched some Bowie. There's Amazon... plus a few pages of of weird websites that I have no idea what they are, but look like "paid piracy", they either ask for credit card or give me a DMG which supposedly has a downloader. For software I searched the one I made by the company I work at. There's stuff like Filehorse, Softonic (I don't even know if they're legit), then there's a few which look like those aggregators but end up giving you malware when downloading. That's with ads blocked, and subscription to several lists. In the end IMO this is terrible for small businesses, people will end up distrusting anything that's not Amazon or anything that they try to search organically, or they'll get malware.
tedivm 4y ago
The malvertisement thing has become real bad. The other day I had a problem so I used chrome, where I unfortunately hadn't installed an add blocker yet. I searched for my bank (I know, I should have put the URL in directly, but I was being lazy since it was a new chrome install and I didn't have the url in my history yet). I hit the first link, logged in (my password manager would have saved me here, but again it wasn't installed), and realized that it was a fake website. Fortunately I changed my password again before it was an issue- and then my bank locked my account when they saw the suspicious activity. So nothing bad really happened to me other than some inconvenience. However I'm still amazed that Google would let their search results get poisoned with these ads for phishing sites.
- rom-antics 4y ago
  This is why the appeal-to-ethics argument against adblocking holds no weight with me. Yes, maybe I stole $0.0001 from the publisher by not looking at an advert. But I also didn't have my bank password stolen and my files cryptolockered. It's a small price to pay for security.
  - hgsgm 4y ago
    I don't know about "stole" but the value of those ads is more like $100/yr/user
    - TremendousJudge 4y ago
      I know people who got robbed of more than that by scams that showed up on ads
  - BizarreByte 4y ago
    You shouldn’t feel bad, advertisements online are user hostile and a security threat. It’s not like a billboard that is at most annoying as you avert your gaze, despite what online ad supporters want you to believe. The ad companies could cleanup the business and actually enforce security/safety standards, but that would cost money and god forbid they lose some.
deafpolygon 4y ago
Well, fortunately, I never click the "Ad" sponsored links and most of the time I don't see them anyways (uBlock). That doesn't help the other 90% of users online though.
- jpmattia 4y ago
  Like many here, I have a sysadmin side gig for my aging dad: uBlock is essentially required as anti-virus software. While it's great that google figured out how to monetize search by inserting ads, it was a lot more ethical back when their major demographic was geeks who could tell the difference between an ad link and a genuine result. Now? Not so much.
  - capableweb 4y ago
    > it was a lot more ethical back when their major demographic was geeks who could tell the difference between an ad link and a genuine result I think the ads used to be more distinct as well, with a different background color even, if I remember correctly. I guess it's a fine line to walk between "It should be obvious what is advertisement" vs "Users should be confused enough to sometimes click the advertisement", and Google chose to go for the latter in order to raise click rates.
    - GeekyBear 4y ago
      Ads were not only a different color, they were also limited to the margins of the page and did not appear in the list of search results. As a matter of fact, when Google was the scrappy new underdog, they used to make fun of the legacy search engines for the practice of mixing ads into the list of search results.
      - ManuelKiessling 4y ago
        You either die a hero or you live long enough to see yourself become the villain…
chaostheory 4y ago
I can’t replicate this. Maybe it’s because I’m logged into Google when I search?
- xmodem 4y ago
  Me neither, the examples called out in the article have likely all been culled by now. I do have to wonder why entering ad keywords for names of popular software doesn't immediately flag for review though.
  - Terretta 4y ago
    Because the most expensive (lucrative for Google) ads include competitors bidding on each other's names as keywords.
- JZerf 4y ago
  You might have an ad blocker installed.
miohtama 4y ago
One solution is ad transparency and have company verifies details in all advertisiments. Facebook already does this for political ads AFAIK.
htrp 4y ago
> It is difficult to get a man to understand something when his salary depends on his not understanding it. - Upton Sinclair Google doesn't exactly care about this because they still get paid for the click. The malware companies are willing to bid extremely high for that single click (since they end up pwning your computer).
- toss1 4y ago
  That'll work just fine until they trash their reputation with carp like this. Then, no one will use them, and they will have a hard time getting it back; they may still exist, but only as a husk of their former stature.
  - acdha 4y ago
    You’re not wrong but the manager making that call will have retired rich by then.
    - toss1 4y ago
      Yup, highly likely. But this is why someone in the executive or CxO suite must be on top of flagging potentially existential issues like this and getting on top of it — instantly. If it were my company, I'd be temporarily pulling down all ads not from a known previously-vetted source (e.g., the major agencies of publicly listed US companies), setting up an emergency team to develop some recognition technology, then opening it back up again with very strong surveillance. But yeah, likely the execs there will just say 'it won't collapse that fast, and I'll be off on sunnier beaches then...
vehemenz 4y ago
It boggles my mind that neither macOS nor Windows has an official, comprehensive package manager. Sometimes the only way to get software is to download binaries from a Google search like it's 2003. On macOS, 90% of what you'd ever need is on Homebrew—this is more or less a solved problem—but it's still unofficial and Apple promotes their pointless App Store instead. In Windows land, the unofficial package managers are nowhere near comprehensive (understandable, I guess), but you'd think with Microsoft's approach toward WSL and GitHub, they would have an officially supported HomeBrew-like alternative.
- tech234a 4y ago
  Windows has winget built in.
  - vehemenz 4y ago
    They allow anyone to submit to the repository with minimal vetting, and the package selection is inferior compared to Homebrew. Maybe we have different ideas about what "official" and "comprehensive" mean.
    - izacus 4y ago
      I'd love to hear what "official" means to you and why that definition has value for a package manager.
      - vehemenz 4y ago
        Prima facie, a one-stop, secure, official (paid Microsoft employees working on it) source for binary downloads seems like it has plenty of value for end users. I'd be interested in knowing why keeping the Windows Store around and having a secondary package list for winget that most people don't use is a better paradigm.
  - consumer451 4y ago
    I had no idea this existed. Neato! C:\>winget search "hacker news" Name Id Version Source ------------------------------------------------ Hacker News Reader 9WZDNCRDKBC1 Unknown msstore Hacker News (YC) 9NBLGGH1RHHV Unknown msstore I have no idea on the provenance of these packages, so will not be installing until I understand this more, but thanks for sharing winget. "winget search torrent" listed some apps which I had never heard of before. Here is winget's submission requirements info: > Expectations for submissions: > The manifest complies with the schema requirements. All URLs in the manifest lead to safe websites. > The installer and application are virus free. The package may be identified as malware by mistake. If you believe it is a false positive you can submit the installer to the Microsoft Defender team for analysis. > The application installs and uninstalls correctly for both administrators and non-administrators. > The installer supports non-interactive modes. > All manifest entries are accurate and not misleading. >The installer comes directly from the publisher's website. https://learn.microsoft.com/en-us/windows/package-manager/package/repository#validation-process https://learn.microsoft.com/en-us/windows/package-manager/pa...
arthurofcharn 4y ago
Google was once considered trustworthy. It never was, but we thought it trustworthy. Where can you find a trustworthy source for software? Depends on your platform. Linux: Your package manager. In my case, apt. Mac: Apple has an app store of its own. Use that, or one of the BSD package management systems ported over. Ios: Apple app store is decently curated. Android: Google's app store is terribly curated. Give up now. Windows: Nobody uses whatever app store or package management system that microsoft developed. A third party developed a useful package management system. It is called Steam. Other platforms: see replies below.
- charcircuit 4y ago
  Linux package managers are not trustworthy. That is another case where everyone pretends that it is. Usually packages are created and updated by random people and can be pseudonymous.
  - arthurofcharn 4y ago
    Oh crud, you are right. Any idea how to fix this? Perhaps a more curated (and more manageable) list? That would seem to be in conflict with our bazaar model.
    - izacus 4y ago
      The package managers right now ARE that curated list and distributions like Debian have proven themselves to be trustworthy. Of course, you can always find something wrong with every approach, but the truth that everyone needs to face here is that you need to trust SOMEONE to distribute good software to you.
    - Sakos 4y ago
      AUR is one of those "at your own risk" repos where I always check the pkgbuild and comments of a package first before installing something new. I don't know why I should hesitate to trust the default repos though since they're curated by the same people making the distro I use. Either I trust them or I use another distro.
godzillabrennus 4y ago
I feel lost reading articles like this. Then I realize people still use Google search. I switched six years ago to Duck.com and I’m never looking back.
- jvolkman 4y ago
  You forgot that people use the search engine with >90% market share?
DanCarvajal 4y ago
Was looking at a fake Audacity site just the other day. I couldn't believe it was the number one search result when I was researching progress on the project's UI redesign.
bleuuuu 4y ago
pihole
jeffbee 4y ago
The actual lesson here appears to be don't use Microsoft Windows.
- JonChesterfield 4y ago
  I'm seeing a consensus on do use Microsoft bing which just can't be right
  - jeffbee 4y ago
    Under the same banner of just staying away from popular malware targets, it would be consistent to choose bing or DDG while searching from your web browser running on OpenBSD/riscv64. Just confuse the hell out of the bad guys. But, the big flaw in the article is the author fails to suggest a better alternative. DDG raises 2 malware sites in the top 10 organic (I assume) results for "tor download". You're not safe from this stuff anywhere.
    - BizarreByte 4y ago
      > it would be consistent to choose bing or DDG while searching from your web browser running on OpenBSD/riscv64. Just confuse the hell out of the bad guys. As a bit of a joke I used one of those browser fingerprint tools running on a browser under OpenBSD/macppc. The entire setup was completely unique, they had never encountered another user that matched. It would confuse the bad guys, but it’s very easy to track.
zamalek 4y ago
It seems as though using an adblocker has become more important in terms of security posture than having an antivirus running, or keeping your system up to date.
kmfrk 4y ago
We're going to end up in a weird situation where we just download all this stuff through storefronts like Steam instead of open websites on Google, if they keep this up. Doesn't help that Windows' own app store is a huge mess on Windows 10 - and presumably 11.
ipython 4y ago
Every time I read these articles I am so happy that the sponsored links are blocked by Pi-hole. Makes my family furious because it also disables all the shopping links as well, but well worth it imo.
NelsonMinar 4y ago
Back in the early 2000s I helped create policy and procedures at Google to stop this kind of thing. Google's early anti-malware policies, extended to ads, and internal procedures to make sure we effectively stopped malware ads. That was a long time ago though and it's sad and frustrating to read it's not working so well now. In particular the article points out several big red flags about how malware scanners are automatically finding the site and download are suspicious. It's a shame Google Ads isn't using that information. (As for DownloadStudio, they have a Wikipedia page that looks 100% innocuous. Searching for "DownloadStudio" has Google search offering an inline answer to "Is DownloadStudio safe" with a reference to the website for DownloadStudio saying "yes it's safe". In this case the inline result is actively harmful. https://i.imgur.com/37GzDKe.png https://i.imgur.com/37GzDKe.png)
- bcrl 4y ago
  It's sad that Google finds it more important to take profits from ads linking to malware downloads than to protect users from harms. I guess the only way that's going to happen is if governments step up and make Google liable for harm caused by ads. I've seen it happen myself with my father. He gets served malware and phishing ads at the top of searches on his iPad for completely innocuous searches like "Apple Canada support", while I get completely different results in the same house from my own devices. There's no way to report these incidents either.
  - Tepix 4y ago
    Could it be that the device is already infected with malware-injecting things?
    - bcrl 4y ago
      No, I checked for that multiple times as I was around when that happened. It was an ad served up directly by Google that lead to a phishing website and phone numbers on it. His filter bubble is very different from mine, and it's clear that the peddlers of malware and scams use ad targeting to hit the elderly with ads that try to take advantage of them. This is a major downside of ad targeting: they're more effective for both good and bad purposes. Ads really should be less ephemeral than they are. Sometimes I see an ad I'm interested in but miss it before clicking a link at which point it's gone after hitting the back button. Similarly, if an ad is for a scam, there needs to be a way to go back, find it, and then flag it.
heywherelogingo 4y ago
Think twice before using Google.
yazzku 4y ago
Why isn't Google fined for distributing malware?
horsawlarway 4y ago
Honestly - just stop using Google search (and while I remain flabberghasted I'm saying this - Edge is a better chromium browser than Chrome.). Or better yet, any Google product. The company is diving off a cliff. For reference... A private Jellyfin server I use for hosting videos of my kid for his grandparents, and some music I legally own is consistently flagged as phishing (along with basically anyone else hosting them publicly based on this thread: https://github.com/jellyfin/jellyfin-web/issues/4076 https://github.com/jellyfin/jellyfin-web/issues/4076) Google has "automated" itself into the garbage.
- kcartlidge 4y ago
  > and while I remain flabberghasted I'm saying this - Edge is a better chromium browser than Chrome This is surprisingly true. On my work Windows laptop I switched as (a) the system overhead was less than half and (b) the performance was better. Been months, and other than the occasional wrong icon being clicked I've not launched Chrome since.
  - horsawlarway 4y ago
    I use it on my Linux boxes, and it's better there too, which is really a bit stunning at the end of the day. I would have laughed in your face 10 years ago if you'd told me I would prefer a MS browser over chrome... but here we are. Google is rapidly becoming a dinosaur, and I don't think they have the ability (or perhaps desire) to change course. Frankly - I'd like to see their search monopoly broken up at this point. It's time for some fresh air in the space.
xbar 4y ago
Malware has been accompanied by lots more porn in Google search results in the past quarter. I switched to Duck Duck Go some time ago, but I hadn't required it for extended family. Now I do.
jerry1979 4y ago
Just to jump on the anti-google bandwagon, google news search has fell off a cliff over the past decade. Can anyone recommend a news search that allows me to filter by year or year range?
beckler 4y ago
Google owns VirusTotal... so why doesn't search get fed info from VirusTotal?
sneak 4y ago
I block all advertising links via DNS at my router. The first full page of Google links that are all ads are just broken links for me.
Havoc 4y ago
Confused why google isn't all over this double stat? If their advert area develops a reputation for being bad & untrustworthy then their business model breaks on a pretty fundamental level.
sys32768 4y ago
I wonder how the morale is on the Google search team these days. Maybe they can make a paid search that eliminates all affiliate sites in the results.
mastax 4y ago
I once saw a google search ad result for a malware version of GNU Cash. It was extremely easy to miss. The website was identical except the Windows download was replaced with malware instead of linking to Sourceforge. The malware installer was signed with a key from a random Taiwanese electronics company (likely stolen). I emailed DigiCert and got the cert revoked. None of the scanners on VirusTotal flagged the installer. A GNU Cash malware wouldn't need to do any typical malware behavior (crypto mining, ransomware) because they could just send off your bank account credentials. Within half an hour of uploading to VirusTotal the website was replaced with a placeholder blog.
- BeefWellington 4y ago
  Yeah, especially with open-source stuff it's been a problem for a while. The GIMP team is regularly targeted this way and has been for years. 2022: https://www.bleepingcomputer.com/news/security/google-ad-for-gimporg-served-info-stealing-malware-via-lookalike-site/ https://www.bleepingcomputer.com/news/security/google-ad-for... 2015: (The SourceForge Fiasco) https://www.gimp.org/news/2015/05/27/gimp-projects-official-statement-on-sourceforges-actions/ https://www.gimp.org/news/2015/05/27/gimp-projects-official-... 2013: https://www.gimpusers.com/forums/gimp-user/15999-adware-malware-in-gimp-windows-distribution https://www.gimpusers.com/forums/gimp-user/15999-adware-malw...
lazyeye 4y ago
There must be a browser addon that removes the ads from Google search results.
bbu 4y ago
not so surprising when read about what a dump google ads has become: https://www.propublica.org/article/google-display-ads-piracy-porn-fraud https://www.propublica.org/article/google-display-ads-piracy...
eddhead 4y ago
Everyone should be using a package manager / store to get software, or from the official site. If they're not available, then get the vendor to publish them there. Winget / Choco / Scoop or even Windows Store. Same with whatever people use on Linux distros.
kazinator 4y ago
Contrarian viewpoint: When in the history of the web could you blindly download something from a page found by a search engine and install it? When has any search index ever conferred that level of trust to a result? I don't remember any year when you couldn't use a major search engine to find many an asshole site promising that the sought-after content is available if you first download and run their malware .exe file. "I found this page via Google, therefore its downloads are trustworthy" isn't a thing, hasn't ever, and likely isn't going to be any time soon (and implementing it would have downsides).
potbelly83 4y ago
I think we're moving back towards a 90s version of the web again. No search, just a list of hand curated sites of people who's opinions we trust. The only thing is now these will be likes specs of gold drowning in a sea of shit.
- kcartlidge 4y ago
  And no behavioural ads; contextual ones work good enough and have the benefits of (a) no tracking needed, (b) ads that actually relate to what you're looking at/searching for, (c) no monopoly marketplaces, and (d) sites able to host their own ads within a web that can survive off revenues without losing billions to Google and Meta. To be honest even if contextual ads are less efficient than behavioural ones (debatable) it's still worth it to rescue the web from what it has largely become.
yurikoif 4y ago
Isn’t this the norm for search engines? Guess you privileged westerners don’t know about Google’s alternative *in china* Baidu. Regular users just try to avoid every download link directly from it.
radiojasper 4y ago
- Install Firefox. To hell with Chrome as it's just a tracking device wrapped in a web browser. - Install a proper ad blocker. To hell with advertisments in search engines. - Swap Google for DuckDuckGo.
johnklos 4y ago
This article is too kind. We're supposed to believe that all the brilliant minds at Google can't keep ahead of scammers? Sorry, but I don't believe that. On the other hand, I do give Google credit for knowing when they can make more money by allowing a problem to exist than by fixing it. Google got everyone hooked by being decent, by giving good search results, by giving people decent and free-ish email accounts, et cetera. Now it's all going to shit, because they've got everyone hooked so their free(ish) offerings don't need to be good any more. My guess is that search sucks because they can extract more money from advertisers who want to buy their way out from under scammers. Email sucks because they want people to have to pay to get any answers when things are problematic, and we no that no normal human being can correspond with any human that works for Google without giving them money. A majority of the phishing spam I receive now come directly from Google's shitty mail services. Perhaps Google wants software providers to "buy" their way in to a higher position than scammers. Or perhaps Google wants software environments to seem to suck to make the Android marketplace better by comparison. I can't imagine any other reasons why Google would play dumb and allow this kind of gaming of their search results.
- fsociety 4y ago
  In reality this is probably due to orgs not working with each other or inefficiencies (aka negligence).. but yes their threat intel systems can most definitely detect these kind of ads.
BLKNSLVR 4y ago
Google's advertising has actually helped other search engines be safer and more useful. Google search acts as a magnet for all the crap you don't want when searching. Brave search, DDG, Searx, etc are all cleaner and therefore more useful.
t0bia_s 4y ago
Who search for installers on web should know about winget, scoop or chocolatey. https://winget.run/ https://winget.run/ https://scoop.sh/ https://scoop.sh/ https://chocolatey.org/ https://chocolatey.org/ For those who don't like command line, there is WingetUI: https://github.com/marticliment/WingetUI https://github.com/marticliment/WingetUI We should abandon old, inefficient and now dangerous habits.
meltyness 4y ago
Well, this is one way Google the $1.4T publicly-traded company can raise their ad revenue.
technick 4y ago
Do the fake click methods still work for driving up click cost of advertising? Maybe... we...ahem should launch a fake click campaign on these malware advertisers to attack their ad spend budget?

329 points by satya71 4y ago

Google's search product has become a shadow of its former self. Every year it seems harder to find what I'm looking for. The top half of the first search result page is now (potentially malicious) ads, and what follows is likely SEO spam. I need to add "reddit" or "stackoverflow" to half my searches these days so I'm not served nearly useless results. It's a sad decline from 10+ years ago when I'd type a half-formed thought into the search box and I'd get the answer.

realusername 4y ago
They pretty much lost the war against content farms already. I'm not sure the content indexing & crawling model they have is even adapted to the current web.
- beefield 4y ago
  What makes you think they ever waged a war? I never saw any indication.
  - CalRobert 4y ago
    Well, there were algorithm changes like Panda 12 years ago...
    - mc32 4y ago
      12 Years is a long time... fighting "the previous war" doctrine type results. Not to dismiss any non-public changes, but never the less, search results quality has suffered. Maybe search results isn't their funnel to relevant ads but rather they want to serve up ads while skipping the quality results step most people expect.
  - patja 4y ago
    Matt Cutts made it seem like they were serious about it. On reflection, his departure seems like a turning point, albeit perhaps coincidental.
  - realusername 4y ago
    I think they did at the beginning, there's been a lot of algorithm changes before but once they realized they were losing, they just gave up. The incentives are just not aligned anyways, Google Search gets its money from the ad links on the top, they don't really lose anything if the links below are half terrible...
- csdvrx 4y ago
  They will never fight that war again. Just follow the money: google has all the reasons to tolerate SEOs, since these SEO linkfarms are filled to the brim with ads, conveniently sold by google! I'd be surprised if anyone at google would understand that to be a problem, because "It is difficult to get a man to understand something, when his salary depends upon his not understanding it."
mmcgaha 4y ago
I was looking for info about an online acquaintance that I used to game with 20+ years ago. His handle is pretty unique but google would not return anything. Bing on the other hand had me finding all of his old post leading to his real name and now I am back in email contact. I get the feeling that google is just filtering out anything over a certain age and below a certain level of popularity.
- BizarreByte 4y ago
  Google heavily favours newness, I am sure of that. It used to be easy to find very old, but relevant results. The content still exists, but even with date filters it’s hard to find now. It’s made supporting very old things (products, code, computers) extremely difficult.
deleted 4y ago
[deleted]
iggldiggl 4y ago
And some small pages seem to have gone missing entirely – some "humorous" typos that I distinctly remember used to return a small handful of pages now return nothing on Google, even though the page(s) in question still exist(s) and is/are still indexed by Bing.
- solarkraft 4y ago
  Bing used to be a joke, but nowadays they actually do a decent job for cases in which Google fails.
  - pessimizer 4y ago
    Watch them sneak in and steal search. Over the years, Google lost any sort of moral moat that put them above Microsoft. Does anybody think that Microsoft is more intrusive and user-aggressive than Google any more? It's six of one and a half dozen of the other, and if I use Linux or a Mac at home, Microsoft doesn't seem overly interested in me at all aside from trying to sell me Office. Google's probably trying to figure out a way to license my brainwaves.
    - dvngnt_ 4y ago
      yeah. windows is crazy with ads embedded in the OS. they even install tiktok by default
unity1001 4y ago
> It's a sad decline from 10+ years ago when I'd type a half-formed thought into the search box and I'd get the answer. Incidentally the first algorithm updates to 'combat spam' came around by then, starting with 'Penguin'. They were supposed to cut the spammy sites from search. All that they did ended up being removing small sites, blogs and ecommerce businesses from search results for the benefit of mega companies at the cost of search quality...
dahdum 4y ago
> I need to add "reddit" or "stackoverflow" to half my searches these days It feels truly absurd how many queries I need to append "reddit" to get something useful. The web has changed but Google isn't keeping up.
- i_am_proteus 4y ago
  Of course, SEO blog spammers are learning to add these terms to their sites.
  - lotsofpulp 4y ago
    The problem is they spam the actual forums themselves. I assume all those posts such as “what did buy (for less than $x) that you find most useful” are spammers so they can reply with their own products. And I am sure they are making posts asking for product/restaurant/etc recommendations and then replying to themselves.
    - ChrisMarshallNY 4y ago
      I remember encountering this in LinkedIn groups. I had joined a few (like The Swift Programming Language), and would see questions like "I have this problem <Detailed description of the issue>, how can I solve it?" Since (in at least one case) this was a problem I had easily solved, years before, I would provide a detailed, concise, answer, showing how to deal with it in a few lines of code. My answer would get ignored. Instead all these replies would show up, saying things like "I added the <XXX Library>, and it solved the problem!". These would get voted up, and the original poster would actually engage them. After seeing a few of these, I realized that LI groups are dumpster fires, and quit them all.
  - ryandrake 4y ago
    As long as "site:" still works (limiting your search scope to a particular domain), then the SEO'ers can pound sand. Pretty much 100% of my google searches these days are scoped to a particular domain. This is because my search needs in 202x are very different than in 200x. Back then, I wanted to find the right web site for X. Today, I know the best web sites for X, and I always want to search for that exact X on that exact site. I am no longer interested in discovering new web sites. The established ones are known to be good, and any new, unknown one is almost 99.9999% likely to be SEO spam. For example, I'm not interested in Dropshipper 45512's automatically generated web store where he gets a commission to ship you Alibaba goods, and that's really all you get in the long tail of shopping searches. Search engines need to pivot away from helping people find new web sites (since they are mostly crap) and instead help to curate the best content from existing known-good ones. Yes, it sucks if your new site is legitimitely one of the 0.0001% that are human-made and awesome. Sorry, but I'm not going to find you through search. Don't worry, I'll find you through word of mouth if you are actually high quality.
Loughla 4y ago
Every google search has to have either "+reddit" or "+stackoverflow" depending on what I'm trying to accomplish. And EVERY search for products needs to say "-pinterest".
- voytec 4y ago
  Another example: music videos may require "-reaction -reacting". But it's the same or worse with DuckDuckGo.
  - csours 4y ago
    The information landscape is hostile, your attention is valuable, so there is motivation to hijack it.
    - gumby 4y ago
      Sadly there’s disproportionate value. Your attention is only worth a few cents, the criminals' (SEOers, scammer ps etc) cost is miniscule per user, but the cost to each user of the misinformation and wasted time is larger. Like breaking a shop window to steal something small and easily transported/resold.
      - csours 4y ago
        I think this is why there is value in moderated spaces like reddit [complex feelings here], the moderators and team/tribe mentality ensure that there is informational value to at least that group [more complex feelings here].
  - Akronymus 4y ago
    For music, also adding -extended feels necessary. Along with -60fps for anything anime related.
    - OmarAssadi 4y ago
      Oh my GOD. The 60 FPS 4K memescaling shouldn't drive me as insane as it does, but jesus christ, the amount of times I have wanted to show someone some opening, gone on YouTube, and literally everything is some tweened upscale. I usually give up and end up having to go and StackOverflow the ffmpeg filters I'll never remember for burning in subs just to clip it myself -- `ffmpeg -i episode.mkv -vf "subtitles='episode.mkv':si=0" -c:v libx264 -preset slow -crf 18 -c:a aac_at -b:a 320k -ss start_duration -t opening_duration output.mp4` [1]. I think it bothers me even more given anime is rarely even natively fully 1080P 29.97/30 FPS, let alone 4K 60. I try my best to live and let live, but it's my biggest pet peeve. It drives me nuts that basically all TV manufacturers do this too now by default -- everything I've purchased over the past ~10-12 years or so comes preset with """"smooth""" motion and a billion other video "correction" modes enabled, despite it just artifacting or making everything look straight up worse [2]. I'm genuinely really curious, does anyone here on HN use and enjoy those modes? Maybe there is something I'm missing. Or maybe I'm just hyper-sensitive to that kind of thing. It made me laugh when I moved back to the US after school in Russia; family had gotten a new TV and within like seconds of being home and trying to watch a movie together, I'm immediately sitting there fiddling with the sittings, meanwhile no one else apparently even noticed the frame interpolation was on in the first place. Anyway, sorry for the rant ;-) ‎ [1]: OK, this time it was from memory, so it might not quite be right. But maybe I've finally memorized the correct incantation? [2]: good video on the topic - <https://www.youtube.com/watch?v=m1nUCyC8hGA https://www.youtube.com/watch?v=m1nUCyC8hGA>
grishka 4y ago
It's gotten so bad that there's now an ad blocker filter list that removes the StackOverflow clones from search results.
- flangola7 4y ago
  Do you have a handy link?
- BizarreByte 4y ago
  I’d love a list of URLs for low quality stuff like GeeksforGeeks so I can block them all.
- Smilliam 4y ago
  I'm not OP, but for those of you who saw this comment and were hoping for a link, the one that I use is https://github.com/quenhus/uBlock-Origin-dev-filter https://github.com/quenhus/uBlock-Origin-dev-filter
  - ben174 4y ago
    Any other external filter lists that are useful?
    - Smilliam 4y ago
      Not software dev specific, but I also use Peter Lowe's ads and trackers blocklist (https://pgl.yoyo.org/adservers/serverlist.php https://pgl.yoyo.org/adservers/serverlist.php). Note that this one can be a bit aggressive (blocks url shorteners and clickthroughs on google ads even if they are the correct place you want to visit because, well, tracking), but it is well maintained and generally a fantastic addition to the default ublock origin lists imo
      - ben174 4y ago
        Is this a hosts file only? It doesn't seem to want to import into uBlock.
pessimizer 4y ago
Altavista was better. It would certainly return more than the 5 SEO stained results pages that current search engines are repeating over and over again, pretending that they're bigger than they are.
- egberts1 4y ago
  Too bad that Yahoo! absorbed Altavista then made that site defunct since 2013.
- acdha 4y ago
  Google was better, too. This is because someone decided it was better to sell ads than give people the most relevant results. It’s not like it’s an unsolved problem in computer science to block persistent spam / scraper / cloaking domains — someone at Google told the people who used to do that to stop.
Foobar8568 4y ago
Unfortunately reddit is spammed with promoters
- piva00 4y ago
  Still much easier to parse through reddit's comments and try to identify astroturfing than going through Google's results figuring out what's not SEO-spam or sponsored reviews... It takes me much less effort to do the former than the latter.
  - itchyouch 4y ago
    For products, I'll find suggestions from reddit, signal it with the conversational quality, then corroborate it against other places that reviews may exists like forums, youtube, facebook, instagram, etc. Usually, a great product will have enough activity surrounding it that it's difficult to fake with bots. Especially, Instagram profiles with <1000 followers + non-seo-optimized stories/posts raving about something signals that the the <joy-from-product> is organic rather than manufactured. I think the strongest signal for legitimate IG accounts is the ephemeral nature of the 24-hour IG stories. I suppose someone enterprising could auto-build hundreds of personas that post stories daily, but a random profile with stories posting activism, their morning latte art, a selfie with some friends seems doesn't fit in the ROI of a scalable marketing strategy across a ton of accounts. Maybe I could be wrong?
- SamBam 4y ago
  I think this is truer and truer. Part of the issue is our built-in bias towards thinking of other Reddit users (and HN and whoever) as people just like ourselves. That means we give undue weight to their recommendations. I definitely find myself being more swayed by a single user's recommendation with maybe a few dozen upvotes, over SEO-gamed websites and Amazon reviews. But in reality, that's a ludicrous assumption, since advertisers knows it too, and it only takes 5-10 fake accounts to create that kind of pretend consensus. In many ways, Reddit is far easier to spam.
eino 4y ago
I used DDG which was slightly better; but for a couple of months, I've switched to kagi, and it's been a revelation. It's much better than both, it's google from 15 years ago. Drawback is that unlimited searches needs a subscription (10$/months). But I personally think it worth for the time and focus gains.
- neodymiumphish 4y ago
  Have you done a side by side against Neeva? I've been on Neeva for long enough that it's not worth testing against competitors; it's very good, but I'm always interested in how well others compare.
  - eino 4y ago
    I haven’t but I will a try! In the last years the only that I found equivalent was cliqz, that unfortunately closed 2 or 3 years ago and which I still regret.
MrFoof 4y ago
Which, hilariously, is what got people to use Google in the first place. What made Google take off was not only was it fast, but you also got what you were looking for in the first page of results — if not the top of the first page. No more carefully crafting queries to try to filter out the chaff. What you wanted, fast, and easy enough that someone not versed in how to carefully structure queries could be immediately successful. - - If some search engine or other tool can get us back to that point, that’s not only what will eat Google’s lunch, but devour it - and quickly.
whoisthisguy 4y ago
Kagi is the way to go. Search results are more useful, and I'm rarely faced with spam sites.
5350-uiop-1130 4y ago
at this point Google is more of a brochure than a search engine "here are some ads that match your search query"
deleted 4y ago
[deleted]
klyrs 4y ago
> I need to add "reddit" or "stackoverflow" to half my searches... The perversity is that site-local searching used to be better when it existed, but people (users and web devs both) came to rely on google. It's a sorry state that google remains the primary interface to sites that should know their data better them google...
stasge 4y ago
Personalization could be a reason of getting bad results. I'm always using https://google.com/ncr https://google.com/ncr in private mode and I don't think I've noticed any degradation in search quality so far.

waselighis 4y ago

All the more reason to use an adblocker. Online ads are the most common way that malware gets injected into otherwise trustworthy websites.

RajT88 4y ago
Yeah! I recall discovering recently my father had a coin miner malware on his laptop, which had been acting slow for a while (a year). Upon discovery, my mother gave him some hard side-eye. But I explained the whole malvertising thing, and that seemed to placate her. Don't get me wrong; he probably was looking at naughty pictures. But I actually think he's more likely to have gotten that from a legit site.
- acdha 4y ago
  I’m reminded of the time I opened nytimes.com and the ad Google served started a download for a .exe file. It wasn’t well targeted to my Mac but if you do that to a million people the number who’ll think it’s a trustworthy site and run it will be greater than zero.
scarface74 4y ago
And how does that help when organic search leads to malware?

azangru 4y ago

Took me a while to understand what "using Google to download software" means. Was there a hidden functionality I wasn't aware of? Turns out, what they mean is "don't use Google to search for software you wish to download".

coldpie 4y ago
Yeah, I love Ars, but Dan is definitely their weakest writer. The article is about scammers buying ad space on google to rank their malware above the legitimate google search results. Installing an ad blocker is a great solution.
- macintux 4y ago
  Typical ad blockers surely don’t filter out Google search results.
  - coldpie 4y ago
    The search results are not the problem. The ads are. Ads are placed above search results, so users are more likely to be mislead by them. Installing an ad blocker removes the misleading ads, leaving only the legitimate search results.
    - whstl 4y ago
      Not entirely, unfortunately, at least on my experience. Putting the keyword "download" after the name of software, ebooks, or music will lead into weird websites that distribute malware, and they rank very high. I just tried searching for an old Game Programming book I happen to have. There's two piracy sites, then one site with a "Download" button that gives me a DMG with an executable. Those are above Archive.org, the official github repo of the book and the official website. For music download, I searched some Bowie. There's Amazon... plus a few pages of of weird websites that I have no idea what they are, but look like "paid piracy", they either ask for credit card or give me a DMG which supposedly has a downloader. For software I searched the one I made by the company I work at. There's stuff like Filehorse, Softonic (I don't even know if they're legit), then there's a few which look like those aggregators but end up giving you malware when downloading. That's with ads blocked, and subscription to several lists. In the end IMO this is terrible for small businesses, people will end up distrusting anything that's not Amazon or anything that they try to search organically, or they'll get malware.

tedivm 4y ago

The malvertisement thing has become real bad. The other day I had a problem so I used chrome, where I unfortunately hadn't installed an add blocker yet. I searched for my bank (I know, I should have put the URL in directly, but I was being lazy since it was a new chrome install and I didn't have the url in my history yet). I hit the first link, logged in (my password manager would have saved me here, but again it wasn't installed), and realized that it was a fake website. Fortunately I changed my password again before it was an issue- and then my bank locked my account when they saw the suspicious activity. So nothing bad really happened to me other than some inconvenience. However I'm still amazed that Google would let their search results get poisoned with these ads for phishing sites.

rom-antics 4y ago
This is why the appeal-to-ethics argument against adblocking holds no weight with me. Yes, maybe I stole $0.0001 from the publisher by not looking at an advert. But I also didn't have my bank password stolen and my files cryptolockered. It's a small price to pay for security.
- hgsgm 4y ago
  I don't know about "stole" but the value of those ads is more like $100/yr/user
  - TremendousJudge 4y ago
    I know people who got robbed of more than that by scams that showed up on ads
- BizarreByte 4y ago
  You shouldn’t feel bad, advertisements online are user hostile and a security threat. It’s not like a billboard that is at most annoying as you avert your gaze, despite what online ad supporters want you to believe. The ad companies could cleanup the business and actually enforce security/safety standards, but that would cost money and god forbid they lose some.

deafpolygon 4y ago

Well, fortunately, I never click the "Ad" sponsored links and most of the time I don't see them anyways (uBlock). That doesn't help the other 90% of users online though.

jpmattia 4y ago
Like many here, I have a sysadmin side gig for my aging dad: uBlock is essentially required as anti-virus software. While it's great that google figured out how to monetize search by inserting ads, it was a lot more ethical back when their major demographic was geeks who could tell the difference between an ad link and a genuine result. Now? Not so much.
- capableweb 4y ago
  > it was a lot more ethical back when their major demographic was geeks who could tell the difference between an ad link and a genuine result I think the ads used to be more distinct as well, with a different background color even, if I remember correctly. I guess it's a fine line to walk between "It should be obvious what is advertisement" vs "Users should be confused enough to sometimes click the advertisement", and Google chose to go for the latter in order to raise click rates.
  - GeekyBear 4y ago
    Ads were not only a different color, they were also limited to the margins of the page and did not appear in the list of search results. As a matter of fact, when Google was the scrappy new underdog, they used to make fun of the legacy search engines for the practice of mixing ads into the list of search results.
    - ManuelKiessling 4y ago
      You either die a hero or you live long enough to see yourself become the villain…

chaostheory 4y ago

I can’t replicate this. Maybe it’s because I’m logged into Google when I search?

xmodem 4y ago
Me neither, the examples called out in the article have likely all been culled by now. I do have to wonder why entering ad keywords for names of popular software doesn't immediately flag for review though.
- Terretta 4y ago
  Because the most expensive (lucrative for Google) ads include competitors bidding on each other's names as keywords.
JZerf 4y ago
You might have an ad blocker installed.

miohtama 4y ago

One solution is ad transparency and have company verifies details in all advertisiments. Facebook already does this for political ads AFAIK.

htrp 4y ago

> It is difficult to get a man to understand something when his salary depends on his not understanding it. - Upton Sinclair Google doesn't exactly care about this because they still get paid for the click. The malware companies are willing to bid extremely high for that single click (since they end up pwning your computer).

toss1 4y ago
That'll work just fine until they trash their reputation with carp like this. Then, no one will use them, and they will have a hard time getting it back; they may still exist, but only as a husk of their former stature.
- acdha 4y ago
  You’re not wrong but the manager making that call will have retired rich by then.
  - toss1 4y ago
    Yup, highly likely. But this is why someone in the executive or CxO suite must be on top of flagging potentially existential issues like this and getting on top of it — instantly. If it were my company, I'd be temporarily pulling down all ads not from a known previously-vetted source (e.g., the major agencies of publicly listed US companies), setting up an emergency team to develop some recognition technology, then opening it back up again with very strong surveillance. But yeah, likely the execs there will just say 'it won't collapse that fast, and I'll be off on sunnier beaches then...

vehemenz 4y ago

It boggles my mind that neither macOS nor Windows has an official, comprehensive package manager. Sometimes the only way to get software is to download binaries from a Google search like it's 2003. On macOS, 90% of what you'd ever need is on Homebrew—this is more or less a solved problem—but it's still unofficial and Apple promotes their pointless App Store instead. In Windows land, the unofficial package managers are nowhere near comprehensive (understandable, I guess), but you'd think with Microsoft's approach toward WSL and GitHub, they would have an officially supported HomeBrew-like alternative.

tech234a 4y ago
Windows has winget built in.
- vehemenz 4y ago
  They allow anyone to submit to the repository with minimal vetting, and the package selection is inferior compared to Homebrew. Maybe we have different ideas about what "official" and "comprehensive" mean.
  - izacus 4y ago
    I'd love to hear what "official" means to you and why that definition has value for a package manager.
    - vehemenz 4y ago
      Prima facie, a one-stop, secure, official (paid Microsoft employees working on it) source for binary downloads seems like it has plenty of value for end users. I'd be interested in knowing why keeping the Windows Store around and having a secondary package list for winget that most people don't use is a better paradigm.
- consumer451 4y ago
  I had no idea this existed. Neato! C:\>winget search "hacker news" Name Id Version Source ------------------------------------------------ Hacker News Reader 9WZDNCRDKBC1 Unknown msstore Hacker News (YC) 9NBLGGH1RHHV Unknown msstore I have no idea on the provenance of these packages, so will not be installing until I understand this more, but thanks for sharing winget. "winget search torrent" listed some apps which I had never heard of before. Here is winget's submission requirements info: > Expectations for submissions: > The manifest complies with the schema requirements. All URLs in the manifest lead to safe websites. > The installer and application are virus free. The package may be identified as malware by mistake. If you believe it is a false positive you can submit the installer to the Microsoft Defender team for analysis. > The application installs and uninstalls correctly for both administrators and non-administrators. > The installer supports non-interactive modes. > All manifest entries are accurate and not misleading. >The installer comes directly from the publisher's website. https://learn.microsoft.com/en-us/windows/package-manager/package/repository#validation-process https://learn.microsoft.com/en-us/windows/package-manager/pa...

arthurofcharn 4y ago

Google was once considered trustworthy. It never was, but we thought it trustworthy. Where can you find a trustworthy source for software? Depends on your platform. Linux: Your package manager. In my case, apt. Mac: Apple has an app store of its own. Use that, or one of the BSD package management systems ported over. Ios: Apple app store is decently curated. Android: Google's app store is terribly curated. Give up now. Windows: Nobody uses whatever app store or package management system that microsoft developed. A third party developed a useful package management system. It is called Steam. Other platforms: see replies below.

charcircuit 4y ago
Linux package managers are not trustworthy. That is another case where everyone pretends that it is. Usually packages are created and updated by random people and can be pseudonymous.
- arthurofcharn 4y ago
  Oh crud, you are right. Any idea how to fix this? Perhaps a more curated (and more manageable) list? That would seem to be in conflict with our bazaar model.
  - izacus 4y ago
    The package managers right now ARE that curated list and distributions like Debian have proven themselves to be trustworthy. Of course, you can always find something wrong with every approach, but the truth that everyone needs to face here is that you need to trust SOMEONE to distribute good software to you.
  - Sakos 4y ago
    AUR is one of those "at your own risk" repos where I always check the pkgbuild and comments of a package first before installing something new. I don't know why I should hesitate to trust the default repos though since they're curated by the same people making the distro I use. Either I trust them or I use another distro.

godzillabrennus 4y ago

I feel lost reading articles like this. Then I realize people still use Google search. I switched six years ago to Duck.com and I’m never looking back.

jvolkman 4y ago
You forgot that people use the search engine with >90% market share?

DanCarvajal 4y ago

Was looking at a fake Audacity site just the other day. I couldn't believe it was the number one search result when I was researching progress on the project's UI redesign.

bleuuuu 4y ago

pihole

jeffbee 4y ago

The actual lesson here appears to be don't use Microsoft Windows.

JonChesterfield 4y ago
I'm seeing a consensus on do use Microsoft bing which just can't be right
- jeffbee 4y ago
  Under the same banner of just staying away from popular malware targets, it would be consistent to choose bing or DDG while searching from your web browser running on OpenBSD/riscv64. Just confuse the hell out of the bad guys. But, the big flaw in the article is the author fails to suggest a better alternative. DDG raises 2 malware sites in the top 10 organic (I assume) results for "tor download". You're not safe from this stuff anywhere.
  - BizarreByte 4y ago
    > it would be consistent to choose bing or DDG while searching from your web browser running on OpenBSD/riscv64. Just confuse the hell out of the bad guys. As a bit of a joke I used one of those browser fingerprint tools running on a browser under OpenBSD/macppc. The entire setup was completely unique, they had never encountered another user that matched. It would confuse the bad guys, but it’s very easy to track.

zamalek 4y ago

It seems as though using an adblocker has become more important in terms of security posture than having an antivirus running, or keeping your system up to date.

kmfrk 4y ago

We're going to end up in a weird situation where we just download all this stuff through storefronts like Steam instead of open websites on Google, if they keep this up. Doesn't help that Windows' own app store is a huge mess on Windows 10 - and presumably 11.

ipython 4y ago

Every time I read these articles I am so happy that the sponsored links are blocked by Pi-hole. Makes my family furious because it also disables all the shopping links as well, but well worth it imo.

NelsonMinar 4y ago

Back in the early 2000s I helped create policy and procedures at Google to stop this kind of thing. Google's early anti-malware policies, extended to ads, and internal procedures to make sure we effectively stopped malware ads. That was a long time ago though and it's sad and frustrating to read it's not working so well now. In particular the article points out several big red flags about how malware scanners are automatically finding the site and download are suspicious. It's a shame Google Ads isn't using that information. (As for DownloadStudio, they have a Wikipedia page that looks 100% innocuous. Searching for "DownloadStudio" has Google search offering an inline answer to "Is DownloadStudio safe" with a reference to the website for DownloadStudio saying "yes it's safe". In this case the inline result is actively harmful. https://i.imgur.com/37GzDKe.png https://i.imgur.com/37GzDKe.png)

bcrl 4y ago
It's sad that Google finds it more important to take profits from ads linking to malware downloads than to protect users from harms. I guess the only way that's going to happen is if governments step up and make Google liable for harm caused by ads. I've seen it happen myself with my father. He gets served malware and phishing ads at the top of searches on his iPad for completely innocuous searches like "Apple Canada support", while I get completely different results in the same house from my own devices. There's no way to report these incidents either.
- Tepix 4y ago
  Could it be that the device is already infected with malware-injecting things?
  - bcrl 4y ago
    No, I checked for that multiple times as I was around when that happened. It was an ad served up directly by Google that lead to a phishing website and phone numbers on it. His filter bubble is very different from mine, and it's clear that the peddlers of malware and scams use ad targeting to hit the elderly with ads that try to take advantage of them. This is a major downside of ad targeting: they're more effective for both good and bad purposes. Ads really should be less ephemeral than they are. Sometimes I see an ad I'm interested in but miss it before clicking a link at which point it's gone after hitting the back button. Similarly, if an ad is for a scam, there needs to be a way to go back, find it, and then flag it.

heywherelogingo 4y ago

Think twice before using Google.

yazzku 4y ago

Why isn't Google fined for distributing malware?

horsawlarway 4y ago

Honestly - just stop using Google search (and while I remain flabberghasted I'm saying this - Edge is a better chromium browser than Chrome.). Or better yet, any Google product. The company is diving off a cliff. For reference... A private Jellyfin server I use for hosting videos of my kid for his grandparents, and some music I legally own is consistently flagged as phishing (along with basically anyone else hosting them publicly based on this thread: https://github.com/jellyfin/jellyfin-web/issues/4076 https://github.com/jellyfin/jellyfin-web/issues/4076) Google has "automated" itself into the garbage.

kcartlidge 4y ago
> and while I remain flabberghasted I'm saying this - Edge is a better chromium browser than Chrome This is surprisingly true. On my work Windows laptop I switched as (a) the system overhead was less than half and (b) the performance was better. Been months, and other than the occasional wrong icon being clicked I've not launched Chrome since.
- horsawlarway 4y ago
  I use it on my Linux boxes, and it's better there too, which is really a bit stunning at the end of the day. I would have laughed in your face 10 years ago if you'd told me I would prefer a MS browser over chrome... but here we are. Google is rapidly becoming a dinosaur, and I don't think they have the ability (or perhaps desire) to change course. Frankly - I'd like to see their search monopoly broken up at this point. It's time for some fresh air in the space.

xbar 4y ago

Malware has been accompanied by lots more porn in Google search results in the past quarter. I switched to Duck Duck Go some time ago, but I hadn't required it for extended family. Now I do.

jerry1979 4y ago

Just to jump on the anti-google bandwagon, google news search has fell off a cliff over the past decade. Can anyone recommend a news search that allows me to filter by year or year range?

beckler 4y ago

Google owns VirusTotal... so why doesn't search get fed info from VirusTotal?

sneak 4y ago

I block all advertising links via DNS at my router. The first full page of Google links that are all ads are just broken links for me.

Havoc 4y ago

Confused why google isn't all over this double stat? If their advert area develops a reputation for being bad & untrustworthy then their business model breaks on a pretty fundamental level.

sys32768 4y ago

I wonder how the morale is on the Google search team these days. Maybe they can make a paid search that eliminates all affiliate sites in the results.

mastax 4y ago

I once saw a google search ad result for a malware version of GNU Cash. It was extremely easy to miss. The website was identical except the Windows download was replaced with malware instead of linking to Sourceforge. The malware installer was signed with a key from a random Taiwanese electronics company (likely stolen). I emailed DigiCert and got the cert revoked. None of the scanners on VirusTotal flagged the installer. A GNU Cash malware wouldn't need to do any typical malware behavior (crypto mining, ransomware) because they could just send off your bank account credentials. Within half an hour of uploading to VirusTotal the website was replaced with a placeholder blog.

BeefWellington 4y ago
Yeah, especially with open-source stuff it's been a problem for a while. The GIMP team is regularly targeted this way and has been for years. 2022: https://www.bleepingcomputer.com/news/security/google-ad-for-gimporg-served-info-stealing-malware-via-lookalike-site/ https://www.bleepingcomputer.com/news/security/google-ad-for... 2015: (The SourceForge Fiasco) https://www.gimp.org/news/2015/05/27/gimp-projects-official-statement-on-sourceforges-actions/ https://www.gimp.org/news/2015/05/27/gimp-projects-official-... 2013: https://www.gimpusers.com/forums/gimp-user/15999-adware-malware-in-gimp-windows-distribution https://www.gimpusers.com/forums/gimp-user/15999-adware-malw...

lazyeye 4y ago

There must be a browser addon that removes the ads from Google search results.

bbu 4y ago

not so surprising when read about what a dump google ads has become: https://www.propublica.org/article/google-display-ads-piracy-porn-fraud https://www.propublica.org/article/google-display-ads-piracy...

eddhead 4y ago

Everyone should be using a package manager / store to get software, or from the official site. If they're not available, then get the vendor to publish them there. Winget / Choco / Scoop or even Windows Store. Same with whatever people use on Linux distros.

kazinator 4y ago

Contrarian viewpoint: When in the history of the web could you blindly download something from a page found by a search engine and install it? When has any search index ever conferred that level of trust to a result? I don't remember any year when you couldn't use a major search engine to find many an asshole site promising that the sought-after content is available if you first download and run their malware .exe file. "I found this page via Google, therefore its downloads are trustworthy" isn't a thing, hasn't ever, and likely isn't going to be any time soon (and implementing it would have downsides).

potbelly83 4y ago

I think we're moving back towards a 90s version of the web again. No search, just a list of hand curated sites of people who's opinions we trust. The only thing is now these will be likes specs of gold drowning in a sea of shit.

kcartlidge 4y ago
And no behavioural ads; contextual ones work good enough and have the benefits of (a) no tracking needed, (b) ads that actually relate to what you're looking at/searching for, (c) no monopoly marketplaces, and (d) sites able to host their own ads within a web that can survive off revenues without losing billions to Google and Meta. To be honest even if contextual ads are less efficient than behavioural ones (debatable) it's still worth it to rescue the web from what it has largely become.

yurikoif 4y ago

Isn’t this the norm for search engines? Guess you privileged westerners don’t know about Google’s alternative *in china* Baidu. Regular users just try to avoid every download link directly from it.

radiojasper 4y ago

- Install Firefox. To hell with Chrome as it's just a tracking device wrapped in a web browser. - Install a proper ad blocker. To hell with advertisments in search engines. - Swap Google for DuckDuckGo.

johnklos 4y ago

This article is too kind. We're supposed to believe that all the brilliant minds at Google can't keep ahead of scammers? Sorry, but I don't believe that. On the other hand, I do give Google credit for knowing when they can make more money by allowing a problem to exist than by fixing it. Google got everyone hooked by being decent, by giving good search results, by giving people decent and free-ish email accounts, et cetera. Now it's all going to shit, because they've got everyone hooked so their free(ish) offerings don't need to be good any more. My guess is that search sucks because they can extract more money from advertisers who want to buy their way out from under scammers. Email sucks because they want people to have to pay to get any answers when things are problematic, and we no that no normal human being can correspond with any human that works for Google without giving them money. A majority of the phishing spam I receive now come directly from Google's shitty mail services. Perhaps Google wants software providers to "buy" their way in to a higher position than scammers. Or perhaps Google wants software environments to seem to suck to make the Android marketplace better by comparison. I can't imagine any other reasons why Google would play dumb and allow this kind of gaming of their search results.

fsociety 4y ago
In reality this is probably due to orgs not working with each other or inefficiencies (aka negligence).. but yes their threat intel systems can most definitely detect these kind of ads.

BLKNSLVR 4y ago

Google's advertising has actually helped other search engines be safer and more useful. Google search acts as a magnet for all the crap you don't want when searching. Brave search, DDG, Searx, etc are all cleaner and therefore more useful.

t0bia_s 4y ago

Who search for installers on web should know about winget, scoop or chocolatey. https://winget.run/ https://winget.run/ https://scoop.sh/ https://scoop.sh/ https://chocolatey.org/ https://chocolatey.org/ For those who don't like command line, there is WingetUI: https://github.com/marticliment/WingetUI https://github.com/marticliment/WingetUI We should abandon old, inefficient and now dangerous habits.

meltyness 4y ago

Well, this is one way Google the $1.4T publicly-traded company can raise their ad revenue.

technick 4y ago

Do the fake click methods still work for driving up click cost of advertising? Maybe... we...ahem should launch a fake click campaign on these malware advertisers to attack their ad spend budget?