4 ms·

A lookalike site carefully curated to rise in search result ranking over time can trivially start delivering malware at any point. It happens enough that it’s w

A lookalike site carefully curated to rise in search result ranking over time can trivially start delivering malware at any point. It happens enough that it’s warranted here. No reason not to report it for many things. It’s illegitimate and has no right to protection.

danpalmer 3y ago
It can also... not deliver malware. The point at which it would be of interest to Safe Browsing would be the point at which it starts delivering malware, and reporting it before then is only going to create false positives that could make it harder to report if/when it did start distributing malware. The Safe Browsing project is not about judgement calls on whether a website is a good citizen or not. The whole point is to have a global database of obviously bad stuff that is not about any sort of editorial control, curation, etc. That way it's a clear win for browsers to implement, and there's little criticism that can be levelled against it for preferential treatment etc. Cloudflare's Radar seems to have a different scope, and may be a more appropriate place to report this site.
- Chabsff 3y ago
  Fraudulently pretending to be a trusted authority (trusted enough to click a download link clears the bar) is sufficient to get flagged as Social Engineering, under the deceptive content category, by Safe Browsing. See https://developers.google.com/search/docs/monitor-debug/security/social-engineering https://developers.google.com/search/docs/monitor-debug/secu...
  - danpalmer 3y ago
    Ah, interesting, this is still under Safe Browsing, but it's distinct from the malware reporting that the blog post directs people to. Reports for this would get the site classed as deceptive (which it sounds like it is), but not for malware distribution. That sounds like a good option, perhaps the best option for the Notepad++ blog post to direct people to. Fortunately/unfortunately I still can't load the site on any device or browser so I'm not actually sure what it looks like or how obvious it is.
Zambyte 3y ago
notepad-plus-plus can also trivially start delivering malware at any point btw.
- baobabKoodaa 3y ago
  Sure, but we both know the odds of the scam website delivering malware is about 10000x higher than the odds of the real website delivering malware.
  - deleted 3y ago
    [deleted]
gunapologist99 3y ago
Any website can deliver malware at any point. Should we report them all? If we start predicting that they will, we've turned the internet into minority report. Just because people are jerks and making money off deceptive ads doesn't specifically mean they're going to start serving malware.. it just means they're jerks.
- earthnail 3y ago
  No, but in this instance it’s so clearly targeted at a particular program that it really starts becoming dangerous for the makers of said program. Not all third party download sites are evil. But this one is in the veru dark gray area. It is correct to report it now as a threat before something bad actually happens.
  - danpalmer 3y ago
    Report it as what, and to who? If you report it as distributing malware when it doesn't it's just crying wolf, and will only take up time from actual malware reporting, or make this less likely to be classed as malware in the future if/when it does distribute it. Reporting it as trademark infringement to the hosting provider under the DMCA is most likely the best course of action, the one most likely to lead to a take down. That's assuming there's a trademark on Notepad++.
- PurpleRamen 3y ago
  It's a matter of probability. It's unlikely that an original project will start becoming abusive on its own, especially if it has a long history of trust. Someone unrelated, who is just high jacking other's fame and has built no trust on its own? More likely. And if it's just a throwaway ad-farm that was set up once, it's likely not receive much care. So there is a higher chance that a hack of the site will go under for a long time, or that the owner will just sell it at some point to a malicious actor. Anyone being long on the internet has seen such things happen more than enough, so many people have a legitimated lack of trust against those sites.
EasyMark 3y ago
reporting it to google as a shitty link is one thing, reporting it some place that is used for reporting malicious (aka dangerous) software sites seems wrong to me.

danpalmer 3y ago

It can also... not deliver malware. The point at which it would be of interest to Safe Browsing would be the point at which it starts delivering malware, and reporting it before then is only going to create false positives that could make it harder to report if/when it did start distributing malware. The Safe Browsing project is not about judgement calls on whether a website is a good citizen or not. The whole point is to have a global database of obviously bad stuff that is not about any sort of editorial control, curation, etc. That way it's a clear win for browsers to implement, and there's little criticism that can be levelled against it for preferential treatment etc. Cloudflare's Radar seems to have a different scope, and may be a more appropriate place to report this site.

Chabsff 3y ago
Fraudulently pretending to be a trusted authority (trusted enough to click a download link clears the bar) is sufficient to get flagged as Social Engineering, under the deceptive content category, by Safe Browsing. See https://developers.google.com/search/docs/monitor-debug/security/social-engineering https://developers.google.com/search/docs/monitor-debug/secu...
- danpalmer 3y ago
  Ah, interesting, this is still under Safe Browsing, but it's distinct from the malware reporting that the blog post directs people to. Reports for this would get the site classed as deceptive (which it sounds like it is), but not for malware distribution. That sounds like a good option, perhaps the best option for the Notepad++ blog post to direct people to. Fortunately/unfortunately I still can't load the site on any device or browser so I'm not actually sure what it looks like or how obvious it is.

Zambyte 3y ago

notepad-plus-plus can also trivially start delivering malware at any point btw.

baobabKoodaa 3y ago
Sure, but we both know the odds of the scam website delivering malware is about 10000x higher than the odds of the real website delivering malware.
- deleted 3y ago
  [deleted]

gunapologist99 3y ago

Any website can deliver malware at any point. Should we report them all? If we start predicting that they will, we've turned the internet into minority report. Just because people are jerks and making money off deceptive ads doesn't specifically mean they're going to start serving malware.. it just means they're jerks.

earthnail 3y ago
No, but in this instance it’s so clearly targeted at a particular program that it really starts becoming dangerous for the makers of said program. Not all third party download sites are evil. But this one is in the veru dark gray area. It is correct to report it now as a threat before something bad actually happens.
- danpalmer 3y ago
  Report it as what, and to who? If you report it as distributing malware when it doesn't it's just crying wolf, and will only take up time from actual malware reporting, or make this less likely to be classed as malware in the future if/when it does distribute it. Reporting it as trademark infringement to the hosting provider under the DMCA is most likely the best course of action, the one most likely to lead to a take down. That's assuming there's a trademark on Notepad++.
PurpleRamen 3y ago
It's a matter of probability. It's unlikely that an original project will start becoming abusive on its own, especially if it has a long history of trust. Someone unrelated, who is just high jacking other's fame and has built no trust on its own? More likely. And if it's just a throwaway ad-farm that was set up once, it's likely not receive much care. So there is a higher chance that a hack of the site will go under for a long time, or that the owner will just sell it at some point to a malicious actor. Anyone being long on the internet has seen such things happen more than enough, so many people have a legitimated lack of trust against those sites.

EasyMark 3y ago

reporting it to google as a shitty link is one thing, reporting it some place that is used for reporting malicious (aka dangerous) software sites seems wrong to me.