4 ms·

So the site is clearly parasitic, doesn't add anything and detracts from security. The term "malicious" does imply a little more to me though, like it's actual

So the site is clearly parasitic, doesn't add anything and detracts from security. The term "malicious" does imply a little more to me though, like it's actually serving me altered software. I guess the question is whether doing this (injecting yourself into the download flow for an open source piece of software and profiting via ads while doing so) is "malicious". I can see an argument that it is, as at the very least the site very much looks like it's the official site unless you read the small print. I don't get the ads on that site at the moment. I assume they are the fake download button type of ad? In any case, we can fight this particular site, but as you point out if this is generated content then I don't see how we're going to manually fight the coming onslaught of similar endeavours, so if the search engines can't keep generated content off their results (and so far they haven't been able to), it's going to be an interesting few years.

cbozeman 2y ago
> I guess the question is whether doing this (injecting yourself into the download flow for an open source piece of software and profiting via ads while doing so) is "malicious". Yes. It's malicious. You're trying to earn money - in this case, ad revenue - on a piece of software with which you have nothing to do whatsoever. It's not only malicious, it's disgusting. I would state how I really feel, but dang would ban me.
- baobabKoodaa 2y ago
  > Yes. It's malicious. You're trying to earn money ... No, please stop trying to redefine words. That's not what "malicious" means. I agree with you that this website is disgusting and needs to be taken down (as in "down from google") because there's a very real risk that the unscrupulous owners of the website _will eventually serve malicious software_ to juice their profits. But simply serving ads is not what the word "malicious" means.
  - birdman3131 2y ago
    Given the number of full screen ad's claiming my computer is infected I have ran across just serving ad's is often enough to count as malicious. (Not saying all sites do that but I have seen it often enough.)
    - baobabKoodaa 2y ago
      Ok, so Google (the website) is malicious, Youtube (the website) is malicious, Facebook (the website) is malicious. Every single ad infested website in the world is malicious, according to you. Stop trying to change language. That's not what "malicious" means.
mirekrusin 2y ago
It may redirect for 99.99% of users for example. Or only for ip ranges that are not relevant targets.
- Flammy 2y ago
  Yeah my thought was similar: One day in the future its current behavior changes once it has built up enough traffic...
cnity 2y ago
Your definition of maliciousness is basically user-centric, rather than provider-centric. It is malicious from the perspective of the maintainers of N++ because it robs them of the ability to control their image for the users who find the product through the parasitic page (which is obviously a worse UX).
- benlivengood 2y ago
  In light of the long-term effort to subvert xz and get a backdoor into sshd it's feasible that these kinds of malicious sites have a second agenda; become popular enough as search results for a Free product to serve backdoored download links selectively or wholesale once they get enough traffic. Regardless of intent, the low-quality ad networks sites like that serve routinely serve fractional malware ads anyway (focus-stealing alert()-style "you are the 100,000th visitor" or "malware detected on your device" garbage).
  - cnity 2y ago
    Yes, though I was trying to expand the definition of malicious to include GPs own terms. Even if that never happened, the current situation is already malicious because the site erodes at the trust factor of the victim site in exchange for ad revenue.
- nurettin 2y ago
  You are bob. notepad-plus-plus.com is alice. Are you saying alice doesn't want eve to impersonate her because she is jealous?
afavour 2y ago
> The term "malicious" does imply a little more to me though, like it's actually serving me altered software. Just because it doesn’t today doesn’t mean it won’t tomorrow. Be “legit”, get links to your site, rise in the SEO ranks. Then maliciously alter the software.
throwaway598 2y ago
> (injecting yourself into the download flow for an open source piece of software and profiting In high frequency trading, the equivalent's called providing liquidity.

cbozeman 2y ago

> I guess the question is whether doing this (injecting yourself into the download flow for an open source piece of software and profiting via ads while doing so) is "malicious". Yes. It's malicious. You're trying to earn money - in this case, ad revenue - on a piece of software with which you have nothing to do whatsoever. It's not only malicious, it's disgusting. I would state how I really feel, but dang would ban me.

baobabKoodaa 2y ago
> Yes. It's malicious. You're trying to earn money ... No, please stop trying to redefine words. That's not what "malicious" means. I agree with you that this website is disgusting and needs to be taken down (as in "down from google") because there's a very real risk that the unscrupulous owners of the website _will eventually serve malicious software_ to juice their profits. But simply serving ads is not what the word "malicious" means.
- birdman3131 2y ago
  Given the number of full screen ad's claiming my computer is infected I have ran across just serving ad's is often enough to count as malicious. (Not saying all sites do that but I have seen it often enough.)
  - baobabKoodaa 2y ago
    Ok, so Google (the website) is malicious, Youtube (the website) is malicious, Facebook (the website) is malicious. Every single ad infested website in the world is malicious, according to you. Stop trying to change language. That's not what "malicious" means.

mirekrusin 2y ago

It may redirect for 99.99% of users for example. Or only for ip ranges that are not relevant targets.

Flammy 2y ago
Yeah my thought was similar: One day in the future its current behavior changes once it has built up enough traffic...

cnity 2y ago

Your definition of maliciousness is basically user-centric, rather than provider-centric. It is malicious from the perspective of the maintainers of N++ because it robs them of the ability to control their image for the users who find the product through the parasitic page (which is obviously a worse UX).

benlivengood 2y ago
In light of the long-term effort to subvert xz and get a backdoor into sshd it's feasible that these kinds of malicious sites have a second agenda; become popular enough as search results for a Free product to serve backdoored download links selectively or wholesale once they get enough traffic. Regardless of intent, the low-quality ad networks sites like that serve routinely serve fractional malware ads anyway (focus-stealing alert()-style "you are the 100,000th visitor" or "malware detected on your device" garbage).
- cnity 2y ago
  Yes, though I was trying to expand the definition of malicious to include GPs own terms. Even if that never happened, the current situation is already malicious because the site erodes at the trust factor of the victim site in exchange for ad revenue.
nurettin 2y ago
You are bob. notepad-plus-plus.com is alice. Are you saying alice doesn't want eve to impersonate her because she is jealous?

afavour 2y ago

> The term "malicious" does imply a little more to me though, like it's actually serving me altered software. Just because it doesn’t today doesn’t mean it won’t tomorrow. Be “legit”, get links to your site, rise in the SEO ranks. Then maliciously alter the software.

throwaway598 2y ago

> (injecting yourself into the download flow for an open source piece of software and profiting In high frequency trading, the equivalent's called providing liquidity.