4 ms·

I can't be the only one here that think Google has way too much power for anyone's good. This being said, I have no idea what could be done, if anything, to av

by ddalex 13y ago

I can't be the only one here that think Google has way too much power for anyone's good. This being said, I have no idea what could be done, if anything, to avoid being in a situation where Google can, mistakenly, blacklist your from the Internet. This is why I stopped using Chrome, and learned to love Firefox, again.

softmodeling 13y ago
I'm ashamed to confess that when I saw this, I wished the world was full of Internet Explorer users :-)
derefr 13y ago
We could require that Google, Microsoft, Mozilla et al use only third-party open blacklists (and contribute to those projects with their blacklist data if they feel they know more than the project does, but where the project has final say in what does or doesn't go in.) This decouples the incentive structure.
- tytso 13y ago
  My experience is that third party blacklists (especially for e-mail spam) have a much worse false positive problem. As I said in another comment, economics is working against you. There is relatively little or no cost to a blacklist provider if there is a false positive. And there are a lot of people who care very much about spam, or malware, who put a lot of pressure on blacklist providers to be as comprehensive and to react as quickly as positive. Heck, if you are looking at this from a larger social good perspective, it might even be better for society at large to have the blacklist provider be much more aggressive about blacklisting sites quickly. What's the cost of a malware compromising someone's machine, and requiring someone to take their desktop off-line for a day or more while they reinstall everything from scratch (and find out that they no longer can find their MS Office reinstall disks, and the new MS Office requires them to relearn where all controls are on the reorganized toolbar)? Versus the economic cost of some minor web site getting blocked for a few days? In any case, given that you as the minor web site won't be providing any payments to the blacklist provider, why do you assume the incentive structure will be any better with third-party blacklists?
  - derefr 13y ago
    I think the interesting thing about decoupling the incentive structure isn't so much how the blacklist operator would react (more liberal blacklists), but how the browser maker would react. Since the browser maker will no longer control the blacklist, they will now have users telling them that sites are broken (because they've been blacklisted), and they won't be able to do anything about it on the blacklist side. So, what they will be incentivized to do, is to make whitelisting a blacklisted site (especially those that only get loaded through invisible iframes etc.) have a much simpler/easier/clearer UX, so that their complaints go down. This is good for everyone, but it's not something they'll do when they still have the option "just remove X from the blacklist."
    - tytso 13y ago
      But the sites aren't really _broken_. There will be a warning displayed to the user, but the user can always say, "give me the site anyway". And users do hate it when they hit a web site which trashes their machine with malware. So they might be in favor of more stringent blacklists as well. It might be a bad assumption that users will demand a more liberal blacklist. That's certainly not how e-mail blacklists have worked out. Sometimes the people most in favor of the blacklists that hit all sorts of innocent mail senders are the users sick and tired of spam.
      - eli 13y ago
        Have you seen the "warning" lately? It's a pretty dire message. The only button visible is "Go Back." You have to click a tiny "advanced" text link to even see that there's an option to go to the site anyway. Try for yourself in Chrome: malware.testing.google.test/testing/malware/
- tomrod 13y ago
  I'm not sure we want to start down the route of legislation. Could you imagine the end result of Google-as-regulated-utility? Spammer's dream!
  - derefr 13y ago
    I didn't really mean legislation--just strong grassroots demand. These are corporations, and they'll build the features their customers want, after all. Maybe we just need a a Kickstarter to pay for the engineering time required to get this coded into Firefox and Chromium. If Mozilla or Google don't like it, call the result a fork and start a campaign for people to switch, as happened with OpenOffice+LibreOffice, or with MariaDB. Of course, I think both Google and Mozilla are smart enough that they'd see what was happening there, and just adopt the open blacklists. As browser-users, I believe that we really do have the ability to affect the decisions of these companies, if we have something we can all get behind. :) (...at least, if it doesn't directly interfere with their bottom line, like including an ad-blocker in Chrome would for Google. Can't have everything.)
magicalist 13y ago
> This is why I stopped using Chrome, and learned to love Firefox, again Firefox uses Google for safe browsing filtering.
taopao 13y ago
The author acknowledged ITT that the site probably did serve malware. The right thing was done IMO. Wouldn't it be worse if the OP was blamed for infecting his users? "Probably both sites were infected at some point. Again, I never saw the malware message myself but the guy that alerted us first copied the message he got and it was explicitly mentioning the demo site: “Content from demos.shapingrain.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your Mac with malware.”"

by ddalex 13y ago

softmodeling 13y ago

I'm ashamed to confess that when I saw this, I wished the world was full of Internet Explorer users :-)

derefr 13y ago

We could require that Google, Microsoft, Mozilla et al use only third-party open blacklists (and contribute to those projects with their blacklist data if they feel they know more than the project does, but where the project has final say in what does or doesn't go in.) This decouples the incentive structure.

tytso 13y ago
My experience is that third party blacklists (especially for e-mail spam) have a much worse false positive problem. As I said in another comment, economics is working against you. There is relatively little or no cost to a blacklist provider if there is a false positive. And there are a lot of people who care very much about spam, or malware, who put a lot of pressure on blacklist providers to be as comprehensive and to react as quickly as positive. Heck, if you are looking at this from a larger social good perspective, it might even be better for society at large to have the blacklist provider be much more aggressive about blacklisting sites quickly. What's the cost of a malware compromising someone's machine, and requiring someone to take their desktop off-line for a day or more while they reinstall everything from scratch (and find out that they no longer can find their MS Office reinstall disks, and the new MS Office requires them to relearn where all controls are on the reorganized toolbar)? Versus the economic cost of some minor web site getting blocked for a few days? In any case, given that you as the minor web site won't be providing any payments to the blacklist provider, why do you assume the incentive structure will be any better with third-party blacklists?
- derefr 13y ago
  I think the interesting thing about decoupling the incentive structure isn't so much how the blacklist operator would react (more liberal blacklists), but how the browser maker would react. Since the browser maker will no longer control the blacklist, they will now have users telling them that sites are broken (because they've been blacklisted), and they won't be able to do anything about it on the blacklist side. So, what they will be incentivized to do, is to make whitelisting a blacklisted site (especially those that only get loaded through invisible iframes etc.) have a much simpler/easier/clearer UX, so that their complaints go down. This is good for everyone, but it's not something they'll do when they still have the option "just remove X from the blacklist."
  - tytso 13y ago
    But the sites aren't really _broken_. There will be a warning displayed to the user, but the user can always say, "give me the site anyway". And users do hate it when they hit a web site which trashes their machine with malware. So they might be in favor of more stringent blacklists as well. It might be a bad assumption that users will demand a more liberal blacklist. That's certainly not how e-mail blacklists have worked out. Sometimes the people most in favor of the blacklists that hit all sorts of innocent mail senders are the users sick and tired of spam.
    - eli 13y ago
      Have you seen the "warning" lately? It's a pretty dire message. The only button visible is "Go Back." You have to click a tiny "advanced" text link to even see that there's an option to go to the site anyway. Try for yourself in Chrome: malware.testing.google.test/testing/malware/
tomrod 13y ago
I'm not sure we want to start down the route of legislation. Could you imagine the end result of Google-as-regulated-utility? Spammer's dream!
- derefr 13y ago
  I didn't really mean legislation--just strong grassroots demand. These are corporations, and they'll build the features their customers want, after all. Maybe we just need a a Kickstarter to pay for the engineering time required to get this coded into Firefox and Chromium. If Mozilla or Google don't like it, call the result a fork and start a campaign for people to switch, as happened with OpenOffice+LibreOffice, or with MariaDB. Of course, I think both Google and Mozilla are smart enough that they'd see what was happening there, and just adopt the open blacklists. As browser-users, I believe that we really do have the ability to affect the decisions of these companies, if we have something we can all get behind. :) (...at least, if it doesn't directly interfere with their bottom line, like including an ad-blocker in Chrome would for Google. Can't have everything.)

magicalist 13y ago

> This is why I stopped using Chrome, and learned to love Firefox, again Firefox uses Google for safe browsing filtering.

taopao 13y ago

The author acknowledged ITT that the site probably did serve malware. The right thing was done IMO. Wouldn't it be worse if the OP was blamed for infecting his users? "Probably both sites were infected at some point. Again, I never saw the malware message myself but the guy that alerted us first copied the message he got and it was explicitly mentioning the demo site: “Content from demos.shapingrain.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your Mac with malware.”"