5 ms·
I feel like I should share a story here. The fight against spam is becoming a serious problem for legitimate businesses. I've suffered from the same malware is
by ashray 13y ago
I feel like I should share a story here. The fight against spam is becoming a serious problem for legitimate businesses.
I've suffered from the same malware issue earlier. Since we use ad networks for advertising it works as follows. 1 ad network has about 3000 different ads running in different locations. If any of those domains get compromised and blacklisted and Google notices that you served something from that domain - BOOM! You're on stopbadware.org and need to get your website reviewed. You block the ad, and apply for a review. To their credit, it takes about 24 hours for the whole process (review happens, they delist you, Google caches update, etc.). However, for 24 hours anyone who comes to your site or clicks on a google result for you, or clicks anywhere to come to you - Gets a massive warning. The cost in terms of lost revenue and reputation damage are almost incalculable. This has happened to me in the past, several times. I have severed relationships with several ad networks and yet this keeps happening - even with the most reputable networks and you try to stay ahead of the curve but if you fall behind even a bit, you may get blacklisted again. All this for a site that makes maybe $200/month.
Another problem I faced was with SURBL. It's a spam blacklist that works on a bizarre system. Basically if they find your domain name beind spammed around the internet (it could be anyone else doing it) they will blacklist you. What's worse is that providers like bitly, facebook, etc. use the SURBL blacklist. So what happens ? Well, one day someone goes and spams your domain on internet forums, etc. SURBL picks up on it. Then, suddenly all your facebook links, bitly links shared on twitter, etc. start showing warning pages. Basically someone clicks on your link on facebook and gets a page saying "This site may harm your computer". Ditto for Bitly as well.
I tried to get delisted but no one at SURBL would respond. I kept trying to get in touch through their online form but no one responded for 2-3 weeks. Finally, I did a whois on the domain, found the admin contact and emailed him. I also sent him a text on his phone. At last after about 4 weeks of being on SURBL I managed to get delisted.
That. Was. An. Ordeal.
This in my opinion is absolutely unacceptable. Spam blacklists do have a responsibility to be correct in their assessments. And if they do have a false positive for any reason, they should have a streamlined resolution process. Unfortunately, the internet is the wild west and shooting before asking questions appears to be quite acceptable in these parts. I recognize that a lot of this is an attempt to protect users but when I open my mom's PC, I still see a bunch of browser toolbars, bookmarking widgets, etc. etc. (malware, right ?) Folks are still getting phished. This fight needs to be rethought.
- tytso 13y agoThe problem with the block list business model is that false positives have a much lower negative cost to the black list provider than false negatives. Users who find that some spammer doesn't get blocked, will get really annoyed, and make their displeasure known to the blacklist provider (or just switch to some other blacklist). As long as it's not a very high visibility site which is getting blocked (i.e., it's just some startup or a relatively low-profile blog that gets blocked), it's no skin off the blocklist provider's back. So the problem with blacklists like SURBL is going to be a very hard one to fix; the dead hand of economics doesn't really care about irrelevant things like fairness or justice.
- username42 13y agoHave you heard about Blue Coat filter ? Insane categories with insane definitions. For example http://sitereview.cwfservice.net/catdesc.jsp?catnum=38&catmap=8&locale=en http://sitereview.cwfservice.net/catdesc.jsp?catnum=38&catma... the 3 sites listed as example of the category, are not in this category.
- teach 13y agoThose sites seem to fit the "Computers" category to me. (Note that sites can be in more than one category.)
- 300bps 13y agoI'm on the other side of this debate. Two years ago I was innocently using Chrome to read reddit when I suddenly got a virus in my computer that took me four hours to clean up from. Turns out it came from an ad on reddit. With things like ad networks distributing malware, Google and others should shoot first and ask questions later. http://www.reddit.com/r/announcements/comments/e7988/a_number_of_reddit_users_have_reported_finding/ http://www.reddit.com/r/announcements/comments/e7988/a_numbe...
- invisible 13y agoThe unfortunate thing is that more often than not some ad networks aren't punished but rather the downstream ad-space seller. It comes down to browsers half of the time having bad security principles. Anything can change window.location in an any iframe (on any domain) and the new sandboxing for iframes is HORRIBLE (not to mention the support of sandboxing itself is barely there). Ad networks work by passing the user around between networks until an ad is found but this removes any chance of being able to find who is responsible for a given bad ad. The entire thing is a security nightmare and the only "fix" Google can provide consists of blacklisting downstream websites that may indirectly link to a bad ad via ad networks. I don't disagree with Google's "fix" but I do think they should approach the problem on Chrome and show what good security means when it comes to ads for the other browser vendors.