Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No More Deceptive Download Buttons

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

41–50 of 263 posts

Re: No More Deceptive Download Buttons

#41

Post by cabirum »

RansomTime wrote: post #34
cabirum wrote: post #18

Google should detect and block the buttons, not display full-screen warnings. What next? "This site contains controversial views"? Or "Politically incorrect website ahead"?

Google can't block elements on sites it does not control. Warning users of phishing and warning users of speech that it finds objectionable are 2 different things entirely.

A deceptive button does not equal phishing. It just might (and most often does) open a non-malicious popup with some ad. (non-malicious in a sense it won't install ransomware to your PC)

And of course Google can easily integrate it's own ad blocker in Chrome if it chooses so.

Re: No More Deceptive Download Buttons

#42

Post by userbinator »

As I write this, the ranking of the comments here is... strange. Those who see this as being yet another way of Google using their power to manipulate what people see on the Internet are being heavily downvoted, while those agreeing with the practice are not? That doesn't feel like HN to me.

I'm in the former group. This mollycoddling is just going to lead to more users who can't decide for themselves whether something is suspicious or not and are thus easier to deceive, which might be exactly what Google wants, but I certainly do not think it is good for the Web as a whole (or even society in general.) Being able to make these sorts of decisions of trust is an important part of growing up in general, and I'd even say "finding the right download button" could be considered a sort of right of passage to being an effective user of the Web, and not just a consumer.

Re: No More Deceptive Download Buttons

#43

Post by kuschku »

derefr wrote: post #24
lexicality wrote: post #2

Perhaps now that Google has taken steps to block websites that display these ads, Google should take steps to stop accepting these ads onto their network in the first place. Most of the time when I see those DOWNLOAD/PLAY buttons, they're hosted on doubleclick.

I'm not sure they need to. Google's approach here tackles the problem of these ads being created from an economic direction: if nobody is seeing these ads, they won't make any CPM money any more, so their creators will stop running them. That's a much more sensible approach than doing what you're suggesting—trying to catch specific instances of people doing something nefarious that makes them money. That just causes…

It’s an approach that has many casualties, though.

Re: No More Deceptive Download Buttons

#44

Post by idiot900 »

whyleyc wrote: post #9

This is a joke right ? We run Adsense display ads on our site and have to spend significant time every day reviewing and blocking new ads which try to use these deceptive practices. Since Google clearly has the tech to detect this they should be implementing it at source on the advertisers (malvertisers). Instead they are pushing this down to the publishers and hitting them with penalties. It's a clever ploy in some…

Google doesn't control all advertisers. Presumably this applies to sites with non-Google ads too.

Also, if these ads are rejected immediately (or nearly so) by Google, it will provide that much more feedback that malicious advertisers can use to "improve" their ads that much more quickly.

Re: No More Deceptive Download Buttons

#45

Post by kuschku »

derefr wrote: post #33
mschuster91 wrote: post #31

Earlier quoted context omitted.

> The hard part here is that, wherever you'd decide to persist a "don't bug me any more about this" flag, Build a new binary - offer users to install a "developer" build of Chrome which is exactly the same as the mainstream "release" build, except it allows disabling the protections.

You don't actually have to go that far; there are plenty of Chrome settings controlled by command-line options, and that's usually safe enough—it's actually really hard for malware to "sneak in" command-line options (if the user is a regular user, while the the Chrome shortcuts in the Start Menu et al were installed under elevation, which is the usual case.) There's a command-line option to Chrome that entirely disab…

Adding a command line option that allows disabling the nags via a UI would be solution.

Re: No More Deceptive Download Buttons

#46

Post by sergiotapia »

oliv__ wrote: post #25

I know these fake ads all suck and everyone hates them but somehow getting rid of them feels like cutting off a little piece of what makes the web the web. I kinda like this darker, more free-for-all, wild wild west side of the Internet.

Me too man, I remember the internet back then where everything was unique and not a cookie-cutter bootstrap boilterplate. Want a nostalgia trip? Download Opera (one of the early versions) - it'll pluck at your heart strings and make you yearn for times when you had more personal responsibility and Google wasn't there to infect everything with it's nanny browser. Hell, even Firefox the last bastion of Freedom on the web, is following Chrome.

Re: No More Deceptive Download Buttons

#47

Post by userbinator »

derefr wrote: post #27
tdkl wrote: post #23

I hope they'll include a "Stop the nanny" flag in chrome://flags as well. I mean you can't even change the new tab page to a custom .html, without Chrome nagging you at every launch if the settings are correct. If you make a manifest.json and load as an unpacked extension, it will moan about that. FFS, I know what you're trying to do with Joe/Jane Noob, but at least give me something to skip that if I know what I'm d…

The hard part here is that, wherever you'd decide to persist a "don't bug me any more about this" flag, malware could also potentially write that same flag to that same place. For example, Windows UAC is frequently set to the "don't bug me about this, just auto-elevate" setting by malware.

So you're saying we should just obey Big Brother Google and not try to do anything it doesn't approve of?

As the old saying goes, "Those who give up freedom for security deserve neither."

Re: No More Deceptive Download Buttons

#48

Post by afandian »

danr4 wrote: post #40
afandian wrote: post #36

Earlier quoted context omitted.

You mean Google? I see a tonne of deceptive advertising propagated by Google's ad network.

No. I mean the companies whose sole business is to get you to download bundled malware, change your search engine, push ads to every site you browse using extensions etc. Source: I've worked at one of those.

Surely the companies that advertise via Google to try and deceive you to into clicking their download button or whatever fit the bill? And surely Google, by actively enabling them, is also part of the process. As stated elsewhere on this thread, if they can detect deceptive sites, they can detect deceptive adverts.

Re: No More Deceptive Download Buttons

#50

Post by mschuster91 »

derefr wrote: post #33
mschuster91 wrote: post #31

Earlier quoted context omitted.

> The hard part here is that, wherever you'd decide to persist a "don't bug me any more about this" flag, Build a new binary - offer users to install a "developer" build of Chrome which is exactly the same as the mainstream "release" build, except it allows disabling the protections.

You don't actually have to go that far; there are plenty of Chrome settings controlled by command-line options, and that's usually safe enough—it's actually really hard for malware to "sneak in" command-line options (if the user is a regular user, while the the Chrome shortcuts in the Start Menu et al were installed under elevation, which is the usual case.) There's a command-line option to Chrome that entirely disab…

> (if the user is a regular user, while the the Chrome shortcuts in the Start Menu et al were installed under elevation, which is the usual case.)

Nope. Windows allows deletion of "protected" shortcuts e.g. from your desktop and launch bar.

Post reply on HN