Is Firefox lying to users about viruses in downloads?

If only the voting public understood about statistics, false positives, and false negatives.

Even if Firefox did a full virus scan, there would still be false positives and false negatives in the results.

The system designer always has to put their reporting threshold somewhere, and that always means making a decision to bias towards false positives or false negatives. Eliminating false positives means exploding the number of false negatives.

Unfortunately, people like the OP don’t understand this, and yell angry things like “Firefox is lying to me!” Others here suggest FF should inject a bunch of weasel words like maybe and could and might. That’s a seemingly rational thing to do if you believe you’re informing a customer population that understands things like false positives and false negatives, but we have pretty clear evidence that they don’t. So FF makes a conscious informed decision to prefer reporting false positives over false negatives and then allows the user to override if they believe they know enough to do so. Sure, there are some costs to false positives, but they are dwarfed by the cost of false negatives.

There are quite a few reasons I can think of:

* Privacy

* Performance

* They would likely have to work with Virus Total to support their infrastructure as I can only imagine how quickly they'd take such a cloud service offline if everyone started using it by default

* And then what happens if / when the cloud service does have an outage? Does that mean people are blocked from downloading things?

* Same question for people on a corporate network who might have Virus Total blocked

* Same question for people on poorer internet connections as now the user has to transfer twice as much data if it's not a hash already stored on Virus Total.

That all said, its a cool idea for a third party browser add-on (if it hasn't already been done?)

I would suggest it might also force some sites to more actively police their site for malware to get off of the list.

And if only developers understood UX.

The "lie" the author was complaining about was that Firefox is miscommunicating what it did: It warned that a concrete file was containing malware when it actually found a suspicious domain.

Depending on context, that might make a huge difference - e.g., if a user got such a warning for a file they uploaded themselves, they might get the wrong impression that their system is compromised.

As the author noted, simply describing the actual threat would clear this up.

> Sure, there are some costs to false positives, but they are dwarfed by the cost of false negatives.

This strategy has blown up a number of times already. If you present too many false positives, users might lose trust in you and ignore your predictions altogether.

I agree that finer classification is needed. However: if you decide to declare to a user that every individual file that might contain a virus does contain a virus, that's intentionally deceiving them. It's deciding "X% of the time, this statement will not be true, and we are ok with that" instead of building the uncertainty into the statement itself. So I don't see how this can not be considered lying, unless they believed there would be no false positives.