Is Firefox lying to users about viruses in downloads?

Post by xg15 » Wed, Jul 04, 2018, 3:53 PM UTC

Piskvorrr wrote: post #15

yjftsjthsd-h wrote: post #8

Earlier quoted context omitted.

... so, materially yes? As a user, I don't care that they have an excuse, I care that they said "this file is a virus" when the file was not a virus.

Not really. "Lying" includes an intent to deceive. I would have been okay with "raises false alarms", "generates false positive" or even "confuses and/or misleads users". As a user, I want to be better safe than sorry - but would perhaps be happier with a finer classification than "no problem/OMG VIRUS!"

Post by mediocrejoker » Wed, Jul 04, 2018, 3:57 PM UTC

davidsong wrote: post #30

There are several ebooks that have been uploaded to libgen that contain PDF exploits, and from what I understand there's no way to remove them. The way that their library database works is by linking a book number to a file's md5 sum. On the filesystem they are stored something like `$drive:\$batch\$sum` where `$drive` is a Windows drive letter, `$batch` is the primary key of the document rounded to the nearest 1k, 1…

Post by gruez » Wed, Jul 04, 2018, 3:59 PM UTC

mc32 wrote: post #13

sus_007 wrote: post #6

Firefox isn’t necessarily scanning the files for viruses, they’re often just using databases that list domains suspected of hosting malware. IIRC, Chrome does the same thing too. I think it's not much of an issue for Firefox to flag stuffs downloaded from suspected URLs as a malware since it's not uncommon to have one's system infected from those sites' content. Firefox is just trying it's best to prohibit any sort o…

I wonder why they can’t integrate some service like VirusTotal into their downloader. Sure, for heretofore new objects it’ll take longer, but they have a long list of many many file hashes and their reputation dB .

Post by gruez » Wed, Jul 04, 2018, 4:01 PM UTC

mc32 wrote: post #31

laumars wrote: post #23

Earlier quoted context omitted.

There are quite a few reasons I can think of: * Privacy * Performance * They would likely have to work with Virus Total to support their infrastructure as I can only imagine how quickly they'd take such a cloud service offline if everyone started using it by default * And then what happens if / when the cloud service does have an outage? Does that mean people are blocked from downloading things? * Same question for p…

Those are good things to think about, but I'll give them a stab: _Privacy: They [FF] can act as anonymous proxy. _Perf: Yes, for new objects, but for known objects, it should be minimal. _Service outage: Build a system which can allow an override (download at your own peril, while service is out) _Corp should already have enterprisey systems in place _New, unknown object: Yes an issue. As someone else said [GlitchMr]…

Post by nebulous1 » Wed, Jul 04, 2018, 4:08 PM UTC

yodon wrote: post #21

If only the voting public understood about statistics, false positives, and false negatives. Even if Firefox did a full virus scan, there would still be false positives and false negatives in the results. The system designer always has to put their reporting threshold somewhere, and that always means making a decision to bias towards false positives or false negatives. Eliminating false positives means exploding the…