Earlier quoted context omitted.
>_Privacy: They [FF] can act as anonymous proxy. I think he's talking about the file contents.
Indeed I was. I should have been more verbose on that bullet. :)
Ah! Good point.
Is Firefox lying to users about viruses in downloads?
61–70 of 76 posts
Re: Is Firefox lying to users about viruses in downloads?
#62Earlier quoted context omitted.
And if only developers understood UX. The "lie" the author was complaining about was that Firefox is miscommunicating what it did: It warned that a concrete file was containing malware when it actually found a suspicious domain. Depending on context, that might make a huge difference - e.g., if a user got such a warning for a file they uploaded themselves, they might get the wrong impression that their system is comp…
> And if only developers understood UX. I've upvoted you, since I think your point is good, I'd just add that as a developer, I've found myself on more than one occasion pushing for the type of UX being advocated here, and getting pushback from designers/PMs. Typically, the issue I run into is a desire for the UX to be "simple", sometimes simpler than the system underlying it actually is (or is even capable of being)…
Yea, that s happens all the time in software. It’s the developer’s job to push back and explain the probability distribution of the results to the designers/PM so they understand the algorithm’s limitations, and everyone’s job to fight for the user. It needs to be a conversation, not a contract.
Designer: This label is required to say what store the user is at given his location.
Developer: the location sensor is imprecise. We could have 20m of precision or worse. The store location data is also known to be inaccurate and incomplete. We can provide top 10 candidate stores with their probabilities. The “top” one we return could be 95% likely or 35% likely. Your move!
Bad Designer: Too much numbers for my brain. We’ll just show the top result. YOLO!
Better designer: We could only show a result if it’s above a certain threshold. Or we could show top 3. Or maybe we need to talk about changing the requirement.
Better developer: There may be other signals and inputs we could use to help make the results more confident...
Re: Is Firefox lying to users about viruses in downloads?
#63Earlier quoted context omitted.
What you say is true, but how is this relevant to the discussion at hand?
It speaks to the argument that “if this site is serving up infected files, all files it serves should be treated as potentially infected”
That would include domains like dropbox.com or drive.google.com then?
Re: Is Firefox lying to users about viruses in downloads?
#64Earlier quoted context omitted.
It speaks to the argument that “if this site is serving up infected files, all files it serves should be treated as potentially infected”
That would include domains like dropbox.com or drive.google.com then?
Security is always complex, and simple rules always have flaws. That doesn’t mean simple rules are always bad, it just means people who build systems around them do need to understand they need to do more than just blindly follow simple rules. I’m pretty sure you’ll find FF doesn’t alert on those sites, because they are being handled by a more complex rule than a vanilla low or medium traffic site.
Re: Is Firefox lying to users about viruses in downloads?
#65Earlier quoted context omitted.
Until the moment where you really need that file.
This. Firefox has become far more aggressive in policing use. For ex., if HTTPS is misconfigured 60.0.2 no longer offers an option for one time exceptions, now there's only 'get me out of here' and 'report to mozilla' buttons. Perhaps someone more familiar with ff's config knobs will post the knob name.
I'm running 60.0.2 and I still have the option to add an exception, under "Advanced". What you describe only happens when the site is so badly misconfigured that no connection is possible (e.g. protocol errors).
Re: Is Firefox lying to users about viruses in downloads?
#66Earlier quoted context omitted.
In my book, flagging as malware something that is not malware is lying, or at least a false positive. So, spoiler: it's a bit more nuanced than "yes" or "no".
In my book, there is a lot of distance between "lying" and "false positive"
Which really shrinks when it's about presenting the known-failible process as 100% reliable, which the wording/UX seem to suggest in this case.
I can understand the reasoning behind this, I've seen it done multiple times to my own projects by the UX guys. I don't really know if it's net-positive strategy or not, but the fact that there is a lie involved at some level is undeniable. At least to those who didn't drink too much Kool-Aid and don't think the average user is too stupid to comprehend the truth, and therefore that it makes no sense to present it to the users.
I may be biased in the other direction, but every time I see a discussion about "dark patterns" in UI I get a feeling that they differ from the "light" ones only in what is the goal of the manipulation, but with methods surprisingly similar on both sides.
Re: Is Firefox lying to users about viruses in downloads?
#67The history of Google's "SafeBrowsing" with respect to Firefox is a real mixed bag. The privacy protections Mozilla asked for from Google were begrudgingly implemented. As a Linux user, I used to just turn it off.
Re: Is Firefox lying to users about viruses in downloads?
#68This is how every other browser does it too. I'd be more alarmed if my browser had an inbuilt antivirus.
You would be alarmed that the largest attack vector decided to build in a system to detect attacks?
Re: Is Firefox lying to users about viruses in downloads?
#69Earlier quoted context omitted.
Until the moment where you really need that file.
This. Firefox has become far more aggressive in policing use. For ex., if HTTPS is misconfigured 60.0.2 no longer offers an option for one time exceptions, now there's only 'get me out of here' and 'report to mozilla' buttons. Perhaps someone more familiar with ff's config knobs will post the knob name.
You cannot add exception for domain using HSTS.
Re: Is Firefox lying to users about viruses in downloads?
#70Earlier quoted context omitted.
Understand security, if there is malware in one file on your server you burn down the server and set up new one. If your machine gets infected you format all because it is insecure by definition. You might even need to throw out physical machine... If you get one it downloads ten other and you don't know which one will pass your virus scanner. It is not fun and games anymore, silly nerds having fun are not doing it.…
What you say is true, but how is this relevant to the discussion at hand?
Every file you download from site serving pirated content is high potential for malware.
I trust Mozilla more than some pirated content website or their user.
If you need that content more than you are afraid to be hacked and understand risks involved you are good to go.
People who are not aware of that threat need to be warned. Telling nicely does not work and people will click OK without reading.
Just as I wrote it is not fun and games and magic unicorns from internetz are not giving latest movies/programs for free.
Yes it is censorship, but as I wrote if you understand the risk and know what to do you will find your way to download it without firefox.