Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bing has been serving up malicious Google Chrome ads for months

forbes.com

Post reply on HN
Print view View original

91–100 of 249 posts

Re: Bing has been serving up malicious Google Chrome ads for months

#91

Post by mikeash »

simongr3dal wrote: post #58

I never quite understood the appeal of giving some unknown third-party the right to put links and text and javascript onto your site. It might be labour intensive to have human eyes on every ad that is sold when you're at Google, or even Bing, scale. But it seems a little bit too hands-off, and irresponsible, to take money without vetting the input and then letting every scammer get into that very "blessed" and visib…

A lot of tech company woes come down to an insistence on automating things that really need human attention.

Your recommended children’s videos are actually disturbing parodies? Easily solved with human curation. Some Alex Jones story makes its way into your news aggregator? Having people check the story would fix this. Scammy or malware-ridden ads on your site? See above.

Obviously this isn’t practical for everything, but tech companies take it way beyond what’s necessary, then act like the problems are impossible to avoid.

Re: Bing has been serving up malicious Google Chrome ads for months

#92

Post by Sephr »

vezycash wrote: post #42
beager wrote: post #17

Earlier quoted context omitted.

> Bing makes it clear when a site is promoted by prepending "ad" to the search result. Other search engines such as DuckDuckGo and Google do the same. They very specifically do not make it clear, they (and I mean all of them) intend to make sponsored results look as identical as possible to organic results to improve the likelihood that you'll click them. They only have subtle markings showing that they're ads becaus…

>the Bing ad shows the domain as `google.com There's a reason for this - ad tracking for conversion, performance or even to make sure the advertising network is honest. The ad tracking domain is not always the same as destination domain. AFAIK, this problem seems easily solved. All Ms has to do is flag ads whose displayed URL do not match the final URL for manual review. Or simply ban it.

> All Ms has to do is flag ads whose displayed URL do not match the final URL for manual review. Or simply ban it.

The ad did match the final URL, it just selectively redirected to the legitimate or malicious page based on user agent. See https://twitter.com/sephr/status/1055751684146655232?s=19

Re: Bing has been serving up malicious Google Chrome ads for months

#93

Post by mikeash »

vezycash wrote: post #41
nhkssol wrote: post #2

Bing makes it clear when a site is promoted by prepending "ad" to the search result. Other search engines such as DuckDuckGo and Google do the same. It is near impossible for Bing to manually review every advert so perhaps it would be beneficial for search engines to provide a way for users to report rouge promoted links, similar to how YouTube allows you to report its sidebar ads.

>It is near impossible for Bing to manually review every advert I don't agree with this. Reviewing ads should be a straight forward process, much more so than reviewing an app submission. Plus, obvious issues can easily be automated, reducing the load of manual reviews.

It’s easy for Bing to manually review every ad. What’s hard is manually reviewing every ad while maintaining their current prices and profit margins.

Re: Bing has been serving up malicious Google Chrome ads for months

#94

Post by saagarjha »

fjsolwmv wrote: post #75
TaylorAlexander wrote: post #69

Earlier quoted context omitted.

This is a tangent/pile-on, but this is not the only dark pattern google engages in. I absolutely do not want YouTube Red. Any software that respects the user would let you dismiss the offer with an option for “do not ask me again.” And yet, because the software is not respecting the user, YouTube asks me ad nauseum if I want to upgrade to YouTube Red. No. I do not. But I don’t get an option for no. There is something…

Ad-supported software has ads. No liking the ads and refusing to pay for the product isn't a grand moral stand.

This isn’t the same thing. Some people are happy with viewing ads in general, but are not happy with aggressive pop-ups that tell them to upgrad. In essence these alerts are saying their choice is the wrong one, even though it’s a choice that YouTube itself gave them.

Re: Bing has been serving up malicious Google Chrome ads for months

#95

Post by OliverJones »

It's possible to install Google Chrome on a Windows box with chocolatey, the Windows answer to apt and brew.

But, still, Microsoft's browsers still aren't good. In my workplace (where we do some complex cross-browser work) they're an enormous nuisance to development and QA. I wish Edge were far better than IE, but they're both quirky. Firefox and Google Chrome ordinarily work predictably. Safari has a few quirks, Edge is really quirky, and IE is a narrow gauge steam train, all different.

Why doesn't Redmond stop throwing good money after bad and just license Firefox? Are they stuck in the sunk-cost fallacy?

Re: Bing has been serving up malicious Google Chrome ads for months

#96

Post by kbenson »

RandyRanderson wrote: post #86
josteink wrote: post #65

Earlier quoted context omitted.

> If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? Simply visit Google.com, Gmail, Youtube or any other Google-site and await the Chrome-spam 100% guaranteed to appear in any browser not Chrome. My favorite one: “Upgrade your browser”. Not misleading at all, eh? How about “no”?

I'm not a fan of the tactic either but MS does the same thing all the time. Also FF, Chrome and Safari ARE upgrades to Edge/IE by any reasonable metric. You've probably never had to write a non-trivial cross browser app. Try it and then let's see how you feel.

Yeah, picking on the upgrade wording is tricky, and cuts both ways. It has a common, semi-specific meaning with computers, but has also been used for far longer in the more general way it's used here.

If you say "I upgraded my stereo system", I would consider the chance you meant that to imply you got better versions of the same devices from the same manufacturer to be essentially nil.

I'm that respect, it may seem misleading if you do a lot of work with computer or have for many years, buts maybe it isn't much to a layperson?

Re: Bing has been serving up malicious Google Chrome ads for months

#97

Post by Sephr »

anonred wrote: post #38
flipp3r wrote: post #18

Earlier quoted context omitted.

> And the problem seems to have been fixed. When I search for chrome download on Bing, the top result is https://www.google.com/chrome . Which could be faked, as seen in the referenced tweet: https://twitter.com/GabrielLandau/status/1055300918101598208 Yes, they show the word "Ad", alongside the domain name "google.com" - except the user doesn't end up on "google.com".

Perhaps the ad was using one of the Google redirect tricks? There’s a few google.com endpoints (if I recall) that you can abuse to redirect to arbitrary URLs.

At first I suspected this as well, but apparently it was a link to itracking[.]services and Bing pre-resolved the redirect chain.

You can spoof any domain you want in Bing Ads without needing an open redirect.

Re: Bing has been serving up malicious Google Chrome ads for months

#98

Post by saagarjha »

RandyRanderson wrote: post #86
josteink wrote: post #65

Earlier quoted context omitted.

> If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? Simply visit Google.com, Gmail, Youtube or any other Google-site and await the Chrome-spam 100% guaranteed to appear in any browser not Chrome. My favorite one: “Upgrade your browser”. Not misleading at all, eh? How about “no”?

I'm not a fan of the tactic either but MS does the same thing all the time. Also FF, Chrome and Safari ARE upgrades to Edge/IE by any reasonable metric. You've probably never had to write a non-trivial cross browser app. Try it and then let's see how you feel.

I don’t use Edge, but it’s unfair to characterize Edge as a “downgrade” for all people. The average user cares much more about being able to annotate webpages (for example) than having access to the latest web standard. So the “upgrade” you’re talking about is only from the point of view of the web developer, which is usually the wrong way to think about this kind of stuff. If you go far enough along the path of prioritizing the developer over the user, you end up with stuff like Electron, which penalizes users for not “upgrading” to Chrome and deciding they wanted a native app instead.

Re: Bing has been serving up malicious Google Chrome ads for months

#99

Post by azifali »

Unfortunately the problem is not with Bing alone. There are multiple ad networks including admob owned by google, who will serve a url, or sometimes a script for an ad. That is unfortunately just how advertising works.

The industry never matured (to handle spam, malicious content or fraud) thanks to the Duopoly of Fb and Google, and even the biggest players are not immune to these issues as the onus is on the user to not to click on ads that offer to upgrade browsers, or any system software through ads.

It is the same systems that served malicious election results, the same systems that contributed to the echo chambers that impacted recent elections.

Re: Bing has been serving up malicious Google Chrome ads for months

#100

Post by saagarjha »

fjsolwmv wrote: post #74
beager wrote: post #22

Earlier quoted context omitted.

> The problem has nothing to do with the Edge browser, it has to do with search results returned by Bing, which happens to be Edge's default search engine. I think you're slicing this too thinly. This has everything to do with Edge, which is purposely configured to use a search engine that creates a liability for users. I would agree that "stop using Edge to download Chrome" is not useful and probably clickbait-y. A…

Microsoft could just as well ship Firefox with Bing as the default search. The problem is Bing.

Why would Microsoft do this?
Post reply on HN