Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bing has been serving up malicious Google Chrome ads for months

forbes.com

Post reply on HN
Print view View original

241–249 of 249 posts

Re: Bing has been serving up malicious Google Chrome ads for months

#241

Post by kup0 »

baud147258 wrote: post #239
emmelaich wrote: post #167

I mentioned this in a comment over a year ago in a story about paint.net. https://news.ycombinator.com/item?id=14338174 > The Bing search engine is about as bad. A close friend used IE to get Google Chrome. They clicked the first result and luckily I was able to stop them before starting the install on some crapware. So I asked them to be careful to ensure the download site is correct and left them to it. I came back…

I've just checked on bing with IE and the first results are: - ad by Google for Google Chrome - ad by Mozilla for Firefox - 2 result on Google's site - one download site (didn't check if it's crapware) - two wikipedia links - the same ads at the tops

In one case, I saw where it looked like an ad by Google for Google Chrome- but once clicked, it actually led elsewhere (to a very well-constructed fake Google page)- even though on the result page the URL looked legitimate

Re: Bing has been serving up malicious Google Chrome ads for months

#242

Post by flamtap »

kayone wrote: post #220
weinzierl wrote: post #192

Call me paranoid, but every time I install software on Windows [1] I do the following dance: 1. Search for the name of the software on Google [2]. 2. Open link to software in separate tab. 3. Open Wikipedia link (usually on the same SERP) for software in separate tab. 4. Compare domain name from direct link with the domain name from the Wikipedia article. 5. Open another tab and type domain name manually. 6. Find dow…

Disclaimer: I'm the author/maintainer for AppGet [0]. What you explained here is one of the main selling points (as in convincing, appget is completely free) for appget. AppGet pretty much automates what you explained here and more. We automatically download and validate SHA256 of downloads (We have a strict policy of only allowing releases from the official source) All package info that is used to install applicatio…

I use Chocolatey right now. Are there any particular advantages that AppGet offers over Chocolatey?

Re: Bing has been serving up malicious Google Chrome ads for months

#243

Post by kayone »

flamtap wrote: post #242
kayone wrote: post #220

Earlier quoted context omitted.

Disclaimer: I'm the author/maintainer for AppGet [0]. What you explained here is one of the main selling points (as in convincing, appget is completely free) for appget. AppGet pretty much automates what you explained here and more. We automatically download and validate SHA256 of downloads (We have a strict policy of only allowing releases from the official source) All package info that is used to install applicatio…

I use Chocolatey right now. Are there any particular advantages that AppGet offers over Chocolatey?

There are a few :)

AppGet doesn't use custom scripts on install; everything is defined by data (YAML files). The client uses the data in the manifest and knows how to deal with different installers. This alone makes appget more secure; if you trust the client (it's opensource and managed by the core team) you don't blindly run a PowerShell script as admin on your machine.

Also, adding/updating packages is trivial since all you need to do is update/create a very simple YAML file. Another benefit is we can upgrade the client to better deal with let's say MSI installers, and none of the manifests need to be updated since all the logic is in the client, the manifest only needs to identify itself as MSI.

This also means you can install an app in different interactivity levels, Silent (everything happens in the background), Passive (you see the installer and progress, but you don't have to click next or do anything) or Interactive (appget downloads and validates the installer and just launches it for you, but you can run through the installer and customized it as you see fit)

Our packages are more up-to-date. We have a crawler that checks for updates on regular bases, we use GitHub api, and check vendor sites constantly (over 500K of check events per day). Trivial updates are automatically pushed to the repository, For non-trivial ones the bot automatically creates a pull-request on GitHub to be reviewed by a human. Most cases we pickup updated releases for apps within hours.

AppGet can list, upgrade and uninstall apps that aren't even installed using appget. We check windows installer database as the source of truth. You can download appget right now, run "appget outdated" and I guarantee it'll find outdated apps for you.

I'm sure there are more things, this question comes up a lot, so I'm gonna spend some time and add a page to the documentation just for this.

Re: Bing has been serving up malicious Google Chrome ads for months

#244

Post by kakarot »

hayksaakian wrote: post #226
AnonymousPlanet wrote: post #199

Earlier quoted context omitted.

This is exacltly what you would get if you'd deliberately moved all links to the legitimate site way down. Maybe because it's your competition?

Or if Bing was more susceptible to spam and abuse than Google

Well after Bing got busted for scraping Google's results, they had to scramble to implement their own terrible search algorithm.

Re: Bing has been serving up malicious Google Chrome ads for months

#245

Post by kakarot »

kayone wrote: post #243
flamtap wrote: post #242

Earlier quoted context omitted.

I use Chocolatey right now. Are there any particular advantages that AppGet offers over Chocolatey?

There are a few :) AppGet doesn't use custom scripts on install; everything is defined by data (YAML files). The client uses the data in the manifest and knows how to deal with different installers. This alone makes appget more secure; if you trust the client (it's opensource and managed by the core team) you don't blindly run a PowerShell script as admin on your machine. Also, adding/updating packages is trivial sin…

Chocolatey completely turned me off from Windows package managers. I'm sure you're familiar with all of the sore points that make it more hassle than it's worth.

But your description of AppGet has convinced me to try it out. Thank you!

Edit: There seems to be no obvious way to globally set the install location for apps. This is critical for my setup, I don't install apps in Program Files, because my Windows partition is lean and on an ssd that is shared with other VMs. Apps are installed in another drive location. Is there any way to do this currently?

Re: Bing has been serving up malicious Google Chrome ads for months

#246

Post by kayone »

kakarot wrote: post #245
kayone wrote: post #243

Earlier quoted context omitted.

There are a few :) AppGet doesn't use custom scripts on install; everything is defined by data (YAML files). The client uses the data in the manifest and knows how to deal with different installers. This alone makes appget more secure; if you trust the client (it's opensource and managed by the core team) you don't blindly run a PowerShell script as admin on your machine. Also, adding/updating packages is trivial sin…

Chocolatey completely turned me off from Windows package managers. I'm sure you're familiar with all of the sore points that make it more hassle than it's worth. But your description of AppGet has convinced me to try it out. Thank you! Edit: There seems to be no obvious way to globally set the install location for apps. This is critical for my setup, I don't install apps in Program Files, because my Windows partition…

Thanks for the feedback, right now there is no global way to set this. However, I just created a GitHub issue for it https://github.com/appget/appget/issues/14

In the meantime, what you can do as a workaround, is to use `-i` param when installing apps to launch the installer in interactive mode. That will let you run through the installer and customize everything including the install location. I know it's not ideal, but if you want to use appget to automatically download, validate the installers and check for outdated apps, it might be a reasonable work-around.

Re: Bing has been serving up malicious Google Chrome ads for months

#247

Post by michaelmrose »

Xylakant wrote: post #175
jamieweb wrote: post #80

Earlier quoted context omitted.

GP's solution is valid for the majority of software - at least the sort of software that us HN folk probably use. Unfortunately Google Chrome is a bad example here as it's not available in most repos (since it's closed source).

> GP's solution is valid for the majority of software - at least the sort of software that us HN folk probably use. That’s a bold statement to make, especially since a single piece of malicious software is sufficient. And yes, I want chrome. I need chrome. I need to test stuff on chrome.

Going to googles official webpage will tell you how to get chrome for Debian/Ubuntu/Opensuse/Fedora. This is about as good as it can be because chrome is closed source.

Chromium is available in the repos.

Re: Bing has been serving up malicious Google Chrome ads for months

#248

Post by flamtap »

kayone wrote: post #243
flamtap wrote: post #242

Earlier quoted context omitted.

I use Chocolatey right now. Are there any particular advantages that AppGet offers over Chocolatey?

There are a few :) AppGet doesn't use custom scripts on install; everything is defined by data (YAML files). The client uses the data in the manifest and knows how to deal with different installers. This alone makes appget more secure; if you trust the client (it's opensource and managed by the core team) you don't blindly run a PowerShell script as admin on your machine. Also, adding/updating packages is trivial sin…

Thanks so much for the response, and I am sure it does get asked a lot. I will be sure to keep an eye on your project in the future!

Re: Bing has been serving up malicious Google Chrome ads for months

#249

Post by kakarot »

kayone wrote: post #246
kakarot wrote: post #245

Earlier quoted context omitted.

Chocolatey completely turned me off from Windows package managers. I'm sure you're familiar with all of the sore points that make it more hassle than it's worth. But your description of AppGet has convinced me to try it out. Thank you! Edit: There seems to be no obvious way to globally set the install location for apps. This is critical for my setup, I don't install apps in Program Files, because my Windows partition…

Thanks for the feedback, right now there is no global way to set this. However, I just created a GitHub issue for it https://github.com/appget/appget/issues/14 In the meantime, what you can do as a workaround, is to use `-i` param when installing apps to launch the installer in interactive mode. That will let you run through the installer and customize everything including the install location. I know it's not ideal,…

Still a good enough workaround to leverage the benefits of the trusted repository. Thanks for the tip! Definitely interested in seeing #14 get addressed :)
Post reply on HN