Google Safe Browsing can kill a startup • Hacker News Board

Re: Google Safe Browsing can kill a startup

#521

Post by rdm70 » Sun, Jan 17, 2021, 1:56 PM UTC

koalaman wrote: post #516

freedomben wrote: post #20

After years of seeing developments like this, getting worse and worse, it fills me with rage to think about how clearly nobody in power at Google cares. I naively used to think, "they probably don't realize what's happening and will fix it." I always try to give benefit of the doubt, especially having been on the other side so many times and seeing how 9 times out of 10 it's not malice, just incompetence, apathy, or…

(Googler) You are only focusing on the negatives while completely ignoring the positives here. Here are a few questions to consider that may give you better perspective: 1) Do you know the magnitude of financial and psychological damage caused by malware, phishing, etc on the web? 2) Do you believe that it is possible to have a human review every piece of automation generated malware on the internet? 3) Do you believ…

2*) Do you believe that it is possible to have a human review every FALSE POSITIVE result from automated malware detection on the internet, when reported by those adverse affected by the false positive result?

Yes, yes I do. Banks do it for their customers today at scale.

Re: Google Safe Browsing can kill a startup

#522

Post by ethbr0 » Sun, Jan 17, 2021, 2:10 PM UTC

d3nj4l wrote: post #450

kcartlidge wrote: post #332

Earlier quoted context omitted.

This lack of staffing is something that really annoys me. It's all over the big tech companies, and is often cited as the reason why (for example) YouTube, Twitter, Facebook, etc cannot possibly proactively police (before publishing) all their user content due to the huge volume. Of course they can; Google and the rest earn enough to throw people at the problems they cause/enable. If they can't, then they should stop…

There is a limit to which problems you can throw people at, though. Facebook’s and Youtube’s human moderators suffer from the trauma of watching millions of awful videos every day. Policing provocative posts that are dogwhistling while still allowing satire and legitimate free expression is incredibly challenging and requires lots of context in very different fields. It’s not as simple as setting up a side office in…

Yes: skilled labor. This is not a novel problem. Other companies create internal training pipelines and pay higher wages to attract those sorts of employees, when they're critical to business success.

Re: Google Safe Browsing can kill a startup

#523

Post by corinroyal » Sun, Jan 17, 2021, 2:18 PM UTC

remus wrote: post #327

oji0hub wrote: post #132

Earlier quoted context omitted.

They have the option of not wielding the hammer. I for one never appointed them the guardian of the walled internet.

> I for one never appointed them the guardian of the walled internet. On the other hand, lots of chrome users most likely do trust google to protect them from phishing sites. For those ~3 billion users a false positive on some SaaS they've never heard of is a small price to pay. It's a tricky moral question as to what level of harm to businesses is an acceptable trade off for the security of those users.

The trade-off isn't between increased phishing vs. increased false positives. It's being able to get a human on the phone vs Google's profit margins. Break them up already.

Re: Google Safe Browsing can kill a startup

#524

Post by kubanczyk » Sun, Jan 17, 2021, 2:20 PM UTC

TimTheTinker wrote: post #356

teamspirit wrote: post #345

Earlier quoted context omitted.

Here-here! I really wish there was more human involvement in a lot of these seemingly arbitrary AI-taken actions. Everything from app review to websites and more. This heavy reliance on automated systems has led us down this road. Shoot, keep it, just give us the option to guarantee human review - with of course transparency. We don't need anymore "some human looked at this and agreed, the decisions is final, goodbye…

:s/Here-here/Hear hear/

Hear hear!

Where where!?

Here here!

Re: Google Safe Browsing can kill a startup

#525

Post by Tyr42 » Sun, Jan 17, 2021, 2:38 PM UTC

rdm70 wrote: post #521

koalaman wrote: post #516

Earlier quoted context omitted.

(Googler) You are only focusing on the negatives while completely ignoring the positives here. Here are a few questions to consider that may give you better perspective: 1) Do you know the magnitude of financial and psychological damage caused by malware, phishing, etc on the web? 2) Do you believe that it is possible to have a human review every piece of automation generated malware on the internet? 3) Do you believ…

2*) Do you believe that it is possible to have a human review every FALSE POSITIVE result from automated malware detection on the internet, when reported by those adverse affected by the false positive result? Yes, yes I do. Banks do it for their customers today at scale.

So what happens when the fraudsters automate clicking the "request review" button? They can spin up as many phishing sites as they want, and request as many human hours in review as they want.

With banks, they only have to do that for their customers, whom they've at least had a chance of getting money from. But Google would need to provide it to every site which gets blocked, (as malware sites pretend to be legitimate). Which

Re: Google Safe Browsing can kill a startup

#526

Post by lmarcos » Sun, Jan 17, 2021, 3:08 PM UTC

joseph_grobbles wrote: post #431

lmarcos wrote: post #347

Earlier quoted context omitted.

> When I get a text to a phishing site, I immediately report it to the safe browsing list. Please, don't do that. You're just giving more power to a private company (Google). It's so deceiving, I know: reporting/blocking malware sites is a good thing, but doing so via Google diminishes the returns so greatly that it's no longer worth it.

As opposed to what alternative? Google's safe browsing list is used by everyone, and is currently the gold standard. There exists no alternative. NextDNS uses it. Safari uses it. Firefox uses it. Yeah, I'm not feeling guilty about this, and I'll do it every time. Note that the list isn't like a spam list or something where bad actors can just flag something and get them blacklisted. When you report to the safe browsi…

That's right, there is no good alternative at the moment.

Re: Google Safe Browsing can kill a startup

#527

Post by varispeed » Sun, Jan 17, 2021, 4:08 PM UTC

jedberg wrote: post #316

This is actually funny, because I was involved with the creation of this list, way back in 2004. The whole thing started as a way to stop phishing. I was working at eBay/PayPal at the time, and we were finding a bunch of new phishing sites every day. We would keep a list and try to track down the owners of the (almost always hacked) sites and ask them to take it down. But sometimes it would take weeks or months for t…

That's very interesting. Would you not think for a moment that such mechanism could be abused?

Re: Google Safe Browsing can kill a startup

#528

Post by jedberg » Sun, Jan 17, 2021, 7:31 PM UTC

varispeed wrote: post #527

jedberg wrote: post #316

This is actually funny, because I was involved with the creation of this list, way back in 2004. The whole thing started as a way to stop phishing. I was working at eBay/PayPal at the time, and we were finding a bunch of new phishing sites every day. We would keep a list and try to track down the owners of the (almost always hacked) sites and ask them to take it down. But sometimes it would take weeks or months for t…

That's very interesting. Would you not think for a moment that such mechanism could be abused?

The internet was a much kinder trusting place back then. We assumed when the browser makers agreed to not use it for bad things, we believed them.

Re: Google Safe Browsing can kill a startup

#529

Post by varispeed » Sun, Jan 17, 2021, 7:37 PM UTC

jedberg wrote: post #528

varispeed wrote: post #527

Earlier quoted context omitted.

That's very interesting. Would you not think for a moment that such mechanism could be abused?

The internet was a much kinder trusting place back then. We assumed when the browser makers agreed to not use it for bad things, we believed them.

I think as always great ideas do not account for human nature...

Re: Google Safe Browsing can kill a startup

#530

Post by anticristi » Sun, Jan 17, 2021, 7:51 PM UTC

slim wrote: post #312

anticristi wrote: post #283

This reminds me of email blacklisting. When I was "young" I operated an email server for 6000 users. Keeping that server and our domain away from blacklisting was a full-time job. It wasn't enough to secure your server: Any spam or virus coming from the internal network through that email server could potentially blacklist us. Basically, you had to treat your users as untrusted, and run anti-spam and anti-virus filte…

today Microsoft is the worse. It blacklists your ip from unsuspecting customers using outlook, live.com, etc.. and there is no way to recover from it without becoming yourself a customer. it's vicious because the users of their products are mostly businesses and they are acting as a gateway for doing business with them.

Definitely annoying. But how much is this anti-competitive business practices, and how much is this "raising the bar for the bad folks". Unfortunately, the latter inevitably adds burden to good folks too.