This is outrageous. We need to find a way to stop Google. Google invades our privacy. Google holds us hostages for more money. Now this? When is enough is enough?
Google Ad Disguising Itself as www.gimp.org
91–100 of 230 posts
Re: Google Ad Disguising Itself as www.gimp.org
#92yeah part of google worship has created common misconceptions like that things that appear in its automatic index are true answer to whatever question you have in mind (computers cant read minds). "this is the official link for some product" being only one possible question. then theres also the fact that a search engine cannot know the answer to "this is the right link for this software". i miss when search engines…
> a search engine cannot know the answer to "this is the right link for this software"
You would think keeping a curated list of well-known software projects (and others) would be low-hanging fruit. Instead, it is apparently better to throw money into complicated systems... that can't even catch the most basic form of linkjacking.
> this is a good example of how chicken shit design leads to security vulnerabilities. google probably lets the user post one link and make it lead somewhere else when you click it, as a "UX" feature.
I have always found a bit of subtle arrogance in this kind of thought process. It's like they've never bothered learning the basic functions of the web and how it is meant to work and think they know better than the original creators.
Re: Google Ad Disguising Itself as www.gimp.org
#93IMO checksums more or less offer a false sense of security for users if they're stored/shared on the same page/domain as the download, since it'd be trivial for a bad actor to change them if the files are compromised. Linux mint, for example, the attacker updated the checksums for the ISOs on the page when it was compromised https://www.infoworld.com/article/3036178/lesson-from-linux-... I don't really have a solid s…
Put the checksums in a separate system such as the DNS. Use DNSSEC on your domains. Manage your DNS system as an isolated system (don't mix your HTTP/Email/Other stuff with your DNS provider). Now, users may verify the downloads you provide at your website by getting checksums from the DNS. DANE may be of interest here as well: https://www.infoblox.com/dns-security-resource-center/dns-se...
How does DNSSEC help here at all? We're talking about the security of checksums of data on pages. DNSSEC only addresses the name lookup.
Re: Google Ad Disguising Itself as www.gimp.org
#94This is also a huge issue with Blender and pops up on /r/blender from time to time. (Here's a few random recent examples: https://redd.it/xxkx5s https://redd.it/vvrxko https://redd.it/xwkky8 https://redd.it/vuqu1r ) Ad networks and content providers get up in arms over widespread ad blocking but then allow stuff like this through.
Yeah, blocking ads quickly became security improvement...
Re: Google Ad Disguising Itself as www.gimp.org
#95IMO checksums more or less offer a false sense of security for users if they're stored/shared on the same page/domain as the download, since it'd be trivial for a bad actor to change them if the files are compromised. Linux mint, for example, the attacker updated the checksums for the ISOs on the page when it was compromised https://www.infoworld.com/article/3036178/lesson-from-linux-... I don't really have a solid s…
Put the checksums in a separate system such as the DNS. Use DNSSEC on your domains. Manage your DNS system as an isolated system (don't mix your HTTP/Email/Other stuff with your DNS provider). Now, users may verify the downloads you provide at your website by getting checksums from the DNS. DANE may be of interest here as well: https://www.infoblox.com/dns-security-resource-center/dns-se...
That just makes DNS the single point of failure. If you own DNS, you can change the checksum and the download all at once.
Re: Google Ad Disguising Itself as www.gimp.org
#96Earlier quoted context omitted.
> obeying the law would not scale I don't know why, but that sentence terrifies me. It's like the silicon valley version of a dystopia.
Some laws were put into place before the current internet scale was imagined and would probably not be made today
Internet scale companies like Google happily embrace intellectual property laws when it's their IP on the line, they just don't care about anyone else's. And it's not an issue of "can't scale": Google's ad revenue is bigger than the entire GDP of Kentucky--they could literally hire 1% of the US population to work in fraud management and still turn a profit.
Re: Google Ad Disguising Itself as www.gimp.org
#97Earlier quoted context omitted.
Not only do they allow it, they actively encourage it. They tell businesses that it's really important to buy ad space on searches for your own brand name so that a competitor doesn't. The way they say it really comes off like a protection racket. "Nice number one spot for searches for your brand name you have there, would be a shame if anything were to happen to it." They make people feel better about it by giving a…
But if you have trademark for brand name you should be able to prevent others from using it, right? https://support.google.com/adspolicy/answer/2562124?hl=en
I don't think that someone could actually use your brand name and get away with it long-term (though, short-term, as the original post evidences, isn't guaranteed) but a competitor can absolutely buy ad space trying to steal your customers.
Like, if you search for "Nike" and Nike hasn't bought the branded ad space, you might get an ad for Adidas as the top result, with Nike's homepage the fourth item in the list.
Re: Google Ad Disguising Itself as www.gimp.org
#98Earlier quoted context omitted.
Not only do they allow it, they actively encourage it. They tell businesses that it's really important to buy ad space on searches for your own brand name so that a competitor doesn't. The way they say it really comes off like a protection racket. "Nice number one spot for searches for your brand name you have there, would be a shame if anything were to happen to it." They make people feel better about it by giving a…
But if you have trademark for brand name you should be able to prevent others from using it, right? https://support.google.com/adspolicy/answer/2562124?hl=en
Trademark law likely requires you to do so.
Re: Google Ad Disguising Itself as www.gimp.org
#99Re: Google Ad Disguising Itself as www.gimp.org
#100Earlier quoted context omitted.
Some laws were put into place before the current internet scale was imagined and would probably not be made today
So it’s a valid defense to say complying with the law is hard, that’s why I didn’t? Shouldn’t the right course be to change the law before taking such actions?
It's not uncommon to evaluate the value of enforcing the law. DAs do it all the time.