Live data from Hacker News

Google Ad Disguising Itself as www.gimp.org

old.reddit.com

191–200 of 230 posts

Re: Google Ad Disguising Itself as www.gimp.org

#191
post #64

In this particular case, I suspect a trademark complaint against Google would make sense. Google misrepresented the ad as the product of the Gimp project, and were paid as a result. They usually use an "obeying the law would not scale" type argument in court, but that would clearly be bullshit in this case. They have a business relationship with the ad buyer, and should have verified their affiliation with gimp.org.…

[deleted]

Re: Google Ad Disguising Itself as www.gimp.org

#194
post #34

EDIT: There is definitely a mismatch between the display URL and the landing page URL. It's not clear to me how that can happen; for example https://www.youtube.com/watch?v=jx-gl6K2zQw shows that only the display path can be edited (not the domain), consistently with the wording on https://support.google.com/google-ads/answer/2616010 and https://support.google.com/google-ads/answer/2375287 . On the other hand, https:…

You can just set any URL you want

Do you know how that can be done? Based on the video https://www.youtube.com/watch?v=jx-gl6K2zQw it looks like only the display path can be edited (not the domain).

Re: Google Ad Disguising Itself as www.gimp.org

#195
post #64

In this particular case, I suspect a trademark complaint against Google would make sense. Google misrepresented the ad as the product of the Gimp project, and were paid as a result. They usually use an "obeying the law would not scale" type argument in court, but that would clearly be bullshit in this case. They have a business relationship with the ad buyer, and should have verified their affiliation with gimp.org.…

Google does not allow trademark infringement in ads [1] and provides tools for trademark owners to prevent their trademarks from being used improperly. The issue here seems to be that the Gimp team does not have a registered trademark for "Gimp" (at least not in the U.S). This can be verified at the USPTO website [2]. [1] https://support.google.com/adspolicy/answer/6118 [2] https://www.uspto.gov/trademarks/search

[deleted]

Re: Google Ad Disguising Itself as www.gimp.org

#196
post #104

I think people are missing the actual issue here. Google used to have a clear distinction between what's an ad and what is organic. In these screenshots you have to pay good attention to see the top result is an ad. To keep their conversion numbers up they had to constantly reduce the difference between the ads and everything else. The fact that they can do this and we are so used to it that we don't first identify t…

The actual issue for me is Google allowing an ad to say gimp.com that is not gimp.com. Even if you see it's an ad and are interested, you are now at risk on Google.

Re: Google Ad Disguising Itself as www.gimp.org

#197
post #131
post #64

In this particular case, I suspect a trademark complaint against Google would make sense. Google misrepresented the ad as the product of the Gimp project, and were paid as a result. They usually use an "obeying the law would not scale" type argument in court, but that would clearly be bullshit in this case. They have a business relationship with the ad buyer, and should have verified their affiliation with gimp.org.…

Having the actual url be completely different from the displayed url simply shouldn't be possible. Allowing that invites scams like these. At the very least, they need to be the same domain.

Redditor RawPacket writes[1] that it's probably an IDN homograph attack[2]:

  the g, i, m, or p are replaced with characters from a different character set. Looks right, but the domain is registered with a different character.
  
  Example: * gіmp.com is fake. * gimp.com is real.
  
  They look the same, don't they? But if you click on the fake gіmp.com, your browser will take you to the domain xn--gmp-jhd.com as it is using the і from the Cyrillic character set.
[1] https://old.reddit.com/r/GIMP/comments/ygbr4o/dangerous_goog...

[2] https://en.wikipedia.org/wiki/IDN_homograph_attack

Re: Google Ad Disguising Itself as www.gimp.org

#198

Earlier quoted context omitted.

Internet scale companies like Google happily embrace intellectual property laws when it's their IP on the line, they just don't care about anyone else's. And it's not an issue of "can't scale": Google's ad revenue is bigger than the entire GDP of Kentucky--they could literally hire 1% of the US population to work in fraud management and still turn a profit.

How would you manage a fraud department of 3 million people?

[deleted]

Re: Google Ad Disguising Itself as www.gimp.org

#199

Earlier quoted context omitted.

Quoted post unavailable.

I wasn't even talking about paid links specifically. It's advertising in general that's the problem. Call me a child all you want, I don't care. The simple fact remains that they have an inherent conflict of interest. It's not an absurd argument at all. People who want to sell you something have every incentive to distort the truth and only fools believe them.

Arguing that advertising in general is bad is even more of a nonsense statement.

Re: Google Ad Disguising Itself as www.gimp.org

#200
post #14

IMO checksums more or less offer a false sense of security for users if they're stored/shared on the same page/domain as the download, since it'd be trivial for a bad actor to change them if the files are compromised. Linux mint, for example, the attacker updated the checksums for the ISOs on the page when it was compromised https://www.infoworld.com/article/3036178/lesson-from-linux-... I don't really have a solid s…

> I don't really have a solid solution to this

My solution to this when designing Homebrew’s binary packages was to store the checksums for the binaries in Git but the binaries themselves elsewhere (inspired by Homebrew already storing source checksums in Git).

On Homebrew, therefore, you’d have to compromise both the binaries and the Git repository.

These are both nowadays on GitHub but the binaries in GitHub Packages are addressed by their checksum and the Git repository has a good audit log.

Post reply on HN