Clear conflict of interest enabled by anti trust not being enforced.
Firefox gives a similar warning.
Tell HN: Chrome says "suspicious download" when trying to download yt-dlp
51–60 of 108 posts
Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp
#52The binaries they offer are complied using PyInstaller, which can give false positives in anti virus software.
Google has been anti yt-dlp before it was forked. They also have rules that carve out tools like this from their extension store and at Android, except enforcement is lacking sometimes. Google is terrified of users having access users control to their video content.
yt-dlp breaks YouTube’s DRM. They could easily get the repo removed under the DMCA. They don’t.
Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp
#53The heuristics powering this, as well as the Windows Defender whitelisting, are terrible. My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem. Users are not incentivized to use the program with the warning. But removing the warning requires many people to ignore the warning. This is a big problem for anyone writing Windows software. A…
>My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem.
Given the recent npm axios compromise this sounds like a pretty smart move?
Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp
#54The heuristics powering this, as well as the Windows Defender whitelisting, are terrible. My understanding is that a specific binary needs to become popular for it to stop being flagged. This creates a chicken and egg problem. Users are not incentivized to use the program with the warning. But removing the warning requires many people to ignore the warning. This is a big problem for anyone writing Windows software. A…
Conveniently M$ lets you buy a signing certificate to fix this. https://stackoverflow.com/questions/48946680/how-to-avoid-th...
EV no longer skips smartscreen either nowadays. I understand that was abused, so it's treated as the same as OV. Having a certificate allows the cert itself to accumulate trust (rather than each binary independently doing so) and provides better UX and I suspect an initial small boost to trust signal, but doesn't bypass the initial distrust. There's no way to avoid that AFAICT and even if you're an established business you hit it at intervals because all these certificates expire and so the whole process resets every few years anyway. What a mess.
Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp
#55for what it is worth, when downloading the latest .exe from github, firefox says "this file is not commonly downloaded" and i have to select "allow download". scans of it are fine. probably just a heuristic-based false-positive, and not a news-worthy story of chrome abusing their monopoly or whatever.
Isn’t firefox using Google “safe browsing” database ?
Safebrowsing does not provide popularity metrics for downloads, to my knowledge. It only states whether a URL is malicious according to some Google checks. No amount of popularity would turn a malicious URL into a benign one.
Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp
#56Earlier quoted context omitted.
Google has been anti yt-dlp before it was forked. They also have rules that carve out tools like this from their extension store and at Android, except enforcement is lacking sometimes. Google is terrified of users having access users control to their video content.
yt-dlp breaks YouTube’s DRM. They could easily get the repo removed under the DMCA. They don’t.
it'll just cause a lot more people to become aware of it and cause mirrors to pop up everywhere.
Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp
#57Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp
#58Earlier quoted context omitted.
Conveniently M$ lets you buy a signing certificate to fix this. https://stackoverflow.com/questions/48946680/how-to-avoid-th...
EV no longer skips smartscreen either nowadays. I understand that was abused, so it's treated as the same as OV. Having a certificate allows the cert itself to accumulate trust (rather than each binary independently doing so) and provides better UX and I suspect an initial small boost to trust signal, but doesn't bypass the initial distrust. There's no way to avoid that AFAICT and even if you're an established busine…
>There's no way to avoid that AFAICT and even if you're an established business you hit it at intervals because all these certificates expire and so the whole process resets every few years anyway. What a mess.
Maybe have overlapping sets of certificates and dual sign your binaries? That way there's always an "aged" certificate available.
Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp
#59Re: Tell HN: Chrome says "suspicious download" when trying to download yt-dlp
#60Earlier quoted context omitted.
Why would a browser(be designed to) care about this?
Because people download viruses from the internet all the time? "Common sense antivirus" might work fine if you're technically inclined, but that's not the case for everyone.
The growing prevalence of so-called "supply-chain attacks" (a bad name because it implies a commercial relationship that doesn't usually exist) shows that "common sense antivirus" isn't working so well even among the technically inclined.