Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Firefox lying to users about viruses in downloads?

theindy.us

Post reply on HN
Print view View original

71–76 of 76 posts

Re: Is Firefox lying to users about viruses in downloads?

#71

Post by xg15 »

ryandrake wrote: post #62
deathanatos wrote: post #43

Earlier quoted context omitted.

> And if only developers understood UX. I've upvoted you, since I think your point is good, I'd just add that as a developer, I've found myself on more than one occasion pushing for the type of UX being advocated here, and getting pushback from designers/PMs. Typically, the issue I run into is a desire for the UX to be "simple", sometimes simpler than the system underlying it actually is (or is even capable of being)…

Yea, that s happens all the time in software. It’s the developer’s job to push back and explain the probability distribution of the results to the designers/PM so they understand the algorithm’s limitations, and everyone’s job to fight for the user. It needs to be a conversation, not a contract. Designer: This label is required to say what store the user is at given his location. Developer: the location sensor is imp…

I generally agree, though in this case, I'd agree with the yolo designer.

If I consulted Google Maps and it told me I'm with 48.25% likelihood at address A, with 39.81% likelihood at address B and with 11.94% at another location, what exactly am I to do with this information?

I think Google Maps actually shows a good design to communicate the uncertanity: They show the uncertanity as a blue circle of varying size. It's visual but (more importantly) gives you as a user the ability to reduce the uncertanity with their own information. E.g., if you know you're at an intersection and the circle covers only one, you now have a precise location.

In general, I'd say, it's important to know which context the information is used.

Re: Is Firefox lying to users about viruses in downloads?

#72

Post by ozim »

sammoth wrote: post #63
yodon wrote: post #59

Earlier quoted context omitted.

It speaks to the argument that “if this site is serving up infected files, all files it serves should be treated as potentially infected”

That would include domains like dropbox.com or drive.google.com then?

Do you trust dropbox.com that they separate their servers, do you trust google that they do good job in terms of security and containing malware to single file? If yes then there is no need to include those.

On the other hand if you don't trust then those should be included.

Question is, does Mozilla trust google enough? Does Mozilla trust some random website where people host pirated content?

That is random article written by some random guy. Seems like he is more technical than average Joe, but he does not have any statistics to show why this behaviour was implemented. It just looks like a nag that he get his pirated downloads flagged by Firefox. It is backed up by bunch of people who also use it on /r/libgen. If they don't like it they can move to IE6.

Re: Is Firefox lying to users about viruses in downloads?

#73

Post by ozim »

yodon wrote: post #64
sammoth wrote: post #63

Earlier quoted context omitted.

That would include domains like dropbox.com or drive.google.com then?

Security is always complex, and simple rules always have flaws. That doesn’t mean simple rules are always bad, it just means people who build systems around them do need to understand they need to do more than just blindly follow simple rules. I’m pretty sure you’ll find FF doesn’t alert on those sites, because they are being handled by a more complex rule than a vanilla low or medium traffic site.

Funny thing is article is saying "Unfortunately, this message isn’t always accurate. Apparently, sometimes this message is an outright lie.".

So it is not like this domain hosts one bad file and it got flagged, it is apparently more often if it "sometimes .. is .. lie".

Re: Is Firefox lying to users about viruses in downloads?

#74

Post by Viliam1234 »

klez wrote: post #10
sus_007 wrote: post #6

Firefox isn’t necessarily scanning the files for viruses, they’re often just using databases that list domains suspected of hosting malware. IIRC, Chrome does the same thing too. I think it's not much of an issue for Firefox to flag stuffs downloaded from suspected URLs as a malware since it's not uncommon to have one's system infected from those sites' content. Firefox is just trying it's best to prohibit any sort o…

> Firefox is just trying it's best to prohibit any sort of system infection through itself. In that case I would change the wording from "contains malware" to "may contain malware". Also, they're prohibiting nothing. They still give you the option to open the file (which, as explained by the article, opens a whole different, albeit small, can of worms)

> In that case I would change the wording from "contains malware" to "may contain malware".

Or even more precise: "may contain copyright infringement".

Re: Is Firefox lying to users about viruses in downloads?

#75

Post by phobosdeimos »

sandov wrote: post #42
yodon wrote: post #21

If only the voting public understood about statistics, false positives, and false negatives. Even if Firefox did a full virus scan, there would still be false positives and false negatives in the results. The system designer always has to put their reporting threshold somewhere, and that always means making a decision to bias towards false positives or false negatives. Eliminating false positives means exploding the…

And why the hell should the browser act as an antivirus?. It's a browser, not an antivirus, it should assume the user knows what he's doing, not treat him like a toddler. It's just a huge annoyance with no considerable benefit.

As an advanced user you can disable a lot of "helpful" features. Including safe browsing. Its in about:config

Browser.safebrowsing.malware.enabled

Just set it to false IF you consider yourself a poweruser.

Re: Is Firefox lying to users about viruses in downloads?

#76

Post by franga2000 »

I agree that straight up calling it a virus is wrong. "This file comes from a suspicious source and might be dangerous" would be much better wording. Enough to make the user cautious, but not scare the shit out of them (yes, I've literally seen people jump out of their seats and scream when they saw a virus warning).
Post reply on HN