81–90 of 98 posts
I always thought that using the safe browsing feature is asking for trouble so it is disabled in all my browsers. So my browser doesn't need to make an extra request to Mozilla/Google/etc every time I load a new website and the web is not censored if there is a technical issue
Performance side effects should be negligible, but there are some privacy concerns (your browser is asking Google for each page it visits if it is ok - thus telling G where you surf).
Earlier quoted context omitted.
We explored trying to email whois contacts or standard addresses (such as webmaster@example.com or postmaster@example.com) and essentially got zero pickup. That's one of the reasons we provide Webmaster Tools, and so far it's our best channel to notify small business owners. We can sometimes label sites as hacked in the search results, but Webmaster Tools is definitely the preferred channel for communication of stuff…
Thanks for the clarification, Matt. Does such an action from google also include penalizing the website in terms of page rank and search rankings?
For example, if we manually detect that a subdirectory of a site is hacked, we may remove only that subdirectory from our search results. If your entire site is hacked, then your entire site may be demoted or removed until the site is clean.
Earlier quoted context omitted.
We explored trying to email whois contacts or standard addresses (such as webmaster@example.com or postmaster@example.com) and essentially got zero pickup. That's one of the reasons we provide Webmaster Tools, and so far it's our best channel to notify small business owners. We can sometimes label sites as hacked in the search results, but Webmaster Tools is definitely the preferred channel for communication of stuff…
"We explored trying to email whois contacts or standard addresses" Ironic since the original reason for the tech contact was exactly to be notified for issues like this. Would like to add that as a registrar though we get a reasonably good response to emails that we send. [1] Perhaps there is something about getting an email from google that says "it's probably spam". Or any large well known company that is often the…
Earlier quoted context omitted.
While some of the vectors you've mentioned could potentially be exploitable, blaming a "very unsafe programming language," isn't really a good explanation. These issues could occur in any program and any programming language -- it's not a problem specific to C languages.
Most(?) browser vulnerabilities are caused by errors in C++ code which would not be exploitable in memory safe languages. One of the goals of Mozilla's Servo is to write a browser that's memory safe without compromising performance.
My point was that it's not a C specific problem, though. Most browsers are in fact built on C, I agree. This is due primarily to the speed and performance of the language that is harder to reach with other languages.
It is definitely a more difficult language to write, as it is much more "raw," but that doesn't make it inherently unsafe to use, or any more unsafe than other languages.
http://www.incapsula.com/blog/world-largest-site-xss-ddos-zo...
Security company found a vulnerable Alexa Top 50 site where someone was able to inject XSS code in the comments section creating "DDoS Zombies" of the visitors.
Earlier quoted context omitted.
Exploiting programming errors in the browser is one way. Because browsers are written in very unsafe programming languages (C++), bugs are regularly exploitable so that by specially crafting the bug-triggering input data they can be fooled to scribble content-controlled data inside the browser's memory space. For example, a memory handling bug might let the page overwrite some of the browser's code with data coming f…
While some of the vectors you've mentioned could potentially be exploitable, blaming a "very unsafe programming language," isn't really a good explanation. These issues could occur in any program and any programming language -- it's not a problem specific to C languages.
And it's not a "potentially" thing, as is apparent to anyone following news about browser vulnerabilities. For a recent public performance, see pwn2own - http://nakedsecurity.sophos.com/2014/03/14/pwn2own-day-two-c...
Earlier quoted context omitted.
> First, it's already been unblocked. It's still blocked for me, with Google branding wired.com as "a known malware distributor."
Well that's technically a correct statement. Try: chrome://net-internals/#dns Click "Clear host cache"
As to the technically correct statement, don't you think that saying a site is a "known malware distributor" is a bit more sweeping than saying something more accurate like "we discovered malware on this site"?
In other words, they are using the same language I would expect to see directed towards sites that have malicious intent and should never be visited.
I can't believe on HN of all places people are using Chrome its malware-detecting-capabilities. Friendly reminder that EVERY REQUEST you make with it enabled, will be passed through Google its filters. You should turn all Google networking activities in your browser off. By default, there are at least five or so enabled which will happily send every request you make to Google. Some services even go as far as logging…
pearjuice, this simply isn't true. The way that Chrome does this is periodically downloads a file from Google. The file consists of hashes of known-dangerous web pages. When you visit a new URL, the URL is hashed locally and checked against the client-side list of hashes of known-bad pages. If there's no match, Chrome proceeds normally. Only if there is a hash collision does Chrome do more checking to see if the URL…