A few months ago, we warned that malevolent people were buying Google ads leading people to fake #GIMP websites to trick them into downloading malware.
Apparently this is still continuing to this day (as were reported to us). Google is still not blocking these fake ads despite the many reports and articles which happened for months now. 😓
Be careful and always make sure where you download your software from. Also the GIMP project doesn't buy ads!
https://floss.social/@mithrandir@defcon.social/109773987578181949
@ocdtrekkie You're trying to build a case on individual datapoints for a service that serves 237 billion ad clicks per day.
I think you may find your numbers less than convincing to those of us who know how statistics work, even though we agree that the number should, ideally, be zero.
@mtomczak I mean, I'm just pointing out that examples of this cross my feed incidentally *every* *single* *day*. And that's forgetting the silent majority, and all of the people who do not even understand what is happening.
Google has trained a lot of people to ignore individual datapoints, and it's why Google is the go-to platform for crime: They're ****ing blind, lol.
@ocdtrekkie Yes. I am not surprised that instances occur every single day in an ecosystem with 200+-billion-clicks per day.
Ever heard the statistics on how many of Google's datacenter machines burst into flames per day? Yet Google doesn't sue their vendors for mis-manufacturing; they know how scale works.
@mtomczak You are ignoring all of the data which is inconvenient for your beliefs: That this has impacted a major open source organization and Google has refused to address it for a number of months. And of course, that Google makes money on it, and hence has the perverse incentive to do it.
@ocdtrekkie It's a scale problem. You can make similar accusations of phone companies regarding scam calls.
The consequences of being biggest is you become the largest fraud vector by virtue of scale, no matter how much counter-with you do. That doesn't imply you stop doing the work, but it will never be enough.
@mtomczak If a company is too big to handle being an intermediary in a criminal operations for several months without acting on it, the company should be shut down. Full stop.
@ocdtrekkie Cool.
So what *is* your recommended alternative to phone companies and USPS?
https://www.npr.org/2022/02/03/1077766541/usps-checks-mail-fraud-bank
@mtomczak All of your attempts to suggest adtech is anything but something we should literally just imprison everyone involved with fails to recognize that Google actually makes all it's decisions about pricing and display and moderation based on optimizing the maximum profit return.
@mtomczak The reason the ad is displayed on the page is because Google is confident it is the best way for Google to make the most money from it, and Google isn't acting on reports against an ad that's significantly more profitable than it's removal.
Thanks to Section 230, Google faces no risk of penalty for knowingly serving malicious content, so... they actively serve malicious content.
@ocdtrekkie You've never worked with or in Google have you?
I ask because your perception of what the ad team actually does is so far removed from reality that I have no idea what your source is.
@mtomczak I've not worked at Google, but I've worked with a significant number of Google employees and teams.
It's absolutely a culture of arrogance and learned blindness.
@mtomczak Maybe Ars Technica will finally get their attention? Spamhaus is advising everyone not to use Google to download software. https://arstechnica.com/information-technology/2023/02/until-further-notice-think-twice-before-using-google-to-download-software/
@ocdtrekkie Ars reporting on the problem will certainly light a fire under the team to do more about it than they already are.
I'll be interested to see if that has effect or if the problem is actually fundamentally intractable.
ETA: Ars does a good job of breaking down why Google's been struggling with this problem. So Google employs all manner of out-of-band detection to suss out bad-faith advertisers. Problem is, this new wave of malware vendors is savvy to Google's methods and is cloaking the endpoints from those scans, which means when Google tries to decide if those sites are malicious, they vend a clean front.
(I'm aware of several tricks Google has up their sleeve for this issue, which I choose not to divulge, but if *I* know about them, I assume people who generate revenue by breaking them *definitely* know about them).
In any case, it all circles back to square one again: it's worth it for these folks to optimize their attack against Google's countermeasures because Google is the largest target. This is the "Viruses on Windows" problem again.
@mtomczak The solution is simple: Google should only run ads approved by humans. Of course, that's expensive, so we need a solution to make it worthwhile: Hold Google legally liable for fraud and malware distributed by its platforms.
@ocdtrekkie That's not expensive; it's completely unscalable. It would collapse Google's ability to offer search as a service (it would collapse *all* search engine's abilities to offer search as a service, except possibly for Bing if Microsoft treats it as a loss-leader).
... and it wouldn't solve the problem, because the bad actors would provide a clean front to the humans.
@mtomczak Good. Collapse it. Scale is not a justifiable excuse for misconduct, and it's long past time we start shutting down companies too big to operate responsibly.
Also, how many billions in profit did Google bring in this quarter? It's not unscalable, it's just not going to make them one of the most valuable companies on the planet. Their position is based on ill-gotten gain and lack of responsibility.
@ocdtrekkie I think we're done on this topic if your response is "Well, search had a good run."
The value provided by having search engines outstrips the harm done by bad actors leveraging ads to vend malware. Point me to one counter-example of a general-purpose search engine that isn't ad-backed if you're going to demand we collapse the ecosystem.
Or, as I said, you're actually advocating for just handing search on the web to Microsoft. A hilarious solution for checking Google's power.
@ocdtrekkie USPS is also a private corporation that makes ~20% of its money on ads.
@mtomczak I mean, the USPS is a public service which delivers mail without regards to it's contents (and doesn't make profit based on the value of the content therein).
I agree telco regulation should be better, and the FCC is currently acting heavily to shut down telcos failing to act on SHAKEN/STIR and KYC. We're fixing it. But for what it's worth, a telco is a public utility that provides societal value.
Google is an adtech company and a blight on the planet.