Slashdot Mirror

If you're interested in security and want to do something useful, and profitable, code "preventative/predictive" software that does for the user what the IT department preaches to the users:

1.) Don't click on phishing links in emails. You and I know what that means; usually an executable (.exe, .com, .bat, .scr, .whatever) wrapped in a ,zip.

Start raising flags. Block forward progress until a systems analyst arrives.

2.) Use something like Web of Trust to provide first-flag and even then (and this is important for 1.) as well) have the computer examine the consequences of a download of an attachment or link.

It's a goddam computer. Have it read the code and determine intent.

Look: Users don't encrypt local files. Why is that even happening?

Or, the file/link is a dropper. Users don't do droppers.

--

Predictive analysis and foreseeing consequences:

Work to get on the front line of security and build a better mousetrap.

No. The Web of Trust is about what websites are safe (for their metric of safety) not about anonymizing your visits. This smacks of some kid mad that he bought a bag of chips and over half of it was air and wants the company shut down because he can't even!

> https://www.mywot.com/en/terms

How this got modded insightful is beyond me. It's ignorant.

That's a neat idea! However, I'm a little dismayed that you think users need to be "allowed" to do this or that there "should be" a right to do it, instead of realizing that users don't need anybody's permission and that right already exists and always has existed.

All we need is easy-to-use software to implement it. I think building that kind of functionality into things like Web of Trust and YaCy (if they don't implement it already) is a good place to start.

Others and I rated negatively on https://www.mywot.com/en/score... ... Overall, still showing positive ratings since SF is an old popular web site. :(

I don't always agree with https://www.mywot.com/ ... :P

They CAN function as decent indicators (provided this isn't some "brand new" site they haven't tested):

http://safeweb.norton.com/buzz
http://www.siteadvisor.com/
http://wepawet.iseclab.org/
http://www.mywot.com/en/commun...
http://www.virustotal.com/
http://www.mcafee.com/us/mcafe...
http://www.malwareurl.com/list...
http://cbl.abuseat.org/lookup....
http://www.threatstop.com/chec...
http://www.avgthreatlabs.com/s...

* You can run sites OR IP Addresses thru them to check *ANY* sites you wish that you're unsure of... enjoy!

APK

P.S.=> In fact, I built hooks into those into this application of mine (in its "Site Checkers" menu, pictured below) that allows users of my APK Hosts File Engine 9.0++ 32/84-bit-> http://start64.com/index.php?o... to answer the SAME basic question you have - in case they wish to remove any sites blocked in the hosts file data imported, these sites give them a FAR MORE DECENT INDICATOR than mere "word-of-mouth"... apk

While there's an opportunity to debate the good and bad of it, tapping into the advertising thread of web sites is novel to me. The legality question is similar to what WOT does, right? The plugin warns me about a site's reputation but I do have the option to proceed.

I wonder if any sites have filed suit against WOT?

You sound like one of those people who do not understand that freedom of speech does not guarantee you a printing press -- or, in the case of SideWiki, the ability to vandalize other people's printing presses. You also sound like one of those guys who think owners of Vbulletin/PhpBB/MyBB forums do not have the right to delete postings or ban unwanted users. Sounds like we are just going to have to agree to disagree on the amount of rights a random person who wants to post on someone else's web site has.

Back to SideWiki, There was never a need to regulate it -- it never caught on and was dying within two years. However, based on the precedence in the related Washingtonpost.newsweek Interactive Company, LLC, et al. v. The Gator Corporation case, I think there would have been legal sanctions imposed against Google for SideWiki (such as enjoining them to allow web sites to opt out via a special HTTP header) had it actually caught on.

As an aside, Web of Trust offers all of the good things SideWiki has (protecting people from online spams or other dangerous online content) with very few of the problems SideWiki has: It doesn't encourage trolls and crackpots the way SideWiki tried to, and doesn't pretend to be part of people's web sites the way SideWiki did.

I would suggest this as well. If she's comfortable with Windows, then make it as safe as possible. Security Essentials has far less risk of throwing a key Windows file into quarantine and hosing the install. It's also far better as far as performance. Ensure she knows how to spot when it has not updated in a while (it happens). Ensure it updates when the PC is likely to be on.

From there, you need to use a few plugins that will help keep your mother safer online. WOT is an excellent, and low impact plugin that will warn her about known dangerous sites. AdBlock is a must if she's prone to clicking on things she shouldn't.

If you can swing it, get an SSD, and kill scheduled tasks like defrag, which would no longer be necessary.
DO schedule checks for updates when she is most likely to be on. Ensure you train her to spot the prompt that updates are needed, and how to install them.
If she can't deal with the update process, then you should setup some time each week to remote into the PC to do them, and to handle basic maintenance

For remote fixes, I'd suggest TeamViewer, set to auto-run as a service., with an Admin password setup for yourself.

I used all of the above steps with my Dad who lives about 2 hours away with decent results for quite a few years until the old XP hardware failed. I should note that I eventually moved him to a Mac mini when his old hardware failed, and when I no longer wanted to pay a hundred bucks for Windows. My dad likes playing games for the most part, and the ecosystem on a Mac made sense for him (app store), while keeping him largely out of trouble.

Hi. I'm in the anti-spam business. You got lucky.

A lot of spammers use fake unsubscribe links as a way of verifying your address and the fact that you read the message. Some questionable businesses have verification elements to their unsubscribe links that will note the fact that you visited the site but then due to a bug fail to process your unsubscribe attempt (thus netting the same effect).

I will sometimes unsubscribe from things, but that's because I want to see how successful it was (and I can deal with the trouble caused by attracting more spam). I do not suggest this for others. Use sites like myWOT to research the link before trusting it enough to follow it and perform the request. Use sites like SpamCop and KnujOn (and, if you're in France, Signal Spam, which has legal enforcement power) to report anything else as spam. All of those reporting agencies are tied to actual enforcement (in some way; KnujOn busts registrars, SpamCop informs network operators (and builds its blocklist), Signal Spam prosecutes if in France).

In fact, at least when it comes to the web presence of anything to purports to be a journal, one Web of Trust site would already be up to the task, with browser plugins available. Users just need to crank down the "Trustworthiness" know on any flim-flam journal site they come across. One just needs to hope that hordes of creationists and climate-change deniers don't then start gaming this for their own agendas.

Bull shit scam with low level of trust. Spammers, assholes, and other frauds.

Fuck you 'ya spamming cocksucker.

A simple browsing protection could be implemented using the web of trust.

When I went to the IIPA, Web of Trust went berserk and said the site has a poor reputation for "trustworthiness," "vendor reliability" and "privacy." It also scored a low score on "child safety."

I'm can't say I'm a fan of politics influencing security ratings like this. Not being a user of the tool, I must ask if this a common trait in Web of Trust's database?

I see that the sites for the riaa, and mpaa are also flagged and have piracy related comments on them.

When I went to the IIPA, Web of Trust went berserk and said the site has a poor reputation for "trustworthiness," "vendor reliability" and "privacy." It also scored a low score on "child safety."

I'm can't say I'm a fan of politics influencing security ratings like this. Not being a user of the tool, I must ask if this a common trait in Web of Trust's database?

I see that the sites for the riaa, and mpaa are also flagged and have piracy related comments on them.

When I went to the IIPA, Web of Trust went berserk and said the site has a poor reputation for "trustworthiness," "vendor reliability" and "privacy." It also scored a low score on "child safety."

I'm can't say I'm a fan of politics influencing security ratings like this. Not being a user of the tool, I must ask if this a common trait in Web of Trust's database?

I see that the sites for the riaa, and mpaa are also flagged and have piracy related comments on them.

When I went to the IIPA, Web of Trust went berserk and said the site has a poor reputation for "trustworthiness," "vendor reliability" and "privacy." It also scored a low score on "child safety."

Web of Trust already provides a very valuable service in flagging suspect and malicious websites. It's a mix of both automated systems and user input.

Very useful, very effective and very easy. The only thing it "lacks" is the ability to report something to the "authorities", but I don't consider that to be a fault.

Unfortunately, there's no easy way to leave them a comment about one's opinion of their behavior on their website. I looked.

You can leave a comment about the business, and a rating of their trustworthiness and vendor reliability here. They should see it if they care about their website, and some of their site's visitors (depending on installed FF plugins) may see it. Whether that effects their business prospects is dubious, but it's something.

If a business publicly asserts that a test which has similar mechanics to their test (but is a completely different expression) is a derived work, I'd say they're a bit untrustworthy (though to be fair, matters of law aren't something they claim expertise with -- OTOH, trustworthy people usually try to STFU on topics they don't understand (but we all make mistakes sometimes)). If they issue DMCA takedown notices based on that misconception, I'd say they're dangerously untrustworthy and no one can safely interact with them in commercial matters, which also impacts their "vendor reliability."

What troubles me more than the copyright issue, is that TFA makes it sound like they sell a "licensed version" of the test. It doesn't say authorized copies (copyright terminology), but a licensed version, which implies there might be terms of use or a contract, wholly unlike how people normally buy most copyrighted works (though many proprietary software publishers now assert that too). That is a pretty threatening idea. I wonder if TFA got that right.

RichRelevance is neither independent nor impartial

...and (FWIW) this is the only time I recall following a link in a Slashdot story (second link, TFA) to find the site blocked by Web of Trust:

http://www.mywot.com/en/scorecard/richrelevance.com

My browser tells me which looks are 'good' links and which are 'bad.'

http://www.mywot.com/

Even if there really were one, it would be better to have it client-side anyway. If Google has a role to play in giving users a good way to tag content, the Chome project, not Google's websites, are the right place for it.

Until then, we have stuff like the WOT plugin, though which not ideal, are at least a step in the right direction and popular/used enough to be useful.

http://www.mywot.com/en/scorecard/blog.web.blogads.com

...is this (linked) site? But irony has it that it is not trustworthy.

According to Google's blog post on the issue, automated sentiment analysis doesn't really work...

As it turns out, Google has a world-class sentiment analysis system (Large-Scale Sentiment Analysis for News and Blogs). But if we demoted web pages that have negative comments against them, you might not be able to find information about many elected officials, not to mention a lot of important but controversial concepts. So far we have not found an effective way to significantly improve search using sentiment analysis. Of course, we will continue trying.

which makes it seem like whatever fix they instituted in their algorithm in response to this problem is just a kludge and that the underlying problem remains...

There is a solution to this problem that a lot of people are already using, however: Web Of Trust, which lists user recommendations as to trustworthiness, vendor reliability, privacy and child safety. Sure enough, WOT gives decormyeyes the lowest combined rating, which according to my settings would not allow my browser to even visit such a site.

Might also be worth installing something like WoT to reduce the chance of downloading a trojaned version in the first place:

http://www.mywot.com/en/scorecard/downloadvlcplayer.org

I find that using MyWOT coupled with Chrome keeps me from stuff like this. Both of those reporting tools are crowd-sourced and goes back to the old word-of-mouth method of advertising. Otherwise, you just stick with the places you know.

FOX is Republican (or Libertariaan) leaning and people don't like Republicans/Libertarians.

The end. If you have "Web of Trust" installed on your browser the foxnews.com site is actually blocked and the WOT page reveals a deep-seated hatred towards that channel: http://www.mywot.com/scorecard/foxnews.com

Anybody find her contact page ironic? http://www.anndeweesallen.com/Contact.htm She claims she receives 100K email a month, so don't email her about personal question. That is like 3,300 email a day, many well known celebrities would not receive that many emails in a day. Btw, her Wot rating is very poor: http://www.mywot.com/en/scorecard/anndeweesallen.com

This rate-the-app project sounds similar to WOT. It sounds like a good idea to me, since Web of Trust has helped me avoid a lot of spybots and other crap. http://www.mywot.com/

Sure, it looks legit, but it's not as though stuff can't be faked or ripped from elsewhere, or that semi-legitimate software has never included any kind of problematic adware.

And like he said, he checked WOT and got negative results. So he's asking, "Do you know someplace where I can get a definitive answer on issues like these?"

Although I'm familiar with Thawte, I hadn't heard of its "Web of Trust" prior to this article. However, there's a popular browser add-on with the same name, so I thought I should point that out to avoid any confusion, especially since both products are related to Internet security in some way.

Web of Trust is also the name of a Firefox and Internet Explorer plug-in from a company called WOT Services Ltd. (until recently known as Against Intuition Inc.). It helps protect users from harmful Web sites and puts safety rating badges in search results on Google, Bing, Yahoo!, and other search engines, similar to McAfee SiteAdvisor and Symantec's Norton Safe Web (although in my experience, WOT is much more effective). This completely unrelated Web of Trust is not being killed off.

I hope that clears up any potential confusion.

Because spam doesn't work that way anymore. It comes from botnets where each individual zombie only sends one or less messages to the target and need only send out 20 or 30 each day total to still be effective.

First, I wonder about the 20-30 messages a day bit. There are roughly 150 billion spam messages sent daily. There are 6 billion people on the planet. In order for your 20-30 messages a day number to be correct, that would every man, woman, and child on the earth would need a computer and every single one of them would be part of a botnet.

Next, if we are assuming that your 20-30 number is correct, I assume many of these messages are identical or similar enough to be identified. I know I get several repeat messages in my GMail spam box every day. There are only so many routers that lead into the US. Set these up to monitor email traffic (is it port 22? 25? I don't remember)... and look for patterns. If the same email is being sent 20 billion times, you can bet it's spam, block those hosts until they can show they are not longer spamming, even if it's a million machines that are part of the bot-net.

As for domestically generated spam, track them and let local law enforcement hand them.

This will require funding, of course, but if you tax the companies that would benefit from this, they will end up spending less in the long run.

I invite people to down rate it in mozilla.org and uninstall it from their computers. In the FOSS world the only way to vote is with your feet.

Agreed. Also may I suggest giving it low ratings in the "trustworthiness" and "vendor reliability" categories of WOT and leaving a negative comment on the WOT noscript page with a "Malicious Content" or other descriptive tag.

Don't forget proxy servers -- be sure to block those.

Firefox plus Web-Of-Trust is also good -- it doesn't hurt to let your daughter be warned that some of the sites she will inevitably visit are not so good.

Kids are not always so savvy about cleaning up after themselves, so a little discreet snooping will let you know how well the filtering is going.

Every router/firewall I've used, has also had a logging feature, so you can also use that to take samples of what is being looked at, and you can tweak your blocking accordingly.

Computer in the living room is a fine idea.

Personally I prefer WOT. It's a website reputation system, which lets me vote on the trustworthiness without leaving the site. More on their technology can be found on their blog. They say it knows over 10M sites already, which is quite impressive.