Slashdot Mirror
One in 25 Search Results Risky
Ant writes "According to Ars Technica, security researcher Ben Edelman revisited his May 2006 report on the relative risk of search engine results. In the original report, Edelman found that 5 percent of the results provided by search engines were marked as either "red" or "yellow" by SiteAdvisor, indicating that they presented some risk to the user. Now, Edelman says that his new study has shown that only 4.4 percent of such sites are risky, representing a drop of 12 percent since May... ... The study found that not only can regular links found by search engines be dangerous, the sponsored links that appear in prominent positions in the results pages can also be harmful. In fact, in the May study, sponsored links were more than twice as likely to be linked to malware than non-sponsored links (8.5 vs. 3.1 percent)."
1 in 25 search queries is for bukkake. It's no wonder =P
If an officer ever threatens to taze you, say you have a pacemaker.
Back when the Goatse and Tubgirl landmines were all the rage. And it was FAR more than 1/25!! I'm still using eyebleach!
"Ask not what your country can do for you." --John F. Kennedy
The actual study appears to be here.
4.4% is 88% of 5%, hence a 12% drop.
ok, why doesnt google just notify the user of these yellow, red, (ie. government type terrorism alert colors) on top of each search result returned from a query. Based on these studies they (google) should be able to use the same algorithms the researches used to achive the same conclusion about unsafe sites.
Or does google happen like all of these link farms, more advertisements and clicking = more profit for google? or id googles search algorithm to , shall i say, stupid? to distinguish the good guys (sites) from the bad...
It wasn't a typo, the poster has no concept of the English language. He meant to say, "a 12 percent drop" not "a drop of 12 percent".
.88 = 1.00 - .12
4.4/5 =
A drop of 12 percent would mean we now have -7 percent of something which isn't possible.
Such as XSS attacks. If Google caches a page with XSS in the url (and it has done so in the past), the attack, which is simply JavaScript and not detectable by most antivirus software, can run in the background, retrieving information about the user or even opening up holes to later take over the user's computer.
When a company is allowed to continue doing business after being caught several times with its hand in the malware cookie jar and gets nothing more than a slap on the wrist, there becomes no incentive to cease malware/spyware behavior. This is an enforcement issue and enforcement is not good enough. I'll bet if you label malware as a form of terrorism . . . . Well, on second thought don't do that, too many innocents would get caught up in the dragnet.
SiteAdvisor is annoying. They have their bot visit your website and fill in forms with junk to see whether or not you will spam the email address they supply. They keep hitting the price request form on my company's website, so a salesperson ends up calling the phone number they supply (always goes to voicemail) to try to help someone that isnt' real. Why does McAfee think it's OK to spam me to see whether or not I'll spam them back?
Adds a whole new dimension to Google's "I'm Feeling Lucky" button.
Touting MyEclipse AJAX Tools
How did you decide that only IE is vulnerable to the "risky" results that one might find by following these links?
Because IE 7 runs only on Windows.
Hence, it can be assumed that if you can run IE 7 then perhaps there are security problems involved.
If you run OS X or Linux, you can be assured that chances are those links are fairly safe as far as browser hacks and probability that someone decided to make a hack that affects both Firefox and Linux or Mac combination.
And yes I'm being a bit facetiously, but the grandparent isn't much as a troll but speaking a bit over zealously. Chances IE7 will have more problems than Firefox on any system because of its integration into the OS. Vista handles this a bit better than earlier operating systems, but it still has issues.
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
That's not really true. It's just a matter of how many people are available running the OS and how much time it is worth to the malware artist. After all, it doesn't matter what OS you are running; there are always foolish people who are willing to click anything and hand out the root password when it is asked for. It's true that informed, security conscious folks won't give the password. It's also true that most people running Linux these days are informed and security conscious, however that has really been more of a legacy coming from the fact that you had to be pretty informed and a decent techie to even know that Linux existed and to know why you wanted it and spend time installing it. (Note I didn't say "it is hard to install" because we all know it isn't anymore even if many people still think that it is). Anyway, as OSX and Linux get more users and they tend to be less technical folks these types of problems can hit them too. Non-techies are really easy to social-engineer sometimes.
Well, if this search engine places this site in this special spot, it must mean that this site is trustworthy.
They payed to be in that spot ?
Well, if they're able to pay for that spot, they must be trustworthy.
What do you mean where did they get the money to pay for that spot ?
How should I know ?
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
Slap on the wrist? There should be so much justice.
My solution is to use a custom hosts file. http://www.mvps.org/winhelp2002/hosts.htm publishes a nice one. Whenever I click on a lick in a web search list and I immediately get a "link not found" then I can pretty sure I didn't really want to go there in the first place. A lot of advertisements show up as "404's" as well.
"Will future ages believe that such stupid bigotry ever existed!" -- Ivanhoe
Sorry, but I am detecting crap. The process of measuring something in real life has inheret errors built into it. I doubt Dr. Edelman can measure the fraction of dangerous search results so accurately so that decimal digits have any meaning. Given that his methodology is to perform particular searches, for example, it's not obvious that his search pattern exactly represents that of a typical user, that his definition of a dangerous site is accurate, or how big are the fluctuations in search result placement in the search engines. Actually, I doubt you can even define the parameter he's measuring accurately enough for the difference between 4.4% and 5% to make sense. Very telling is that at not point does the study bother to address the error bars of the methodology. This indicates that no-one has any idea what the results actually mean, and that we should treat them with grave suspicion.
Specifically, the implicit claim in the article that the difference between 4.4% and 5% is statistically significant is bougs. The real byline is "fraction of dangerous websites remains unchanged". The two numbers are clearly equal within any reasonable error of measurement. Note that Dr. Edelman's study does not actually make this comparison.
I would RTFA, but it might be risky...
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
I emphatically disagree. I've written plenty about security exploits, where users need not click "yes" (or anything else), nor need ActiveX, VBS, or any other such thing. Details.
In any event, the piece at issue in the original post considers many kinds of risks -- not just exploits, but also run-of-the-mill scams, like "free" ringtones that aren't. You may not regard such sites as "risky" or harmful, but there are plenty of others who do, because they don't like the prospect of being ripped off.
(1) That means that many of the sites you find by typing "sex", "porn" or "Brittney Spears" are dangerous. "Thank you!"
(2) I would appreaciate a study that will show me how dangerous are the searches that are useful to me, that is searches not for the popular keywords, but, in opposite, on words and phrases that represent some notions, phenomena, concepts that I do not know.
(3) How the presented statistics differ by the category? For example, I would like to see separate results for searches categorized under "Entertainment" and "Science".
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.