CrabApple Report: Firefox blocks popular Mac site
Posted by JohnnyAppleseed | Under Crabapple, Opinion, Review, Software Monday Apr 14, 2008One of the sites we visit fairly regularly is called Cool OSX Apps - we subscribe to their newsfeed, and when we see something interesting, we’ll stop by their site. We’ve never had a bit of trouble with them until today, when suddenly Firefox 3 (beta 5) decided that it wasn’t going to permit us to go to their site. Like some sort of overzealous nanny, it popped up an ominous warning in the middle of a black background:
So, naturally we clicked on "Why was this site blocked?", which took us to a big page of information that told us the following:
One or more StopBadware partners are reporting badware behavior on this site.Reporting Entities
This site is currently (as of 04/14/2008) being reported to StopBadware by the following partners:
Google: reported bad
And on another part of the page…
What is this page?This page is StopBadware’s information page about www.coolosxapps.net/.
Google has found that some portion of www.coolosxapps.net/ contains or links to badware or otherwise violates Google’s software guidelines.
Some websites intentionally distribute harmful software, while many others have been compromised without the knowledge or permission of their owners. StopBadware reports information provided by Google about these sites (see ‘Reporting entities’ to the left) and offers a process to assist webmasters in removing their sites from Google’s list (see ‘I am the owner of this site’ below).
For StopBadware’s guide to understanding Google’s warning pages, see our Frequently Asked Questions (FAQ).
For more information about StopBadware, click here.
Our problem with this is that first of all, this gives us no idea as to whether there really is a threat on this site or not. We doubt the site is any more of a threat than it was yesterday, but sometime in the last day or so, someone at Google or StopBadware decided that we, and anyone else who uses Firefox as our browser, should not be allowed to go to that site. As best we can recall, we never asked for this sort of intervention, so we resent it the way we would resent a busybody neighbor who starts giving unsolicited advice about what we should or should not do "for our own good."
The thing is, had we not been visiting this site semi-regularly for the past few months, we might have been genuinely scared off by this dark red warning on a totally black background. Even the colors were apparently picked to convey a sense of impending danger. This in itself is not a bad thing. There are many inexperienced users on the internet and this color scheme will get a new your attention.
We don’t know about anyone else, but we don’t want either Google or StopBadware denying us the ability to access a site, unless they are willing to tell us precisely what they think is wrong. At our age, we’re not going to accept "Because I said so!" from anybody, even if one of the parties is Google.
So, we dug around in Firefox’s preferences, and on the Security panel we found there is a checkbox you can use to turn off this dubious "assistance":
Uncheck the box, "Tell me if the site I’m visiting is a suspected attack site" and you gag the nanny. Should you do this? That’s up to you. We did, because we’re not going to let some entity with unknown motives (be it Google or StopBadware) decide whether we can get to a web site.
There are at least three things wrong with the way Firefox implements this. First, the warning doesn’t need to be dark blood red on black… that’s just over the top, and needlessly ominous. Second, they need to explain EXACTLY why they are declaring a site bad - for example, if the site happens to have one link on it that will cause us problems if we click on it, then tell us about that link and we’ll be sure to avoid it. But, don’t declare the entire site off limits!
And third, the warning needs a button that allows you to go to the site anyway. Even if it says something like "Okay, you’ve warned me, I’ll take the risk" or something like that, there needs to be a way for a user to bypass the warning on one site without turning off the warning for all sites henceforth.
Right now, the only site we really want to block is StopBadware, until they decide that they should give users enough respect to explain why they are warning about a site. The heavy-handed approach used in Firefox 3 is totally repugnant to us.
As a final comment, we know there are bad people out on the Internet, but we fear that we are all getting too many warnings. For example, every time we download some software program from the Internet, the first time we try to run it we get a warning that this is something we downloaded. No fooling! What a useless warning. It doesn’t tell us anything about whether the software is safe to run, it just acts as though all downloaded software is potentially unsafe, so it had better make us click an extra button before we run it - which by now we do mechanically. If there were ever a real threat, we’d probably click right through and let it run.
Haven’t parents been reading the story of "The Boy Who Cried Wolf" to their children lately? Because it looks to us like the makers of browsers and operating systems sure never heard it.
Subscribe to CAF
There has been a massive increase in sites getting hacked and including links to malware. If the site in question is a WordPress install, I think it’s even more likely that it got hacked. I’ve seen no fewer than 10 WordPress sites compromised in the last week.
That is to say, Yes, it can be annoying to be blocked from accessing a site (and in current Firefox builds that are about to become Firefox 3, you can proceed to the site though it will have a big red warning bar at the top) but being blocked from a hacked site is far from the worst thing that can happen to you on the Web.
BTW, I just checked the site and while it looks clean today, it is a WP site and I’d wager it was recently compromised and then fixed and that’s how it got on the badware list. Either that or one of the downloads it was linking to was a known virus/trojan/malware product.
- A