I wanted to update readers on the micro-scandal surrounding the Progress & Freedom Foundation’s “Issues & Publications” database. As I noted on Monday, Google’s search engine automatically flagged that database as the victim of a malware attack: some unknown third party (probably as part of a large-scale attack on SQL databases that did not target us in particular) had taken advantage of a vulnerability in the PFF database to insert malcious scripts capable of infecting users’ computers. Google immediately and automatically flagged that database (and the PDF files within it) as potentially dangerous and shared that information through its Safe Browsing API with the StopBadware.org project, a “neighborhood watch” group that flags potentially dangerous sites.
I attempted to correct the impression of some readers that Google was deliberately censoring the PFF site because of our disagreements on the sensitive issue of net neutrality. Matt Cutts, a Google engineer, has explained this far better than I ever could.
I’m pleased to inform readers that Stopbadware.org removed our database from their blacklist yesterday:
—–Original Message—–
From: reviews@stopbadware.org [mailto:reviews@stopbadware.org]
Sent: Wednesday, July 16, 2008 9:44 AM
To: Jeff Ho
Subject: StopBadware.org review of www.pff.org/issues-pubs/We have received and processed your request for review of your website, www.pff.org/issues-pubs/. Google’s most recent test of your website found no badware behaviors on the site. As such, the Google warning page for your site has either already been removed or should be removed shortly. In addition, if your site has been listed in our Badware Website Clearinghouse, we will remove your site from the Clearinghouse list.
Sometimes website owners are confused about why Google placed a warning in the search results for their site. In many cases, a website run by an innocent site owner has been hacked by a malicious third party, causing the site to distribute badware without the site owner’s knowledge. If your site was distributing badware because it has been hacked, then simply removing the bad code from your site is not enough to keep your site clean in the future. You will also need to work with your hosting provider to fix all security vulnerabilities associated with your site.
Please note that we will be retesting your website at periodic intervals in order to monitor that it remains free from badware. If we find that you are hosting or distributing badware in the future, the reviews process may take considerably longer than the original review.
Answers to commonly asked questions from site owners who are the subject of Google warnings can be found at: http://stopbadware.org/home/faq#partnerwarnings
For tips on keeping your website clean and secure, please visit: http://stopbadware.org/home/securityThe StopBadware Team
In short, the process used by StopBadware works–and fairly quickly. It might not be perfect, and some of the commenters on my earlier piece on this subject speculated as to ways to make this system more precise and effective. But all readers should recognize that, whatever its current flaws or limitations, this is another valuable service provided by Google at no cost to users. For that, we should all be grateful. I, for one, expect that it will evolve and grow over time and that many of the current complaints will be addressed in the future.
I’ll have more to say about the policy issues raised by this debate but will be at the Space Frontier Foundation’s NewSpace 2008 Conference for the next few days, where I’ll be leading a discussion on space commercialization.
The Technology Liberation Front is the tech policy blog dedicated to keeping politicians' hands off the 'net and everything else related to technology.