Download - Future of the Internet – And how to stop it.

Stability on a Generative Net 171
Google search result: “Warning: This site may harm your computer.” 40 Those
who clicked on the link anyway would, instead of being taken to chuckroast
.com, get an additional page from Google with a much larger warning and a
suggestion to visit StopBadware or pick another page instead of chuckroast’s.
Chuckroast’s visits plummeted after the warning was given, and the site
owner was understandably anxious to figure out what was wrong and how to
get rid of the warning. But cleaning the site requires leaving the realm of the
amateur Web designer and entering the zone of the specialist who knows how
to diagnose and clean a virus. Requests for review—which included pleas for
help in understanding the problem to begin with—inundated StopBadware
researchers, who found themselves overwhelmed in a matter of days by appeals
from thousands of Web sites listed. 41 Until StopBadware could check each site
and verify it had been cleaned of bad code, the warning page stayed up. Difficult
questions were pressed by site owners and users: does Google owe notice to
webmasters before—or even after—it lists their sites as being infected and
warns Google users away from them Such notice is not easy to effect, because
there is no centralized index of Web site owners, nor a standardized way to
reach them. (Sometimes domain name records have a space for such data, 42 but
the information domain name owners place there is often false to throw off
spammers, and when true it often reaches the ISP hosting the Web site rather
than the Web site owner. When the ISP is alerted, it either ignores the request
or immediately pulls the plug on the site—a remedy more drastic than simply
warning Google users away from it.) Ideally, such notice would be given after a
potentially labor-intensive search for the Web owner, and the site owner would
be helped in figuring out how to find and remove the offending code—and
secure the site against future hacking. (Chuckroast eliminated the malicious
code, and, not long afterward, Google removed the warning about the site.)
Prior to the Google/StopBadware project, no one took responsibility for this
kind of security. Ad hoc alerts to webmasters—those running the hacked
sites—and their ISPs garnered little reaction. The sites were working fine for
their intended purposes even as they were spreading viruses, and site customers
would likely not be able to trace infections back to (and thereby blame) the
merchant. As one Web site owner said after conceding that his site was unintentionally
distributing malware, “Someone had hacked us and then installed
something that ran an ‘Active X’ something or rather [sic]. It would be caught
with any standard security software like McAfee.” 43 In other words, the site
owner figured that security against malware was the primary responsibility of
his visitors—if they were better defended, they would not have to worry about