The "lie" the author was complaining about was that Firefox is miscommunicating what it did: It warned that a concrete file was containing malware when it actually found a suspicious domain.
Depending on context, that might make a huge difference - e.g., if a user got such a warning for a file they uploaded themselves, they might get the wrong impression that their system is compromised.
As the author noted, simply describing the actual threat would clear this up.
> Sure, there are some costs to false positives, but they are dwarfed by the cost of false negatives.
This strategy has blown up a number of times already. If you present too many false positives, users might lose trust in you and ignore your predictions altogether.
I've upvoted you, since I think your point is good, I'd just add that as a developer, I've found myself on more than one occasion pushing for the type of UX being advocated here, and getting pushback from designers/PMs. Typically, the issue I run into is a desire for the UX to be "simple", sometimes simpler than the system underlying it actually is (or is even capable of being), and so instead of clear and correct messaging, you get simplified and incorrect messaging.
(My current example of this would be ZIP codes. People like to simplify them to a geographic area in their heads, and then think of them as polygons, and then from there, think you can ask "is this lat/lng inside this ZIP?"; ZIP aren't polygons (they're defined as segments of roads) so answering that question requires approximations; those approximations are sometimes wrong.)
Designer: This label is required to say what store the user is at given his location.
Developer: the location sensor is imprecise. We could have 20m of precision or worse. The store location data is also known to be inaccurate and incomplete. We can provide top 10 candidate stores with their probabilities. The “top” one we return could be 95% likely or 35% likely. Your move!
Bad Designer: Too much numbers for my brain. We’ll just show the top result. YOLO!
Better designer: We could only show a result if it’s above a certain threshold. Or we could show top 3. Or maybe we need to talk about changing the requirement.
Better developer: There may be other signals and inputs we could use to help make the results more confident...
If I consulted Google Maps and it told me I'm with 48.25% likelihood at address A, with 39.81% likelihood at address B and with 11.94% at another location, what exactly am I to do with this information?
I think Google Maps actually shows a good design to communicate the uncertanity: They show the uncertanity as a blue circle of varying size. It's visual but (more importantly) gives you as a user the ability to reduce the uncertanity with their own information. E.g., if you know you're at an intersection and the circle covers only one, you now have a precise location.
In general, I'd say, it's important to know which context the information is used.
If your machine gets infected you format all because it is insecure by definition. You might even need to throw out physical machine...
If you get one it downloads ten other and you don't know which one will pass your virus scanner.
It is not fun and games anymore, silly nerds having fun are not doing it. It is actual crime and really bad guys that would kill you without blinkink an eye are doing malware.
If there is one infected file on your domain you consider whole domain compromised.
I trust Mozilla more than some pirated content website or their user.
If you need that content more than you are afraid to be hacked and understand risks involved you are good to go.
People who are not aware of that threat need to be warned. Telling nicely does not work and people will click OK without reading.
Just as I wrote it is not fun and games and magic unicorns from internetz are not giving latest movies/programs for free.
Yes it is censorship, but as I wrote if you understand the risk and know what to do you will find your way to download it without firefox.
On the other hand if you don't trust then those should be included.
Question is, does Mozilla trust google enough? Does Mozilla trust some random website where people host pirated content?
That is random article written by some random guy. Seems like he is more technical than average Joe, but he does not have any statistics to show why this behaviour was implemented. It just looks like a nag that he get his pirated downloads flagged by Firefox. It is backed up by bunch of people who also use it on /r/libgen. If they don't like it they can move to IE6.
So it is not like this domain hosts one bad file and it got flagged, it is apparently more often if it "sometimes .. is .. lie".
It's just a huge annoyance with no considerable benefit.
Having said that, I do agree that browsers shouldn’t implement lots of crazy features but I personally don’t mind if they have some kind of malicious file scanning feature.
Browser.safebrowsing.malware.enabled
Just set it to false IF you consider yourself a poweruser.
Even if Firefox did a full virus scan, there would still be false positives and false negatives in the results.
The system designer always has to put their reporting threshold somewhere, and that always means making a decision to bias towards false positives or false negatives. Eliminating false positives means exploding the number of false negatives.
Unfortunately, people like the OP don’t understand this, and yell angry things like “Firefox is lying to me!” Others here suggest FF should inject a bunch of weasel words like maybe and could and might. That’s a seemingly rational thing to do if you believe you’re informing a customer population that understands things like false positives and false negatives, but we have pretty clear evidence that they don’t. So FF makes a conscious informed decision to prefer reporting false positives over false negatives and then allows the user to override if they believe they know enough to do so. Sure, there are some costs to false positives, but they are dwarfed by the cost of false negatives.