×
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Nodus
Contributor
Message 1 of 8

False positives caused by inconsistensies in review posting facilities

In many cases you would like to post a review for certain subdomains or subdirectories of different domains. A good example of such cases are many services offering shared hosting (e.g. t35.com) or redirection services (e.g. tinyurl.com). The reviews are not intended to be posted onto the base domains, since they usually don't apply to those directly, and could be considered as false reviews or false positives.

Over time I have noticed some inconsistencies in how SiteAdvisor handles posting reviews for subdomains and subdirectories, especially when using the bulk posting facilities. Basically you cannot review subdomains or subdirectories at all, but there seem to be some exceptions:

  • You can review any subdirectory beginning with a tilde (~).
  • You can review any subdirectory of specific domains (e.g. tinyurl.com, h1.ripway.com)
  • You can review any subdomain of specific domains (e.g. tripod.com, t35.com)

The problem is you only know which domains allow that by experimenting. If they don't, the review will automatically end up to the base domain, which usually was not what you intended. And some of them will bite you: if you post to domain.us.to, the review will show up at domain.us.to as expected, but posting to domain.uk.to will result in the review showing up at uk.to.

Just take a look: there are many reviews that are clearly intended for subdomains, and if posted in bulk, the reviewers didn't probably even notice where the reviews actually ended up to. Sometimes I have even noticed comments from other users regarding such false reviews, suggesting that the reviewer must be stupid reviewing a shared domain that way.

But there's more. Just to mention a couple of such cases, if you post a review for domain.cz.cc or domain.weebly.com using the bulk posting facility, they will end up to cz.cc and weebly.com, respectively. But if you post them manually, they will end up to where you intended. And of course this behavior applies to only some specific domains, which you don't know in advance...

All this is especially a problem when reviewing e.g. phishing domains, since the scam often resides in some subdomain or subdirectory, and you can't always be sure whether SA will accept those or not. And then you end up reviewing bit.ly when the actual scam was using bit.ly/SomeRandomSubdirectory as the URL (naturally redirecting to somewhere else)...

In a nutshell: If you haven't experimented with it before, you can never tell whether you can post a review for a particular subdomain or subdirectory. If posting in bulk, you may not even notice that the review actually ended up in a wrong place. And in some cases it would have ended up to the correct place, had you just posted it manually.

I'd like to see some consistency here. It's not funny to notice you posted a false positive when, in theory, you actually did everything right. Would it be a problem if reviewing subdomains and subdirectories was possible for all domains? I don't think the SA staff will be able to keep up with updating shared hosting services etc., if that's how it's supposed to work now.

7 Replies
Hayton
Reliable Contributor
Reliable Contributor
Message 2 of 8

Re: False positives caused by inconsistensies in review posting facilities

Thank you for posting that. It's useful - and chastening - to get an insight into how these things actually work, as opposed to how they're supposed to work. But I wonder how many people who actually get a false positive will be willing to understand the limitations and/or inconsistencies of the review system?

I found it enlightening though. Thanks again for the explanation.

exbrit
MVP
MVP
Message 3 of 8

Re: False positives caused by inconsistensies in review posting facilities

Nodus, I agree with Hayton, thanks for posting that. 

Let's hope someone from McAfee HQ reads it.

NotBuyingIt
Reliable Contributor II
Message 4 of 8

Re: False positives caused by inconsistensies in review posting facilities

In a community discusison thread late last year, a  McAfee staffer indicated that a big update in the bulk posting tool which some experience reviewers (like Nodus) use, may be forthcoming.  I don't know the tool's current lifecycle(?) status, but perhaps the inconsistancies between it and manual postings might get fixed in an impending revision.

From reading Nodus's critique, I've learned some helpful information about the mysteries of the subdirectory site reviews -- Thanks.

newjack
Former Member
Message 5 of 8

Re: False positives caused by inconsistensies in review posting facilities

That is a good point.Although the basic concept is a good idea. site advisor could use a little tweaking.As some people have complained recently about their site being rated red.I also came across something interesting earlier today.Another site marked green with many red downloads.So hopefully they can tweak the idea a bit.Another problem is pages rated green and unless you dig a bit deeper you may potentially download something nasty.Here is image below.

Message was edited by: newjack on 1/30/11 12:26:05 AM EST
user_75532
Contributor
Message 6 of 8

Re: False positives caused by inconsistensies in review posting facilities

GRC.com .. is a safe site, if SiteAdvisor was to be red flagging this site, it would be un-merited.

There going to be perfectly legit, and harmless utilities like those that demonstrates various leaks in software firewalls .. flagged as red while they aren’t actually a threat if ran. Other things like AntiVirus harmless test samples (like EICAR), red flagged to merely prove it can detect and have this antivirus system demonstrate how it’ll re-act on a real deal. We have useful utilities from trusted sources, like from Nirsoft that should be green rated site, but with red flagged downloads on stuff like harmless Password Recovery utilities.

Message was edited by: Phant0m`` on 30/01/11 1:04:46 CST AM
newjack
Former Member
Message 7 of 8

Re: False positives caused by inconsistensies in review posting facilities

I never said grc was a bad site.Although there could be something wrong with it.I was in agreement to the fact that there could be some improvements to the ratings system.Or the way that 1 specific site is rated.This was just an example of some of the things you see.After looking into  site advisor little deeper 27 red downloads.

Nodus
Contributor
Message 8 of 8

Re: False positives caused by inconsistensies in review posting facilities

Hayton wrote:

But I wonder how many people who actually get a false positive will be willing to understand the limitations and/or inconsistencies of the review system?

Exactly. I have been trying to correct my own mistakes whenever I notice them, but I'm sure there are many that have gone unnoticed. A good example of a somewhat heated discussion about this kind of false positives -- as well as many false positives -- can be found at the review thread of the beforementioned cz.cc. You can see that at the time of my comments it was not yet quite clear to me as to how cz.cc subdomains would accept reviews, if at all. Now I know you can post them only manually. That service is also abused quite a lot, which increases the need to be able to review subdomains.

The good thing is that the bulk posting tool doesn't allow posting a review for a domain that you already have reviewed. So, at least a single reviewer can't (unintentionally) post many false reviews for a single domain.

All this of course also brings us to the question whether it would be reasonable to let reviewers edit or at least remove their own reviews. I would support that, even if it would be possible for a limited time after the submittal of the review.

NotBuyingIt wrote:

In a community discusison thread late last year, a  McAfee staffer
indicated that a big update in the bulk posting tool which some
experience reviewers (like Nodus) use, may be forthcoming.  I don't
know the tool's current lifecycle(?) status, but perhaps the
inconsistancies between it and manual postings might get fixed in an
impending revision.

Yes, I remember that. Don't know about the lifecycle either, and whether this kind of things were included in any "to do" list, which is why it's good if they also reached the ears of someone in a suitable position.

How Many Badges Can You Collect?
Ready for a little competition? Members like you are earning badges and unlocking perks for their helpful answers. Are you? Click here to find out.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community