New Update Download Sentinel improved functionality new versions

Thread details
Extension store page
https://chromewebstore.google.com/detail/download-sentinel/ofjlbohlnaihneapmmnhkbllbekdofce
A 10% improvement is always better than nothing (y):

3.png
 
Version 3.0.3 pushed to CWS
1. Improved look-a-like heuristics
2. Risky download location negative score is halved when no other high-risk is found (e.g. look-a-like, or file type change or file type mismatch with mime-type)

@Sampei.Nihira (this gets 12% now)
1792129770956.png


P.S. for NextDNS users:
when you have BLOCK BYPASS METHODS enabled in parental control, you need to add QUAD9.NET to the whitelist otherwise NEXTDNS blocks the quad9 check.

You can check whether quad9.net is blocked by NextDNS because 3.0.4 now reports network error when Qaud9 does not resolve the download link.
pushed 3.0.4 to CWS
 
Last edited:
LinuxFan58 said:
Version 3.0.3 pushed to CWS
1. Improved look-a-like heuristics
2. Risky download location negative score is halved when no other high-risk is found (e.g. look-a-like, or file type change or file type mismatch with mime-type)

@Sampei.Nihira (this gets 12% now)
View attachment 300712

P.S. for NextDNS users:
when you have BLOCK BYPASS METHODS enabled in parental control, you need to add QUAD9.NET to the whitelist otherwise NEXTDNS blocks the quad9 check.

You can check whether quad9.net is blocked by NextDNS because 3.0.4 now reports network error when Qaud9 does not resolve the download link.
pushed 3.0.4 to CWS
Click to expand...

WOW !!!

You're always a force of nature, my friend.
Thank you so much for this optimization.(y);)
 
Sampei.Nihira said:
It appears that DS has surpassed uBlock Dynamic in the number of users who use these extensions.
943 users.
Click to expand...
In the Chrome developer console it still shows 45 users. Also all my extensions have no data (zero installs and zero removals). Also all three extensions have zero data (zero installs since yesterday), a flatliner in the usage data. Last time that happened (it has happened 2x times earlier) I got an automated mail that my extensions (then it were only 3P Matrix and uBlock Dynamic) were available for download (again).

Some members also reported extension not available at CWS. First time it happened I contacted Chrome Developer Helpdesk and got a reply (weeks after) that "a lot of de-installs were observed by users qualifying the extensions as suspicious" According to Google protocols the extension is taken off-line during the analysis, but when they find nothing it will be available in the webstore, but my usage data in the developers console shows a flatliner (zero installs and zero removals) but user base drops back to normal.

When I look at developer console data (of uBlock Dynamic), I can see a lot of installs (and de-installs) from browsers with russian language installed (Google Developer console reports that, I am not tracking that), while uBlock Dynamic is not distributed in CWS for people in Russia. So it is more likely it is just 1 guy using a Russian clickfarm (than a coordinate reputation shaming campaign of 1000 people).

1792325734366.png


Normally I get a flatliner (zero installs) for 1 or 2 days after I see an influx of number installations

1792340878195.png
 
Last edited:
Sampei.Nihira said:
@LinuxFan58

I just realized I have DS v.3.0.4.(y);)
Changelog?:unsure:

P.S.

It's interesting that the CCleaner download doesn't display an OVERALL RISK SCORE.
This type of alert isn't mentioned in the Readme on GitHub:

View attachment 300722
Click to expand...
Thanks I will have a look at it.

I found a way to find brand look-a-likes using top 1 million websites, while only reliable existing list the top 500 brands of brand finance. :-)
 
Last edited:
LinuxFan58 said:
In the Chrome developer console it still shows 45 users. Also all my extensions have no data (zero installs and zero removals). Also all three extensions have zero data (zero installs since yesterday), a flatliner in the usage data. Last time that happened (it has happened 2x times earlier) I got an automated mail that my extensions (then it were only 3P Matrix and uBlock Dynamic) were available for download (again).

Some members also reported extension not available at CWS. First time it happened I contacted Chrome Developer Helpdesk and got a reply (weeks after) that "a lot of de-installs were observed by users qualifying the extensions as suspicious" According to Google protocols the extension is taken off-line during the analysis, but when they find nothing it will be available in the webstore, but my usage data in the developers console shows a flatliner (zero installs and zero removals) but user base drops back to normal.

When I look at developer console data (of uBlock Dynamic), I can see a lot of installs (and de-installs) from browsers with russian language installed (Google Developer console reports that, I am not tracking that), while uBlock Dynamic is not distributed in CWS for people in Russia. So it is more likely it is just 1 guy using a Russian clickfarm (than a coordinate reputation shaming campaign of 1000 people).

View attachment 300758

Normally I get a flatliner (zero installs) for 1 or 2 days after I see an influx of number installations

View attachment 300767
Click to expand...

Right now, there are 2,000 fake users.:oops::oops:
 
Sorry @LinuxFan58 for your statistics, i picked up download sentinel like that (maybe i am part of fake users😞) :
  1. Version check: Compares the installed version with the latest version provided by Google.
  2. Secure download: Downloads the CRX package over HTTPS from an approved Google domain.
  3. SHA-256 verification: Compares the downloaded file's checksum with the hash provided by Google. Verification is mandatory by default.
  4. Package integrity: Checks the CRX header and verifies that the extracted ZIP archive is valid.
  5. Manifest validation: Checks that manifest.json exists and its version matches the expected version.
  6. Extension identity verification: Extracts the public key from the CRX package, verifies the expected extension ID, and injects the key into manifest.json to preserve the extension's identity.
  7. Safe installation: Prepares the new files in a temporary directory before replacing the existing installation, with a recovery mechanism if replacement fails.
  8. Browser profile cleanup: Optionally removes stale extension entries and restores existing settings after the update.
 
@LinuxFan58

Try running a download test with this:

hxxps://urlhaus.abuse.ch/url/3952221/

Google, GitHub... will never be blocked by DNS for compatibility reasons.
Even Osprey blocks the webpage,for now, (3h 32') only thanks to URLhaus.
On the other hand, the Online Malicious URL Blocklist,if I remember correctly,is updated every 12 hours, but it still doesn't block the webpage.

The DS alert is positive (green) for only 5%.;)
 
Last edited:
Sampei.Nihira said:
@LinuxFan58

Try running a download test with this:

hxxps://urlhaus.abuse.ch/url/3952221/

Google, GitHub... will never be blocked by DNS for compatibility reasons.
Even Osprey blocks the webpage,for now, (3h 32') only thanks to URLhaus.
On the other hand, the Online Malicious URL Blocklist,if I remember correctly,is updated every 12 hours, but it still doesn't block the webpage.

The DS alert is positive (green) for only 5%.;)
Click to expand...
Thanks. Missing website age or no age known will be treated as <90 days in stead of zero day. That is already an upcoming change.

I wil also have a look at the low ratings when VT results are unknown. A low rating should mark grey. Thanks
 
Crazy numbers reported in CWS (over 4000 users), while my own console has a flat-liner (zero installs and removals) since a few days (according to my math the number of users should be 88 - 7 = 81 and not over 4000) :-)

1792427297481.png



Update: Count already dropping: from obver 4400 users now just 4000 users, while installs increased to 91 and removals to 8 = 83 :-)
 
Last edited:

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top