New Update Osprey Browser Protection discussion and updates

Thank you for answering that, hopefully Microsoft will finish reviewing one of them soon.

The other day when I was looking around the internet for anything about Osprey Browser Protection.

Here is one website that I found: Osprey - Open Collective

That and when you mentioned the cost of hosting the proxy made me think about donating, since I already donate to some other things like, Wikimedia / Wikipedia, et cetera.
That page is old and will be reworked in the future, or taken down entirely. Hosting isn't expensive. :giggle:
 
  • Like
Reactions: Sorrento
When I asked ChatGPT which of the Osprey Browser Protection providers to enable when I wanted to use only professional services AND I am already using Google Safe Browsing (new privacy focused cloud realtime lookup APIv5 is implemented) and Cloudflare free Zero Trust with malware protection (but NextDNR free with account provides similar protection) it said only to enable those.

1786012131504.png


@Foulest: I have a question.

Why do you have your server in Antiqua and Barbuda while you live in the US? This is typical for mail-box companies often related with sketchy practices.

Privacy and Confidentiality Antiguan law provides strong privacy protections for business owners. The identities of shareholders and directors are not part of the public record, and unauthorized disclosure of IBC information is a criminal offense. This appeals to individuals seeking to shield their business activities from public scrutiny, competitors, or potential litigants.
 
Last edited:
When I asked ChatGPT which of the Osprey Browser Protection providers to enable when I wanted to use only professional services AND I am already using Google Safe Browsing (new privacy focused cloud realtime lookup APIv5 is implemented) and Cloudflare free Zero Trust with malware protection (but NextDNR free with account provides similar protection) it said only to enable those.

View attachment 299254

@Foulest: I have a question.

Why do you have your server in Antiqua and Barbuda while you live in the US? This is typical for mail-box companies often related with sketchy practices.

Privacy and Confidentiality Antiguan law provides strong privacy protections for business owners. The identities of shareholders and directors are not part of the public record, and unauthorized disclosure of IBC information is a criminal offense. This appeals to individuals seeking to shield their business activities from public scrutiny, competitors, or potential litigants.
That way he can make sure to protect privacy as best as possible so it's a huge plus (might help prevent some governments )and he doesn't save logs , information too and strips as much information as he can sending only what's necessary the domain and little to no private information




About providers unless you have false positives I will enable them all they don't reduce any page loading or have any penalty other then false positive ratio and the providers are chosen based on actually responding and classifying false positives some were removed as they didn't do the necessary to fix false positives
 
That way he can make sure to protect privacy as best as possible so it's a huge plus (might help prevent some governments )and he doesn't save logs , information too and strips as much information as he can sending only what's necessary the domain and little to no private information
Two counter arguments and a plus for Foulest (nr 3)

1. You have to believe Foulest on his word for that. The mentioned AC laws are to protect the privacy of the business owners not their clients (public scrutiny and potential litigants)

2. Antigua and Barbuda have signed a tax deal and bilateral extradition treaty, with the US and are hosting refugees from the US and are receiving substantial funds from the US, so ....

3. On the plus side everything (also the server side software) is on Github
 
Last edited:
All PP's provide protection that may also be psychological.

However, DNS PP's generally never block certain well-known websites (GitHub, Google Drive, etc.) that may spread malware but are also considered a priority for accessibility.

Because a DNS either blocks everything or nothing.
 
When I asked ChatGPT which of the Osprey Browser Protection providers to enable when I wanted to use only professional services AND I am already using Google Safe Browsing (new privacy focused cloud realtime lookup APIv5 is implemented) and Cloudflare free Zero Trust with malware protection (but NextDNR free with account provides similar protection) it said only to enable those.

View attachment 299254

@Foulest: I have a question.

Why do you have your server in Antiqua and Barbuda while you live in the US? This is typical for mail-box companies often related with sketchy practices.

Privacy and Confidentiality Antiguan law provides strong privacy protections for business owners. The identities of shareholders and directors are not part of the public record, and unauthorized disclosure of IBC information is a criminal offense. This appeals to individuals seeking to shield their business activities from public scrutiny, competitors, or potential litigants.
I don't have my server in Antigua and Barbuda... it's in New York. I have no idea where you're getting this from. Osprey's LLC is registered in California.
 
I don't have my server in Antigua and Barbuda... it's in New York. I have no idea where you're getting this from. Osprey's LLC is registered in California.

ChatGPT served me this document (but those are not ISO codes). so that is why I asked, but the ISO code AC is for Ascension Island.
1786045878221.png


Apologize for the confusion, thanks for answering, AC is not a questionalble TLD
1786046406710.png
 
Last edited:
Last edited:
I just launched a small VirusTotal alternative for links. If you want to check a link's safety without opening it in your browser, use this:

Free Website Safety Checker – Malware, Phishing, & Scams

Let me know your thoughts! ;)
You can also see the status of Osprey's systems using https://status.osprey.ac as well.
That is amazing, I look forward to throwing some links at the URL scanner in the near future, and glancing at the status page sometimes.

Thank you very much @Foulest, and keep up the good work. :)
 
I just launched a small VirusTotal alternative for links. If you want to check a link's safety without opening it in your browser, use this:

Free Website Safety Checker – Malware, Phishing, & Scams

Let me know your thoughts! ;)
You can also see the status of Osprey's systems using https://status.osprey.ac as well.

If we take this link, which downloads a .bin file that has been in the URLhaus database for over 14 days:

0.png

it is flagged as malicious only by UrlHaus PP:

0a.png


If we analyze it with VT, only Dr.Web flags it as malware:

0c.png

If I download it, here is the result from the Download Sentinel extension for Brave:

1.png

P.S.

Unfortunately, Sirius LLM doesn't scan this type of file.
It would have been interesting to see the result.;)
 
Last edited:
As always thank you @Sampei.Nihira with your latets catch I could update the readme (had not found a download-URL which was unknown to show new hybrid analysis link) (y)

It shows that the heuristics work great. it is like having my former neighbor (a security expert working for the Dutch National Cyber Security Center) sitting beside you and telling, well I am not sure about this download: it shows signs of suspicious behavior. Better not install it and check twice.

It also shows (bin file type hidden), that a warning is better than a block! By using standard Google mechanisms it also consumes zero CPU (on download and on file write name Chrome triggers call Download Sentinel into action) :-)
 
Last edited:
When I search for Osprey on Chrome Web Store it appears


View attachment 299665

But when I click on it says item not available
View attachment 299666

But it is avialble on Edge
View attachment 299667

Would Google be so vindictive that it blocks it because Osprey started an alternative for VirusTotal (also Google owned) or is it just temporary unavailable?
I encountered this issue before with many security extensions on the Chrome Web Store, but I couldn’t identify the cause.