Google is blocking autohotkey.com

[nnnik]

A certificate error like this - no certificate being provided would certainly result in an error being shown.

[zaphodikus]

This security problem persists today - can you provide a page with clear file signatures and checksums please. This is easy to solve.

[gregster]

You could use Lexikos' original release on github: https://github.com/Lexikos/AutoHotkey_L/releases

@joedf:
What about directing people to that release anyway ? (as long as this is not sorted out...)

[SOTE]

You could use Lexikos' original release on github: https://github.com/Lexikos/AutoHotkey_L/releases

@joedf:
What about directing people to that release anyway ? (as long as this is not sorted out...)

If Google SearchConsole is claiming the issue is certain old zips, then this could be a good long term solution. Instead of having the files on this website, have links to the GitHub releases. Google will have a much harder time screwing around designating GitHub (under Microsoft) as a malware website. If they dared, they better have very legitimate reasons with actual proof. Plus it's much more obvious the software is open-source, with viewable source code, thus safer than most closed-source.

Preferrably as a direct link for downloading, so people don't have to search everywhere.
https://github.com/Lexikos/AutoHotkey_L/releases/download/v1.1.32.00/AutoHotkey_1.1.32.00_setup.exe
(Download of latest version of AutoHotkey)

[joedf]

Our certificate from cloudflare covers *.autohotkey.com
I just tried changing a non-www domain, but I think I screwed it up so I undid the changes. I'm not sure what else is in place that needs to be changed.

I'd rather have @tank revisit this, so I dont break anything that he might have put in place...

[supremepizza]

Not sure if this will help, but it looks like the certificate for ahkscript.org is expired according to my AV, so that might be triggering it.

[joedf]

ahkscript.org is on a simple redirect now (both domains are on the same server). I don't think we are using it for anything else right now.

[Snefferdy]

I'm new. I want to install autohotkey, but I'm getting this big warning when I click on the download link. It makes me not want to download. Does anyone see a light at the end of the tunnel for when this may be fixed?

[Xtra]

I'm new. I want to install autohotkey, but I'm getting this big warning when I click on the download link. It makes me not want to download. Does anyone see a light at the end of the tunnel for when this may be fixed?

Just download it from: -----------> https://github.com/Lexikos/AutoHotkey_L/releases <------------

[SOTE]

Our certificate from cloudflare covers *.autohotkey.com
I just tried changing a non-www domain, but I think I screwed it up so I undid the changes. I'm not sure what else is in place that needs to be changed.

I'd rather have @tank revisit this, so I dont break anything that he might have put in place...

If you guys got your certificate from CloudFlare (as the browser shows), then I'm not understanding what the issue that Google has. Google's big red warning seems to be specific to files hosted at www.autohotkey.com. Aren't you able to use Google SearchConsole and see what they are giving the warning for?

[Xtra]

Aren't you able to use Google SearchConsole and see what they are giving the warning for?

To add to the above:
https://developers.google.com/web/fundamentals/security/hacked/use_search_console

[joedf]

The same issues, year after year... I tried changing filename, reporting a false positive... with varying success but all temporary.
Sometimes they approve it, but they've denied my previous review requests... I usually just end up deleting the old version installers that trigger it... :/

Edit: many like us here...
one individual has suggested to use online installers... https://support.google.com/webmasters/thread/8128670

[ahk7]

I see no good reason to keep the downloads here on autohotkey.com, just move it to GitHub, probably saves this website a lot of traffic and thus lower the bill. Let Microsoft pick up the tab

There is an API[1] so you can automatically redirect the download link/button to the latest version, setting up an additional repo at https://github.com/ahkscript/ for older versions seems rather trivial as well. The version.txt check can still be hosted here at autohotkey.com of course.

[1] https://developer.github.com/v3/repos/releases/

[SOTE]

I agree with the others. Force Google to try continuing it's bizarre behavior and shadow censorship with Microsoft and GitHub. This puts egg all over whatever weirdness that Google is trying to do. Right now, they can play the game of pretending there is something wrong with this website without ever being specific or ignoring the webmaster asking them to remove warnings or stop the bias. However, Google trying to shadow ban open-source software on GitHub is definitely a recipe for them to be successfully sued. If Microsoft and GitHub allows the software, then Google will have to specifically prove their case, versus being ambiguous as they are now.

Furthermore, there can be multiple GitHub repositories of where official AutoHotkey files exist. This would be quasi-backup in case a specific repository got deleted and prevent the targeting of any one of them, as the other can be switched to.

Lastly, I do think the AutoHotkey Foundation is big enough and has enough of a worldwide impact, that you should be able to get an audience with someone at Google specifically. An actual human at Google, who can clarify what they are doing and put a stop to the unfair treatment of your website.

[joedf]

I believe lexikos handles the downloads page (or something related to it) through a script.
@lexikos should we redirect to Github, at least for now?

[SOTE]

I believe lexikos handles the downloads page (or something related to it) through a script.
@lexikos should we redirect to Github, at least for now?

Any updates on possibly fixing the situation? The Google red warning is still in full effect.

[joedf]

I just deleted the older version, put in a review request and added <meta name="robots" content="noindex,nofollow"> to the downloads page.
Now the waiting game... We'll see :/

[lexikos]

@lexikos should we redirect to Github, at least for now?

Do whatever you think is best. I pointed the links to GitHub for a short time years ago, but changed it back because it was being flagged as malicious due to files belonging to other projects. It also seemed slower. If I update a release file (such as to fix an issue with the installer or documentation), the FTP uploads are automatic but the GitHub release must be updated by hand (so I might not bother).

[joedf]

Understood. I'll see what response we get from google.
Otherwise, I might consider switching back and forth between here and github... not ideal :/

Also, I found this page. we might be able to report a false positive here: https://developers.google.com/safe-browsing/v4/reporting
They don't seem to listen at all though the Google Search Console / Webmaster Tools anyway...

[ahk7]

fyi You can use an Action to update / add assets of a release it seems, so would be similar to scripted FTP.

https://developer.github.com/v3/repos/releases/#upload-a-release-asset
https://github.com/actions/upload-release-asset