IE Should Use Google's Malware List 109
Frequent contributor Bennett Haselton writes with an idea that he thinks could help keep browsing on Microsoft's browser more secure for users — and benefit Microsoft as a result. "Tests show that IE's malware filter performs well against other browsers that use the Safe Browsing blacklist from Google. But wouldn't IE's filter be even more effective if it used both filter lists at the same time? And are the political obstacles to that really so insurmountable?" Read on for the rest of a plan that seems a lot more than half-baked.
Most major browsers now come with a built-in blacklist of malware-infected or phishing websites, that display a warning if the user tries to access them in the browser. Internet Explorer 8 uses Microsoft's SmartScreen filter, while Firefox, Safari and Chrome all use Google's Safe Browsing API. Recent tests from NSS Labs reported that IE's filter blocked 81% of "socially engineered malware sites" from the lab's sample, while Firefox, in second place, blocked only 27%, and other browsers trailed even further behind. When NSS Labs ran a test of the different browsers' efficiency at blocking phishing sites, IE and Firefox scored about the same, both blocking about 80% of the sites in the sample. These results left a lot of unanswered questions, such as: Why Firefox, Safari and Chrome got such different scores in both tests (since they supposedly all use the Safe Browsing blacklist), and why such a huge gap between IE's and Firefox's performance in the malware test, but such close scores for the two browsers in the phishing test (the Google Safe Browsing API page says that the database is an attempt to list both malware and phishing sites, after all).But I had a different question: Since Google allows anybody to use the Safe Browsing API, why doesn't Internet Explorer use it as well, in conjunction with their own blacklist, so that a site will be blocked by IE if it's present on either list? This would almost certainly increase the block rate for IE (unless the set of sites blocked by Safe Browsing was entirely a subset of the sites blocked by SmartScreen, which is extremely unlikely). Google's Terms of Use for the Safe Browsing API do require parties to obtain written permission for any usage that will result in more than 10,000 users sending "regular requests" to the API, which would obviously include Internet Explorer. But Google already serves requests for all Firefox users who have the SafeBrowsing API turned on, so for them to process requests for all Internet Explorer users might require four or five times as much computing power, not orders of magnitude more. It's impossible to guess what kind of deal Microsoft and Google would make for the right to have IE do lookups on the Safe Browsing API, but if Microsoft placed a dollar value on increasing the protection for their users, and that dollar value exceeded the cost to Google of running the servers to process the additional queries, then in theory they should be able to agree on a price between those two amounts. Google might well offer to service the queries for free, just for the prestige of being able to say that the Safe Browsing database provided protection for almost all major browsers on the market.
(Microsoft's SmartScreen team declined to comment on the record about their reasons for not using the Safe Browsing list in addition to their own database. I couldn't get an official response from Google about what position they would have on Internet Explorer using the Safe Browsing list, although unofficially an employee said the team would probably be "delighted" if IE were to use it.)
It's worth underlining what a strong statement Microsoft is making by not using the Safe Browsing list. They're not just saying that their own list is better. They're saying that the Safe Browsing list is of such low quality that adding it to their own product would actually make the product worse.
This is different from, for example, what McAfee and Symantec might say about each other's anti-virus lists. Consider the set of all viruses that McAfee blocks and the set of all viruses that Symantec blocks. Let List X be the overlap — the huge swath of viruses that are blocked by both McAfee and Symantec. Then let List Y be the set of all viruses that are blocked by McAfee but not blocked by Symantec, and let list Z be the set of all viruses that are blocked by Symantec but not by McAfee. (So McAfee blocks viruses in the set X+Y, and Symantec blocks viruses in the set X+Z.) Now, representatives from McAfee and Symantec will each say that their list is the better one, which they may or may not believe. But even McAfee is not claiming that List Z — that portion of the list that is blocked by Symantec but not by McAfee — is so worthless that McAfee wouldn't incorporate it into their own product if they could get it for free. If Symantec allowed any anti-virus maker to download Symantec's anti-virus signature database, then presumably McAfee would scratch their heads a bit about why Symantec would do this, but if they cared about giving their users maximum protection, they would incorporate it into their product as well (so that McAfee would then be blocking all viruses in the set X+Y+Z, instead of just the set X+Y as they were before). But Symantec doesn't make it available for free, so McAfee doesn't have the option of using it and the issue doesn't come up. Other than each company claiming their product is the better one (which is par for the course for competitors), the two companies' positions are not contradicting each other.
But consider the analogous situation for anti-malware lists, where X is the set of all sites blocked by both IE's SmartScreen and by the Google Safe Browsing API, Y is the set of all sites blocked by SmartScreen but not by the Safe Browsing API, and Z is the set of all sites blocked by the Safe Browsing API but not by SmartScreen. When Microsoft says that they don't want to use the Safe Browsing list in addition to their own — that they would rather block just X+Y than block X+Y+Z — they're saying that they're estimating that the list Z is of such poor quality (too much risk of containing too many false positives) that it would be better not to block it at all.
In this case, Microsoft's position really is contradicting that of Google, Firefox, Safari, and others who use the Google Safe Browsing API. To achieve the best tradeoff between user safety and convenience, should the sites on List Z — the set of sites on the Safe Browsing API blacklist but not on the SmartScreen blacklist — be blocked, or not? If the answer is Yes, then IE should use the Safe Browsing API in addition to their own SmartScreen list. If the answer is No, then Google should take the URLs in the Safe Browsing API list, run them through IE using some automated script, and then remove all the URLs that weren't blocked by IE — in other words, remove all the URLs on List Z from the Safe Browsing blacklist. But I can think of no consistent set of assumptions that would lead one to recommend that both companies continue doing what they're doing now — that IE should continue not to use the Safe Browsing API, and that Google should continue publishing the Safe Browsing API without trimming URLs that aren't also blocked by IE. Microsoft is saying that the URLs on List Z should not be blocked; Google is saying that they should be.
(Note that this argument is independent of the relative weights that you assign to the benefit of blocking a genuinely malicious site, versus the cost of accidentally blocking a site which is not malicious. Different users might assign different values to these costs and benefits, and depending on what values they assign, those users would want different thresholds to be used in deciding whether to block a site or not. And Microsoft and Google have picked default thresholds that they estimate will meet the needs of the average user. But no matter what values you assign to the benefit of blocking a malicious site and the penalty for blocking a false positive, it's still the case that blocking the sites on List Z either does increases the total cost/benefit score — in which case IE should block sites on the Safe Browsing list in addition to its own — or it doesn't — in which case Google should remove sites from the Safe Browsing list that aren't blocked by SmartScreen.)
I suspect, of course, that the answer is the former — that the set of sites on List Z, those which are blocked by the Safe Browsing API but not blocked by SmartScreen, are probably approximately as likely to be malware as the rest of the sites on the list, and that it would make Internet Explorer safer if Microsoft augmented SmartScreen to use the Safe Browsing API as well. So why don't they?
The answer is probably what people have been shouting out from the back of the classroom since the first paragraph: That for political reasons, Microsoft doesn't want to be seen incorporating anything from Google into their own flagship application. It's not news that a company would prefer to promote its products over its rivals'. But this goes beyond, for example, Microsoft bundling Internet Explorer with Windows instead of Google's Chrome browser. Chrome and Internet Explorer do virtually the same thing, so it would look positively odd for Microsoft to promote IE over Chrome. But IE's SmartScreen list and Google's Safe Browsing list can be used simultaneously, providing more protection than either one by itself.
Still, Microsoft has already calculated that it would be an unwise move politically to use Google's Safe Browsing list. So I'm not trying to second-guess the calculation that they made, based on data that was available to them at the time. Rather, I think that if some publicity can increase the political benefit that they could get from using Google's Safe Browsing list in conjunction with SmartScreen (and increase the political cost of not using it), that might lead them to recalculate and make a different decision. To that end, let me raise up a banner that people can gather under if they want to:
Microsoft, we will not think any less of you if you use the Google Safe Browsing API in Internet Explorer in conjunction with the SmartScreen filter! We'll give you credit for setting aside petty rivalries and using the technology of a competitor in order to make users safer.
The IE team's blog post about the initial success of the SmartScreen filter, from March 2009, cited statistics showing 10 million malware blocks in the previous six months, and asked readers to think about those numbers in terms of their impact on real humans and the grief it saved them: "These are BIG numbers — each malicious download blocked helps prevent compromise of that user's computer." Since then, Microsoft has released new statistics showing that SmartScreen has delivered about 70 million blocks since IE8 was officially released. Of course, not every one of those blocks made the difference between infecting a machine with spyware and keeping it clean (many users wouldn't have downloaded or installed the software that the website was trying to send them), but the IE team is right to be proud anyway. However that also means that if adding Safe Browsing support to IE resulted in only a small percent increase in the filter's effectiveness, it would mean several million additional malware blocks over the same period, and cumulatively tens of millions of more in the years ahead. Isn't that worth Microsoft forming an alliance with Google, especially if doing that would make them look good?
Re: (Score:1)
It would destroy the Internet. (Score:3, Funny)
You see, IE would go up to the malware list, find itself, and then consider itself to be malware and implode. Multiply times a billion and you know what we'll get? That's right, 911 times a billion!
Re: (Score:2)
911 times a billion? Are you saying that IE is responsible for 9/11/01 now? Intriguing idea....
Yes, well, that's the sort of mediocre conspiracy theory I'd expect from you non-creative garbage.
Any truly paranoid expert will tell you the attacks were planned by Zionist Freemason Nazi Illegal Immigrants with H1B Terrorist Visas and carried out by trained fleas.
The Real Question (Score:4, Insightful)
is why shouldn't Firefox, Opera, et al. use IE's list as well, if it's so much better?
Re:The Real Question (Score:5, Insightful)
But honestly, I think The Real Questions are, "Why does Bennett Haselton have to blog every silly thought that pops into his brain, and why does slashdot have to put them all on the front page?"
Re: (Score:1)
Re: (Score:3, Insightful)
Because perhaps this is in fact news for nerds. Why a web browser, which is where most of us spend most our time, would not want to implement safety features is a great topic which merits debate. Seems like a cut and dried example of front page material to me.
If it were a concise, well-written article, then I would agree. As it stands, it's rambling, repetitive, and just a bit painful to read.
Re: (Score:1)
Re: (Score:2)
Re: (Score:1, Funny)
FAIL! We nerds spend most of our time in vi or emacs. Please turn in your geek card on the way out.
Re: (Score:2)
Re: (Score:2)
Firefox and Safari have advertising deals with Google. IE doesn't, as it directs people to Bing and the Live services instead.
The Safe Browsing API is what you get from Google along with some money for signing this advertising deal.
Re:The Real Question (Score:4, Insightful)
Isn't that, by the very definition, what a blog is?
Re: (Score:1)
@TheRealMindChild: "Isn't that, by the very definition, what a blog is?"
You sir, are the Real Genius.
Re: (Score:1)
ahh a digg user on slashdot.
Re: (Score:1)
What do you think blogs are for, exactly?
Re: (Score:1, Informative)
Perhaps because it is not being made freely available for use.
Re: (Score:1, Offtopic)
But I must admit that I don't even know what malware is. I assume it's not executables -- I cannot imagine people still download and execute those.
Re: (Score:2)
Also maybe if their is an exploit which doesn't have a fix yet, it would be good if the sites that incorporate the exploit are on the list.
Maybe their are other reasons as well ?
Re: (Score:1)
The real question: why is anybody on Slashdot using these malware lists?
Using something like this means you're sending every URL you visit to Google/Microsoft. Why would anybody here be for that in the first place?
Re: (Score:2)
Obvious answer:
"malware lists" are the new cookie tracking systems. Every time you go to a website, firefox tells google about it, and the service being provided is that google will let you know if it thinks the site is malicious or not. Internet usage data is some of the most valuable data on the internet. Why would any company give that sort of data to their competitors?
Re: (Score:2)
I believe it has something to do with IE list using proprietary technology, that Firefox, Opera, et al. would need to license before actually being able to use said list.
broswing (Score:4, Insightful)
"Frequent contributor Bennett Haselton writes with an idea that he thinks could help keep broswing on Microsoft's browser more secure for users -- and benefit Microsoft as a result."
I have an idea that I think could help keep Slashdot from embarrassing itself even more than failing to ask Blizzard about bnetd - use a spellchecker.
Re: (Score:2)
Well, he did misspell it, but only slightly - he forgot to capitalize it properly. It should be "BroSwing". It's an iPhone app for brotha's that like to swing ...
results may be biased (Score:4, Interesting)
Re: (Score:2, Insightful)
The fact that MS marketing is touting this result is not evidence of bias, it's just evidence that the test results favored MS. If the test were completed and showed Google's list performed b
Re: (Score:3, Insightful)
The fact that MS marketing is touting this result is not evidence of bias,
We don't have to show bias, NSS Labs has to convincingly show absence of bias. Their experiments are not peer reviewed and they are not reproducible, which means that they aren't worth the paper they are written on.
If the test were completed and showed Google's list performed better, MS would have simply not published the result at all and we never would have heard about it.
That alone means there is bias: selection bias. They can si
Re: (Score:2)
That alone means there is bias: selection bias. They can simply commission enough studies under enough different conditions and then select the (possibly tiny) subset of studies that show what they want.
Sure, except that the only available evidence we have is that this study was commissioned as a private study by the engineers within MS in order to determine how they might improve their own list, and was not initially intended as any sort of marketing effort. It was only picked up by marketing after the positive results were known. Unless you have some evidence that MS spent a lot of time commissioning multiple studies on this, there's no basis on which to claim bias.
Re: (Score:2)
Unless you have some evidence that MS spent a lot of time commissioning multiple studies on this, there's no basis on which to claim bias.
Well, we have
(1) a clear basis on which to claim bias in the selection of the study for publication
(2) a clear basis on which to claim that the study is scientifically worthless because it is not reproducible or peer reviewed.
What more do you want?
Re:four or five times as much computing power (Score:5, Funny)
And in base Z, it's over 9000!
Google's worst feature... (Score:2, Insightful)
You mean they should use that obnoxious Google feature that tries to stop one visiting crack sites? At least they could provide a link to continue, after the user is informed of the risks - to not include one is simply irritating.
Re: (Score:1)
I've been pissed off by that too, but there may be technical reasons for doing so. For example, some browsers prefetch links, and there could potentially be an exploit there.
Re: (Score:2)
You mean they should use that obnoxious Google feature that tries to stop one visiting crack sites? At least they could provide a link to continue, after the user is informed of the risks - to not include one is simply irritating.
Googles malware list is a crap list with many legit sites on it. It sucks almost as much as when they redirect links via their God-awful slow google.com/url slow boat to China. I have never encountered the malware redirect for a site that actually has malware. To be honest,
SPF (Score:3, Insightful)
I've recently heard about a concept called single point of failure [wikipedia.org], maybe you should look into it. If anything goes wrong and Google goes down with its malware list or they simply choose to block IE, we'll be completely defenseless.
Re: (Score:3, Funny)
You should try to read the summary, it helps understand the matter.
Re: (Score:3, Informative)
This post was generally full of speculation, but made me aware that there's a lot more I could be doing to add on protections to my general surfing.
Re: (Score:2)
This post was generally full of speculation, but made me aware that there's a lot more I could be doing to add on protections to my general surfing.
There's really only one thing you need to do to "add protections". Ready? Don't click the dancing bunnies [codinghorror.com]. Only download software from trusted locations, when it's something you're specifically seeking out. In my last 25 years of computing, I've managed to not get any viruses or trojans I did not actively want to install for research purposes. Malware scanning disabled,"safe surfing" and its annoying ilk disabled, and no antivirus except manual clamav scans once a month to make sure I didn't do someth
Re: (Score:2)
I'm confused how this got modded insightful.
That's easy: I didn't RTFA and neither did the mods :)
Political obstacles? (Score:2)
You forgot one thing: Steve Ballmer [wikipedia.org].
Dangerous (Score:4, Interesting)
All browsers using Google's blacklist effectively gives Google the power to censor the Internet.
Re: (Score:2)
Re: (Score:2, Interesting)
True that people can still ignore the warning, but if we're talking about the common user who is now terrified of viruses, spyware and 1337 h4x0rs, odds are they won't click continue.
The CMS that ran our corporate site got hacked a few months back.
Google crawled it and found some hidden links to some malware sites, and my company got on that blacklist.
Customers, suppliers and CEOs were all freaking out, so after we fixed it ASAP we went to Google webmaster tools and requested a recrawl of the site, and that
Re: (Score:1, Funny)
Only if IE blindly applies Google's blacklist with no preference to turn it off.
More likely it will show "Warning, this url is on Google's Malware blacklist. Click here to visit the url anyway."
more than half-baked (Score:2)
Where I come from, "baked" means stoned. With that in mind, I can't help thinking that "more than half-baked" is a very good description for this plan. The blindingly obvious flaw is that if Microsoft did use Google malware list, people would immediately start asking why Microsoft wasn't sharing it's list. While it might be easy for many Slashdotters to say that Microsoft should indeed do that, it does not make any more sense for Microsoft to do that than it does for it to open-source any of the rest of it'
Soo.... (Score:5, Funny)
11/16 baked?
Evolution gives you the answer. (Score:4, Interesting)
Basically Firefox and Google can be much more conservative when estimating a site's malware potential. Since the browser is more secuire, it can let it more attacks and trust Firefox to protect itself to a large extent. IE has a long history of being used in intranets of corporations, and making the browser secure will break tons of installations and companies will not accept it. Their only choice is to find all the malware hosting sites and block them.
Children who grew up in farms with contact with animals dont develop asthma. The nose and lungs are insensitive to some of the irritants. Kids who grow up in ultra clean, sanitized environment develop asthma. Japan is a basket case in this example. They need a bubble around them.
IE grew up in friendly benign corporate environment. It needs very good filters and blocks. Unix cut its teeth in multiuser, college enviornment. So its derivatives Linux and its cultural progeny Firefox and other OSS have immunity built into them deep down.
Re: (Score:2)
Re: (Score:2)
Most viruses these days will work with almost any browser. IE just has a longer legacy of old vulnerabilities. Sure, you could probably protect yourself by using the Cello browser with the OS/Warp operating system, but aside from going that far, you had better use your head and not get cocky (even Linux isn't bulletproof). The ultimate vector of any virus isn't the software, it's the user.
If you're running Firefox with NoScript, nothing is going to get through without you deliberately choosing to allow it. While yes, that still leaves the "cute kitten screensaver" attack vector open, it does make drive-by attacks much rarer.
As a side-benefit, it speeds up browsing by stopping page display from being held up for a stupid flash advert. (I don't mind ads, but hate being held up waiting for them. Webmasters, take note...)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Well, I dont know what he is laughing about exactly but I see a few major flaws here:
1. Firefox has vulnerabilities too. Any user running as root/admin with any browser is really taking a huge chance.
2. This post is really a lot of fanboy nonsense. You cant turn a negative like having a worse phishing filter into a positive. The fact that he is getting mod points shows the ridiculous fanboyism that defines slashdot.
3. This is a PHISHING FILTER. So it doesnt matter if you cant hack grandmas Firefox, shes al
Re: (Score:2)
Re: (Score:2)
In other words... "IE has defenses, Firefox and other OSS has defenses, but I'm going to spin it such that Firefox and OSS sound like they are better at it". The only real difference between wearing a bulletproof vest under a tailored suit and wearing
Re: (Score:2)
Re: (Score:3, Informative)
>. Since the browser is more secuire, it can let it more attacks and trust Firefox to protect itself to a large extent.
There are mostly phishing filters, so what you just wrote doesnt matter. Yeah, its great grandma's firefox isnt taken by some IE-only exploit, but she just typed in her social security number and credit card numbers at www.macys-apparel-0459593-discount.com.
Re: (Score:1)
Your argument about evolution is faulty.
Evolution predicts that individual features become more capable as the benefit of having such features increases within the relevant environment. If "IE grew up in a friendly benign corporate environment" implies that it was exposed to relatively fewer threats than if it were exposed to more threats in a different environment, having protection against malware in an environment free of malware would provide a lower value than having protection against malware in a hos
Re: (Score:2)
"Evolution gives you the answer"
Pah! Typical slashdotters always assuming that evolution is the answer. We all know that IE is a product of intelligent... ... wait, on second thought...
This Google-worship really has to end (Score:1, Insightful)
Look, monoculture wasn't a good thing the last time and it isn't a good thing this time either. Multiple, competing sources of data please. I don't want a mistake in Google's data to mean it will automatically get propagated to MS' products, nor do I want a mistake in MS's list to automatically propogate to Google.
As for Microsoft having calculated this politically, I'll bet it never gave the matter a moment's t
Another possible solution (Score:2)
Surely a slightly better solution would be for the Smartscreen server to import Google's data rather than everyone's version of IE? That way they could insert the results directly into their own database and so there would only be one hit to Google's API (rather than several million), they could ve
How about other browsers use the MS list? (Score:3, Insightful)
This advocates MS also using the Google list. How about Firefox, etc, also access the Microsoft API?
Someone is Assuming something. (Score:2, Insightful)
If that were really the case then this would have already been implemented or in the works to be.
Better yet, why should Microsoft care?
Most people don't fix computer and just go out and buy a new one ever few years
Sounds like another Microsoft fee for a new computer to me.
Maybe I am just to cynical?
Use as safe-browsing services as you can ... (Score:1, Informative)
... because you can never send your complete browser history to enough 3rd parties :D
Re:Anonymous Coward (Score:4, Interesting)
Dear Microsoft, (Score:1)
Re: (Score:2)
I think they even might secretly sponsor Opera so that it appears as if there is a competition in the browser market.
Re: (Score:1)
Re: (Score:2)
Haha! :)
Dude, i have never heard more people argue in favor of Microsoft than when this browser install stupidity was announced.
Anyway, Microsoft also needs to prove that there is competition to their products in order not get rated a monopoly. So they will not buy Opera. That they are secretly funding Opera was a satirical exaggeration i allowed myself to make.
Re: (Score:1)
Re: (Score:2)
I think porting Office to anything should count as sabotage :)
Be careful though (Score:2)
I have a better idea... (Score:2)
Do a few things to really address the security problems inherent in the current designof IE, like eliminating ActiveX and fixing the helper function quoting issue, before worrying about blacklists.
Re: (Score:2)
ActiveX is just a binary plugin API, much like the Netscape plugin API used by all other browsers (this is how Flash and Java applets are supported).
The problem with ActiveX historically was that sites could install ActiveX controls too easily. This has been fixed for years now.
The problem with ActiveX today is when a website has an exploit for a pre-installed plug-in (allowing the site to change stuff on the system). This also happens with Flash and Java on Firefox/Opera/Safari/Konquror/random_other_browse
Re: (Score:2)
The problem with ActiveX historically was that sites could install ActiveX controls too easily. This has been fixed for years now.
And that you can still run ActiveX controls intended for the desktop or other insecure applications from the browser.
And that the "fix" is to have IE pop up a "This web site wants to install a virus on your computer, is that OK?" dialog. Which people automatically approve, because Windows throws them at you all the time.
The whole approach to security in the MS HTML control is fun
Make leaps of reason much? (Score:1)
tl;dr (Score:1)
tl;dr
However, I imagines it boils down to:
"Hey Microsoft, you should use your competitors blacklist in addition to your own!"
Key word there being competitors.
Hey, you know what, they should make the IE search box default to searching both Bing and Google! They should make Live Messenger support both MSN and Google Talk! They should make Microsoft Office include both Word and Google Docs!
Oh, even better, Mozilla should make Firefox render pages in both Gecko and Trident (at the same time, mind you)! Thund
Google List (Score:1)
Only one thing though: (Score:2)
If you're running Windows XP/Vista, many users install a full Internet security suite program. Don't these programs override the browser security settings and use the malware list from the security program itself, a list that is usually automatically updated on a regular basis anytime you're connected to the Internet?
I'm running Norton Internet Security 2009 on my Windows Vista machine at home and this program imposes its own malware monitoring list into Internet Explorer 7.0/8.0 and Firefox 3.0 and 3.5.
Politics? (Score:2)
"Arrogance" would have been my guess. I mean who knows better about how you should use your computer than Microsoft?
Re: (Score:3)
such a BS bash microsoft story. i could spend an hour trying to outline how contrived and flawed the whole article is but i dont have that hour to waste.
I didn't notice that. Granted, I only skimmed the huge summary, but I only saw two things:
1) IE has a better anti-malware feature than anyone else.
2) IE could do even better by combining their own anti-malware set with Google's.
Re: (Score:3, Insightful)
I know the conventional wisdom is MS == bad, and Google == good, but trying to find an MS-bashing angle to every bit of news is counterproductive and tire
Re: (Score:3, Insightful)
Shouldn't IE itself and microsoft.com be on any decent malware list?
I read this as Troll.
It contributes absolutely nothing useful to the discussion - but instead simply feeds on the modder's visceral hatred of everything Microsoft.
Re: (Score:2)
I agree. It got +4 Insightful from sheer hatred.
Re: (Score:1)