[HN Gopher] Google Safe Browsing incident
___________________________________________________________________
Google Safe Browsing incident
Author : ericselin
Score : 182 points
Date : 2025-10-10 13:27 UTC (9 hours ago)
(HTM) web link (www.statichost.eu)
(TXT) w3m dump (www.statichost.eu)
| duxup wrote:
| It feels like unless you're one of the big social media
| companies, accepting user content is slowly becoming a larger and
| larger risk.
| jacquesm wrote:
| It always was. You're one upload and a complaint to your
| ISP/Google/AWS/MS away from having your account terminated.
| blenderob wrote:
| But something has definitely changed over the past few years.
| Back in the days, it felt completely normal for individuals
| to spin up and run their own forums. Small communities built
| and maintained by regular people. How many _new_ truly
| independent, individual-run forums can you name today? Hardly
| any. Instead we keep hearing about long-time community sites
| shutting down because individuals can no longer handle the
| risks of user content. I 've seen so many posts right here on
| HN announcing those kinds of shutdowns.
| Imustaskforhelp wrote:
| I feel like yes forums are being closed because they have
| migrated to the likes of things like discord
|
| I have mixed opinions about discord and if I can be honest,
| I have mixed opinions about forums as well
|
| My opinion is to take things like forums and transfer them
| over to things like xmpp/(Irc?)/(signal?)/(matrix most
| prefered)
|
| There are bridges as well for matrix <-> Irc if this is
| something that interests you, there are bridges for
| everything but I prefer matrix with cinny and I generally
| think that due to its decentralized nature, it might be
| better than centralized forums maybe as well.
| morkalork wrote:
| Is it consolidation of services? Waaaaay back in the day,
| imageboards like 4chan were "one complaint away from being
| shut down" but 24-hours later they'd be up again on another
| rag-tag hosting provider. Nowadays it's like one complaint
| to cloudflare or AWS and the site is dead dead.
| pixl97 wrote:
| >How many new truly independent, individual-run forums can
| you name today?
|
| Almost none, but it's due to a lot of complicated factors
| and not just the direct risk of user content.
|
| Take moderation of content that won't get you banned by
| your ISP. It sucks. Nobody in their right mind would want
| to do it. There are countless bots and trolls that are
| going to flood your forums for whatever cause they
| champion.
|
| Then there is DDOS floods because you pissed off said bots
| and trolls. This can make the forums unaffordable _and_
| piss off your ISP.
|
| But even if nothing goes wrong, popularity is a risk in
| itself. In the past there was stuff like the Slashdot
| effect where your site would go down for a while. But now
| if your small site became popular on tiktok for some reason
| 20 million people could show up. Even if your site can
| stand up to that, how will you moderate it? How will you
| pay for the bandwidth?
|
| Oh, and will you get any advertisers because of said user
| content? How are you going to pay for the site?
|
| Oh, also you're competing with massive sites for eyeballs,
| how are you going to get actual users?
| wahnfrieden wrote:
| Any services successfully offloading UGC to other _moderated_
| platforms? E.g. developer tools relying on GitHub instead of
| storing source /assets in the service itself, and Microsoft
| can take care of most moderation needs. But are there
| consumer apps that do things like this?
| jacquesm wrote:
| I think imgur and disqus are good examples of that, there
| are probably quite a few.
| dylan604 wrote:
| Your equally just one fake report to an automated system away
| having your account shut down. So, yes, your actions have
| consequences, but more worrying to me is the ability of
| someone with a grudge causing consequences for you as well.
| jacquesm wrote:
| This is a direct consequence of centralization of services.
| We're doing this to ourselves.
| dylan604 wrote:
| You say "we" like it is the population of internet users.
| They have no choice in this other than to use whatever
| sites are available. It is the megaEvilCorps that are
| doing it to us. They start with a novel idea that is
| rewarded by lots of users. They then decide to weaponize
| their site against us to become money printing machines.
| They then use that money to buy up any competition which
| artificially limits the end user's choices. WE aren't
| doing shit to ourselves. Profit seeking megaEvilCorps are
| doing it to _us_.
|
| On top of the megaEvilCorps are evilScammyHackers that
| have made the internet a dangerous place. So
| entrepreneurial minded folks came up with some cool
| things to help protect users and site owners from these
| evilScammyHackers. Problem is, it takes scaled services
| to do it which again takes money which naturally limits
| those that are able to provide those services. This is
| again not _we_ doing anything to ourselves.
|
| If you mean we has a species, then sure, but that's a
| really stretched definition of _we_
| fukka42 wrote:
| Still not sure why it's legal for Google to slander companies
| like this. They often have no proof or it's a false positive,
| meanwhile they're screaming about how malicious you are.
| jacquesm wrote:
| Because Google has absolutely nothing to lose and you do,
| besides that they can outlast anybody except for nation states
| in court.
| fukka42 wrote:
| How does this answer the question of legality?
| jacquesm wrote:
| Questions of legality are answered by a judge, not by a
| forum
| ericselin wrote:
| Good question, it probably shouldn't be legal. Enforcing the
| law on these behemoths is another problem, though... :)
| acoustics wrote:
| Notably this post did not examine whether any of the sites it
| was hosting on this domain was malicious/misleading.
| fukka42 wrote:
| I'm not asking about this specific case. There are plenty of
| examples of Google wrongly accusing others of being malicious
| with massive business impact
| progbits wrote:
| Hosts phishing sites, gets blocked by anti phishing mechanism.
| Works as expected from my point of view.
|
| Get yourself on public suffix list or get better moderation. But
| of course just moaning about bad google is easier.
| ericselin wrote:
| You are right, of course. I'm not sure if those of you who
| disagree with me think that Safe Browsing did its job (which it
| did!), that Safe Browsing is a good thing (which it maybe is,
| but which I slightly disagree with), or that it's ok that
| Google monitors everything everyone does.
|
| The last point is actually the one I'm trying to make.
| shadowgovt wrote:
| There should be a concept, sort of an inverse of tragedy of
| the commons, for the positive feedback loop of many users
| providing big data to a company that can use that data to
| benefit many users.
|
| From spamblocking that builds heuristics fed by the spam
| people manually flag in GMail to Safe Browsing using attacks
| on users' Chrome as a signal to their voice recognition
| engine leapfrogging the industry standard a few years back
| because they trained it on the low-quality signal from
| GOOG411 calls, Google keeps building product by harvesting
| user data... And users keep signing up because the resulting
| product is good.
|
| This puts a lot of power in their hands but I don't think
| it's default bad... If it becomes bad, users leave and Google
| starts to lose their quality signal, so they're heavily
| incentivized to provide features users want to retain them.
|
| This does make it hard to compete with them. In the US at
| least, antitrust competition has generally been about user
| harm, not actually market harm. If a company has de-facto
| control but customers aren't getting screwed, that's fine
| because ultimately the customer matters (and nobody else is
| owed a shot at beeing a Google).
| mkishi wrote:
| It's hard to get that point because you're conflating two
| different stories.
|
| Folks around here are generally uneasy about tracking in
| general too, but remove big brother monitoring from Safe
| Browsing and this story could still be the same: whole domain
| blacklisted by Google, only due to manual reporting instead.
|
| "Oh, but a human reviewer would've known `*.statichost.eu`
| isn't managed by us"--not in a lot of cases, not really.
| ericselin wrote:
| Sure, and sorry for being so unclear. The point of my post
| was meant to be a) Google has this enormous cannon, is this
| "right"? And b) they will use it to kill anything bigger
| than a mosquito.
|
| But you're right, complaining about big tech surveillance
| didn't help with making that point at all.
| freehorse wrote:
| You are right, but then again, nobody flags facebook because of
| the scamming taking place in some facebook pages.
| tartarus4o wrote:
| "Might makes right" as they say.
|
| There is no real way a normal person even can flag facebook.
| shadowgovt wrote:
| Generally because Facebook polices Facebook (imperfectly, but
| the effort is demonstrated) and the damage radius is limited
| to Facebook users mostly. As long as the easiest way to avoid
| damage from the Facebook domain is "Don't use Facebook," the
| larger Internet doesn't need a mechanism to police it.
|
| If Facebook became a trap that frequently hosted malware to
| strangers, the rest of the net would begin to interpret it as
| damage and route around it.
| gkbrk wrote:
| If youtube.com doesn't end up on the Safe Browsing blacklist
| because of phishing videos, but your own website can easily end
| up there, it's a pretty clear case of Google abusing their
| power.
| AlienRobot wrote:
| What is a phishing video?
| jeroenhd wrote:
| YouTube hosts millions of videos telling people that they
| are the government/your bank and that you should move
| money/contact a scam center/buy cryptocurrency. Even worse
| is the fact you can pay to turn these videos into ads that
| will roll in front of other videos.
|
| On the whole of YouTube, it's a tiny sliver of a
| percentage, but because YouTube has grown too large to
| moderate, it's still hosting these videos.
|
| If Google applied the same rules they apply to the safe
| browsing list, they'd probably get YouTube flagged multiple
| times a week.
| jeroenhd wrote:
| YouTube doesn't allow you to put your credentials into text
| box and hit send. Google sites, on the other hand, does pose
| a disk, but they'll likely be treated the same as any other
| domain on the PSL.
|
| In my experience, safe browsing does theoretically allow you
| to report scams and phishing in terms of user generated
| content, but it won't apply unless there's an actual
| interactive web page on the other end of the link.
|
| There is the occasional false positive but many good sites
| that end up on that list are there because their WordPress
| plugin got hacked and somewhere on their site they are
| actually hosting malware.
|
| I've contacted the owners of hacked websites hosting phishing
| and malware content several times, and most of the time I've
| been accused of being the actual hacker or I've been told
| that I'm lying. I've given up trying to be the good guy and
| report the websites to Google and Microsoft these days to
| protect the innocent.
|
| Google's lack of transparency what exact URLs are hosting bad
| material does play a role there.
| NitpickLawyer wrote:
| The PSA is good, the article is meh. There is too much
| misdirected anger towards google here, IMO. I agree it sucks to
| be the false positive, but it'd also suck more to unknowingly be
| part of phishing campaigns and not know.
|
| On top of that, it is also recommended to serve user content from
| another domain for security reasons. It's much easier to avoid
| entire classes of exploits this way. For the site admins: treat
| it as a learning experience instead of lashing out on goog. In
| the long run you'll be better off, having learned a good lesson.
| bluesmoon wrote:
| Exactly! For a web dev in 2025 to still not know security best
| practices that have been around for 20+ years is a failure on
| the part of the dev.
| hk__2 wrote:
| I'm sure I don't know ALL the "security best practices that
| have been around for 20+ years" and this is perfectly fine as
| long as I'm able to react quickly. See also
| https://xkcd.com/1053/.
| blenderob wrote:
| It's fine if you personally didn't know that. But if I'm
| paying for a service, I expect the provider to understand
| basic security best practices that have been industry
| standard for 20+ years. And if they don't, they should be
| hiring people who do.
|
| XKCD 1053 is not a valid excuse for what amounts to
| negligence in a production service.
| ericselin wrote:
| Author here. What kind of security negligence are you
| referring to? What would be a specific attack vector that
| I left open?
|
| Regarding the PSL - and I can't believe I'm writing this
| again: you cannot get on there before your service is big
| enough and "the request authentically merits such
| widespread inclusion"[1]. So it's kind of a chicken and
| egg situation.
|
| Regarding the best practice of hosting user content on a
| separate domain: this has basically two implications: 1.
| Cookie scope of my own assets (e.g. dashboard), which one
| should limit in any case and which I'm of course doing.
| So this is not an issue. 2. Blacklisting, which is what
| all of this has been about. I did pay the price here.
| This has nothing to do with security, though.
|
| I'm sorry to be so frank, but you don't know anything
| about me or my security practices and your claim of
| negligence is extremely unfounded.
|
| [1] https://github.com/publicsuffix/list/wiki/Guidelines#
| validat...
| bluesmoon wrote:
| Github discovered the same thing a long long time ago which is
| why you now have the github.io domain.
| Macha wrote:
| In Github's case, I think it was also because a lot of security
| boundaries were using TLD which led x.github.com potentially
| grab cookies of y.github.com or worse, github.com itslef
|
| https://news.ycombinator.com/item?id=5500612
| neon_erosion wrote:
| Don't forget the `githubusercontent.com` domain, which is
| specifically used to host risky, user-generated content, and
| fully documented in
| https://docs.github.com/en/authentication/keeping-your-accou...
| (using an open source component that other companies could also
| use, if they were interested in similar levels of security)
| kbolino wrote:
| Putting user content on another domain and adding that domain to
| the public suffix list is good advice.
|
| So good, in fact, that it should have been known to an
| infrastructure provider in the first place. There's a lot of
| vitriol here that is ultimately misplaced away from the author's
| own ignorance.
| ericselin wrote:
| This is of course true! It just takes an incident like this to
| get ones head out of ones ass and actually do it. :)
| hiatus wrote:
| One can only imagine the other beginner mistakes made by this
| operator.
| shadowgovt wrote:
| Everyone learns somehow.
| kbolino wrote:
| Well, you're responding to him, so questions or suggestions
| are probably better than speculation.
|
| My comment about vitriol was more directed at the HN
| commenters than Eric himself. Really, I think a discussion
| about web infrastructure is more interesting than a
| hatefest on Google. Thankfully, the balance seems to have
| shifted since I posted my top-level comment.
| hiatus wrote:
| > Well, you're responding to him, so questions or
| suggestions are probably better than speculation.
|
| I suspect the author is unaware of their other
| blindspots. It's not 2001 anymore. Holding yourself out
| as a hosting provider comes with some baseline
| expectations.
| lcnPylGDnU4H9OF wrote:
| > baseline expectations
|
| Do you have more details? That sounds interesting.
| kbolino wrote:
| The good news is, once known, a lesson like this is hard to
| forget.
|
| The PSL is one of those load-bearing pieces of web
| infrastructure that is esoteric and thanklessly maintained.
| Maybe there ought to be a better way, both in the sense of a
| direct alternative (like DNS), and in the sense of a better
| security model.
| chrismorgan wrote:
| There's some value in the public suffix list being shared,
| with mild sanity checking before accepting entries: it
| maintains a distinction between _site_ (which includes all
| subdomains) and _origin_ (which doesn't). Safe Browsing
| wants to block _sites_ , but if you can designate your
| domain a public suffix without oversight, you can bypass
| that so that it will only manage to block your subdomains
| individually (until they adjust their heuristics to
| something much more complicated and less reliable than what
| we have now).
| neon_erosion wrote:
| This is the kind of thing that customers rely on you to do
| _before_ it causes an incident.
| ericselin wrote:
| The thing is, for users, having a separate domain wouldn't
| have made any difference without the PSL. And you cannot
| get on there before you're big enough - which I'd say is
| roughly at the same time as you start grabbing the
| attention of scammers.
| neon_erosion wrote:
| Exactly, this has been documented knowledge for many years now,
| even decades. Github and other large providers of user-
| generated content have public-facing documentation on the risks
| and ways to mitigate them. Any hosting provider that chooses to
| ignore those practices is putting themselves, and their
| customers, at risk.
| dawnerd wrote:
| To be fair I've been in the space for close to 20 years now,
| worked on some of the largest sites and this is the first I'm
| hearing of the public suffix list.
| j45 wrote:
| Maybe it was effective from obscurity?
| lcnPylGDnU4H9OF wrote:
| > There's a lot of vitriol here that is ultimately misplaced
| away from the author's own ignorance.
|
| For what it's worth, this makes it sound like you think the
| vitriol should be aimed at the author's ignorance rather than
| the circumstances which led to it, presuming you meant the
| latter.
| kbolino wrote:
| I do think the author's ignorance was a bigger problem--both
| in the sense of he should have known better and _also_ in the
| sense that the PSL needs to be more discoverable--than
| anything Google( 's automated systems) did.
|
| However, I'm now reflecting on what I said as "be careful
| what you wish for", because the comments on this HN post have
| done a complete 180 since I wrote it, to the point of turning
| into a pile-on in the opposite direction.
| lcnPylGDnU4H9OF wrote:
| > also in the sense that the PSL needs to be more
| discoverable
|
| Well, this is a problem that caused the author's ignorance
| but you present it as though it's the other way around.
| That's primarily what I meant. Not really disagreeing with
| "should have known better", mostly in the sense that user-
| generated content is a huge yellow flag.
| yafinder wrote:
| For something that you think is a de-facto standard, public
| suffix list seems kinda raw to me for now.
|
| I checked it for two popular public suffixes that came to mind:
| 'livejournal.com' and 'substack.com'. Both weren't there.
|
| Maybe I'm mistaken, it's not a bug and these suffixes shouldn't
| be included, but I can't think of the reason why.
| jeroenhd wrote:
| I don't know about LiveJournal, but I don't believe you can
| host any interactive content on substack (without hacking
| substack at least). You can't sign up and host a phishing
| site, for instance.
|
| User-uploaded content (which does pose a risk) is all hosted
| on substackcdn.com.
|
| The PSL is more for "anyone can host anything in a subdomain
| of any domain on this list" rather than "this domain contains
| user-generated content". If you're allowing people to host
| raw HTML and JS then the PSL is the right place to go, but if
| you're just offering a user post/comment section feature,
| you're probably better off getting an early alert if someone
| has managed to breach your security and hacked your system
| into hosting phishing.
| asddubs wrote:
| The public suffix list interferes with cookies. So on a
| service like livejournal, where you want users logged in
| across all subdomains, it's not an option
| jeroenhd wrote:
| The PSL is something you find out about after it goes wrong.
|
| It's a weird thing, to be honest, a Github repo mentioned
| nowhere in any standards that browsers use to treat some
| subdomains differently.
|
| Information like this doesn't just manifest itself into your
| brain once you start hosting stuff, and if I hadn't known about
| its existence I wouldn't have thought to look for a project
| like this either. I certainly wouldn't have expected it to be
| both open for everyone and built into every modern internet-
| capable computer or anti malware service.
| 10000truths wrote:
| To be pedantic, the GitHub repo is not the source of truth,
| this is:
|
| https://publicsuffix.org/list/public_suffix_list.dat
|
| It even says so in the file itself. If Microsoft goes up in
| flames, they can switch to another repository provider
| without affecting the SoT.
| sarathyweb wrote:
| Does anyone know if adding our domains to Public Suffix List will
| prevent incidents like this?
| SquareWheel wrote:
| It's generally good advice, but I don't see that Safe Browsing
| did anything wrong in this case. First, it sounds like they
| actually were briefly hosting phishing sites:
|
| > All sites on statichost.eu get a SITE-NAME.statichost.eu
| domain, and during the weekend there was an influx of phishing
| sites.
|
| Second, they should be using the public suffix list
| (https://publicsuffix.org/) to avoid having their entire domain
| tagged. How else is Google supposed to know that subdomains
| belong to different users? That's what the PSL is for.
|
| From my reading, Safe Browsing did its job correctly in this
| case, and they restored the site quickly once the threat was
| removed.
| ericselin wrote:
| I'm not saying that Google or Safe Browsing in particular did
| anything wrong per se. My point is primarily that Google has
| too much power over the internet. I know that in this case what
| actually happened is because of me not putting enough effort
| into fending off bad guys.
|
| The new separate domain is pending inclusion in the PSL, yes.
|
| Edit: the "effort" I'm talking about above refers to more real
| time moderation of content.
| dormento wrote:
| Exactly.
|
| > Second, they should be using the public suffix list
| (https://publicsuffix.org/) to avoid having their entire
| domain tagged.
|
| NO, Google should be "mindful" (I know companies are not
| people but w/e) of the power it unfortunately has. Also,
| Cloudflare. All my homies hate Cloudflare.
| shadowgovt wrote:
| It is mindful.
|
| ... by using the agreed-upon tool to track domains that
| treat themselves as TLDs for third-party content: the
| public suffix list. Microsoft Edge and Firefox also use the
| PSL and their mechanisms for protecting users would be
| similarly suspicious that attacks originating from
| statichost.eu were originating from the owners of that
| domain and not some third-party that happened to
| independently control foo.statichost.eu.
| sokoloff wrote:
| > My point is primarily that Google has too much power over
| the internet.
|
| That is probably true, but in this case I think most people
| would think that they used that power for good.
|
| It was _inconvenient_ for you and the legitimate parts of
| what was hosted on your domain, but it was blocking genuinely
| phishing content that was _also_ hosted on your domain.
| fragmede wrote:
| Every website operator employee worth their salary in this
| area would have told the site's operator this beforehand,
| and could have avoided this incident. Hell, even ChatGPT
| could tell you that by now. The word that comes to mind is
| incompetence on someone's part, but I don't know of the
| details on particularly who was the incompetent one in this
| situation. Thankfully, they've learned a lesson about the
| situation and ideally won't make the same mistake again
| going forwards.
| shadowgovt wrote:
| There are two aspects to the Internet: the technical and the
| social.
|
| In the social, there is _always_ someone with most of the
| power (distributed power is an unstable equilibrium), and it
| 's incumbent upon us, the web developers, to know the current
| status quo.
|
| Back in the day, if you weren't testing on IE6 you weren't
| serving a critical mass of your potential users. Nowadays,
| the nameplates have changed but the same principles hold.
| j45 wrote:
| Social wasn't always sole powered, only began with the
| later social networks, not the early. And now people are
| retreating to smaller communities anyways.
|
| Testing on IE6 wasn't the requirement, all browser's was.
| IE shipped default on windows and basically forced
| themselves into the browser conversation with an incomplete
| browser.
| shadowgovt wrote:
| I don't mean social as in social network. I mean that
| people have always been a key aspect of the technology
| and how it it practically works.
|
| Yes, yes, IE6 shipped by default shipped by default on
| Windows. And therefore if you wanted a website that
| worked, you tested against IE6. Otherwise people would
| try and use your website and it wouldn't work and they
| wouldn't blame the browser, they would blame your
| website.
|
| Those social aspects introduce a bunch of not necessarily
| written rules that you just have to know and learn as you
| develop for the web.
| stickfigure wrote:
| "Google does good thing, therefore Google has too much power
| over the internet" is not a convincing point to make.
|
| This safety feature saves a nontrivial number of people from
| life-changing mistakes. Yes we publishers have to take extra
| care. Hard to see a negative here.
| ericselin wrote:
| I respectfully disagree with your premise. In this specific
| case, yes, "Google does good thing" in a sense. That is not
| why I'm saying Google has too much power. "Too much" is
| relative and whether they do good or bad debatable, of
| course, but it's hard to argue that they don't have a
| gigantic influence on the whole internet, no? :)
|
| Helping people avoid potentially devastating mistakes is of
| course a good thing.
| thetimman8 wrote:
| You're not wrong. You just picked a poor example which
| illustrates the opposite of the point you're making.
| ericselin wrote:
| Fair enough! :)
| neon_erosion wrote:
| What point are you trying to make here? You hosted
| phishing sites on your primary domain, which was then
| flagged as unsafe. You chose not to use the tools that
| would have marked those sites as belonging to individual
| users, and the system worked as designed.
| ericselin wrote:
| Please note that this tool (PSL) is not available until
| you have a significant user base. Which probably means a
| significant amount of spam as well.
| zamadatix wrote:
| Where'd you see/hear that? It hasn't been my experience
| at least - but maybe I've just been lucky or
| undercounting the sites.
|
| There are required steps to follow but none are "have x
| users" or "see a lot of spam". It's mostly "follow proper
| DNS steps and guidelines in the given format" with a
| little "show you're doing this for the intended reason
| rather than to circumvent something the PSL is not meant
| for/for something the public can't get to anyways" (e.g.
| tricking rate limits, internal only or single user
| personal sites) added on top.
| ericselin wrote:
| https://github.com/publicsuffix/list/wiki/Guidelines#vali
| dat...
|
| "Projects that are smaller in scale or are temporary or
| seasonal in nature will likely be declined. Examples of
| this might be private-use, sandbox, test, lab, beta, or
| other exploratory nature changes or requests. It should
| be expected that despite whatever site or service
| referred a requestor to seek addition of their domain(s)
| to the list, projects not serving more then thousands of
| users are quite likely to be declined."
|
| Maybe the rules have changed, or maybe you were lucky? :)
| jlarocco wrote:
| Is it? Companies like Google coddle users instead of
| teaching them how to browse smarter and detect phishing for
| themselves. Google wants people to stay ignorant so _they_
| can squeeze them for money instead of phishers.
| fragmede wrote:
| How does Google get money out of people in that case? As
| a corporation, Google contributes greatly to the
| education sector and also profits greatly, so it seems
| like they're pro-education to me, and are merely making
| the best of a bad situation, but I'd love to hear how
| Google extracts money from the people they've protected
| from phishing schemes in some secret way that I haven't
| considered. I do happen to have Google stock in my
| portfolio though, so maybe that indight's my entire
| comment for you though.
| judge2020 wrote:
| This is a fine mentality when it takes a certain amount
| of "Internet street smarts" (a term used in the article)
| to access the internet - at least beyond AOL etc.
|
| But over half of the world has internet access, mostly
| via Chrome (largely via Android inclusion). At least some
| frontline protection (that can be turned off) is
| warranted when you need to cater to at least the millions
| of people who just started accessing the internet today,
| and the billions who don't/can't/won't put the effort in
| to learn those "Internet street smarts".
| neon_erosion wrote:
| How does flagging a domain that was actively hosting phishing
| sites demonstrate that Google has too much power? They do,
| but this is a terrible example, undermining any point you are
| trying to make.
| jeroenhd wrote:
| The thing about Google is that they regularly get this
| stuff wrong, and there is no recourse when they do.
|
| I think most people working in tech know the extent to
| which Google can screw over a business when they make a
| mistake, but the gravity of the situation becomes much
| clearer when it actually happens to you.
|
| This time it's a phishing website, but what if the same
| happens five years down the line because of an unflattering
| page about a megalomaniac US politician?
| neon_erosion wrote:
| Then that would be an example of a system having failed
| and one that needs to change. Instead, this is an example
| of a hosting company complaining about the consequences
| of skipping some of the basic, well-documented safety and
| security practices that help to isolate domains for all
| sorts of reasons, from reputation to little things like
| user cookies.
| gcr wrote:
| This article shows an example of this process working as
| intended though.
|
| The user's site was hosting phishing material. Google
| showed the site owner what was wrong, provided concrete
| steps to remedy the situation, and removed the warning
| within a few hours of being notified that it was
| resolved.
|
| Google's support sucks in other ways, but this particular
| example went very smoothly.
| j45 wrote:
| Maybe google can have large impact is a more accurate way
| of putting it vs power.
| rasengan wrote:
| Getting on the public suffix list is easier said than done [1].
| They can simply say no if they feel like it and are making sure
| to be able to keep said rights as a "project" vs a "business,"
| [2] which has its pros and cons.
|
| [1]
| https://github.com/publicsuffix/list/blob/main/public_suffix...
|
| [2] https://groups.google.com/g/publicsuffix-
| discuss/c/xJZHBlyqq...
| kyledrake wrote:
| Google has some sort of internal flag for determining origin is
| different on some platforms. We don't get a complete takedown of
| Neocities every time there's a spam site reported. It is likely
| that they were not on that list but perhaps have been manually
| added to whatever that internal list is at this point.
|
| The public suffix list (https://publicsuffix.org/) is good and if
| I were to start from scratch I would do it that way (with a
| different root domain) but it's not absolutely required, the
| search engines can and do make exceptions that don't just
| exclusively use the PSL, but you'll hit a few bumps in the road
| before that gets established.
|
| Ultimately Google needs to have a search engine that isn't full
| of crap, so moving user content to a root domain on the PSL that
| is infested with phishing attacks isn't going to save you. You
| need to do prolific and active moderation to root out this
| activity or you'll just be right back on their shit list. Google
| could certainly improve this process by providing better tooling
| (a safe browsing report/response API would be extremely helpful)
| but ultimately the burdon is on platforms to weed out malicious
| activity and prevent it from happening, and it's a 24/7 job.
|
| BTW the PSL is a great example of the XKCD "one critical person
| doing thankless unpaid work" comic, unless that has changed in
| recent years. I am a strong advocate of having the PSL management
| become an annual fee driven structure
| (https://groups.google.com/g/publicsuffix-
| discuss/c/xJZHBlyqq...), the maintainer deserves compensation for
| his work and requiring the fee will allow the many abandoned
| domains on the list to drop off of it.
| IX-103 wrote:
| If you're not using separate domains then I hope you don't have
| any kind of sensitive information stored in cookies. You can't
| rely on the path restrictions for cookies because it's easily
| bypassed.
| kyledrake wrote:
| You can set cookies that strictly stay on the root domain and
| don't cross to subdomain origins, and vise versa
| (https://developer.mozilla.org/en-
| US/docs/Web/HTTP/Guides/Coo...). We've been doing this for 12
| years without issue.
|
| Strict cookies crossing root to subdomains would be a major
| security bug in browsers. It's always been a (valid)
| theoretical concern but it's never happened on a large scale
| to the point I've had to address it. There is likely
| regression testing on all the major browsers that will catch
| a situation where this happens.
| veeti wrote:
| It can happen to anyone and cause a reputational risk. Once upon
| a time $workplace had a Zoho Form that would be blacklisted by
| Google Safe Browsing or Microsoft Edge for arbitrary periods of
| time, presumably because someone used Zoho to make a phishing
| site, leading to some very confused calls.
| freehorse wrote:
| Sounds a very convenient mistake to do on your competitors? It
| does not sound believable that they would not know what zoho
| was or that it makes no sense to flag all the zoho domain.
| haktan wrote:
| If user1.statichost.page gets blacklisted now will it affect
| user2.statichost.page as well?
| kijin wrote:
| Yes, unless they submit statichost.page to the public suffix
| list.
| kijin wrote:
| It's also good from a security perspective.
|
| Anyone who can upload HTML pages to subdomain.domain.com can read
| and write cookies for *.domain.com, unless you declare yourself a
| public suffix and enough time has passed for all the major
| browsers to have updated themselves.
|
| I've seen web hosts in the wild who could have their control
| panel sessions trivially stolen by any customer site. Reported
| the problem to two different companies. One responded fairly
| quickly, but the other one took several years to take any action.
| They eventually moved customers to a separate domain, so the
| control panel is now safe. But customers can still execute
| session fixation attacks against one another.
| ericselin wrote:
| (Author here) This is all true. The main assumption from my
| part is that anything remotely important or even sensitive
| should be and is hosted on a domain that is _not_
| companysubdomain.domain.com but instead www.company.com.
| freehorse wrote:
| I don't see how a separate domain would solve the main issue
| here. If something on that separate domain was flagged, it would
| still affect all user content on that domain. If your business is
| about serving such user content, the main service of your
| business would be down, even though your main domain would still
| be up.
| ericselin wrote:
| You are right, it would still affect all users. Until the
| pending PSL inclusion is complete, that is. But it now
| separates my own resources, such as the website and dashboard
| of statichost.eu from that.
| toast0 wrote:
| A separate domain may not prevent users' conten from being
| blocked, but it may prevent blocking of the administrative
| interfaces. Which would help affected customers get their
| content and the service could more easily put a banner advising
| users of the situation, etc.
| thehyperflux wrote:
| Google services simply behaved the way I would expect them to
| here. Who knows... they may even have saved some users from
| coming to harm.
| ericselin wrote:
| That is a great point. When I see these sites I'm always seeing
| a dozen red flags, and maybe the biggest one is that it's
| showing a "NatWest" banking site or something and is hosted on
| "portal-abc.statichost.eu". But the whole point is of course
| saving users from coming to harm, and if it did - great!
| liquid_thyme wrote:
| Many phishing attacks originate from Google's owns domains.
| Gmail users phishing others, scammy youtube videos, scammy
| comments with links to scams, scammy ads to fake banking pages,
| etc, etc. But Google would never be hypocritical, never!!
| johnwheeler wrote:
| Seems like a reasonable trade-off I mean six hours is not the
| worst thing in the world. What if you were hosting mission-
| critical such as such? Were you?
| oefrha wrote:
| Honestly, this is extremely basic stuff in hosting, not only due
| to safe browsing, but also--and more importantly--cookie safety,
| etc. If a hosting provider didn't know (already bad enough) and
| turn to whining after being hit, then
|
| > Static site hosting you can trust
|
| is more like amateur hour static site hosting you can't trust.
| Sorry.
| ericselin wrote:
| The thing is, you cannot just add any domain to the PSL. You
| need a significant amount of users before they will include
| your domain. Before recently, there really was no point in even
| submitting, since the domain would have been rejected as too
| small. An increase in user base, increase in malicious content
| and the ability to add your domain to the PSL all happen sort
| of simultaneously.
|
| I'm also trusting my users to not expose their cookies for the
| whole *.statichost.eu domain. And all "production" sites use a
| custom domain anyway, which avoids all of this anyway.
| neon_erosion wrote:
| There are well-documented solutions to this that don't rely
| on the PSL. Choosing to ignore all of that advice while
| hosting user content is a very irresponsible choice, at best.
| ericselin wrote:
| So the problem here is that Alice on alice.statichost.page
| might set a cookie for the `.statichost.page` domain if
| she's careless (which is sometimes the case with Alice).
| This cookie can then be read by Mallory on
| mallory.statichost.eu. Or the other way around, if Mallory
| wants to try to trick Alice into reading his cookie. How
| this can be prevented without the PSL is something I'm very
| interested to hear more about.
| shadowgovt wrote:
| Not sure who changed the HN headline, but I appreciate the
| change. Especially since the concept in the headline is buried at
| the bottom of the post.
|
| Post author is throwing a lot of sand at Google for a process
| that has (a) been around for, what, over a decade now and (b)
| _works._ The fact of the matter is this hosting provider was too
| open, several users of the provider _used it to put up content
| intended to attack users,_ and as far as Google (or anyone else
| on the web is concerned) the TLD is where the buck stops for that
| kind of behavior. This is one of the reasons _why_ you host user-
| generated content off your TLD, and several providers have gotten
| the memo; it is unfortunate statichost.eu had not yet.
|
| I'm sorry this domain admin had to learn an industry lesson the
| hard way, but at least they won't forget it.
| ericselin wrote:
| Author here. I understand that my post and what I'm trying to
| say is unclear. And that there are too many different aspects
| to all this.
|
| What I'm trying to say in the post specifically about Google is
| that I personally think that they have too much power. They can
| and will shut down a whole domain for four billion users. That
| is too much power no matter the intentions, in my opinion. I
| can agree that the intentions are good and that the net effect
| is positive on the whole, though.
|
| On the "different aspects" side of things, I'm not sure I agree
| with the _works_ claim you make. I guess it depends on what
| your definition of works is, but having a blacklist as you tool
| to fight bad guys is not something that works very well in my
| opinion. Yes, specifically my own assets would not have been
| impacted, had I used a separate domain earlier. But the point
| still stands.
|
| The fact that it took so long to move user content off the main
| domain is of course on me. I'm taking some heat here for saying
| this is more important than one (including me) might think. But
| nonetheless, let it be a lesson for those of you out there who
| think that moving that forum / upload functionality / wiki /
| CMS to its own domain (not subdomain) can be done tomorrow
| instead of today.
| gwbas1c wrote:
| > To be fair, many or even most sites on the Google Safe Browsing
| blacklist are probably unworthy. But I'm pretty sure this was not
| the first false positive.
|
| The bigger issue is that the internet needs _governance_. And, in
| the absence of regulation, someone has stepped in and done it in
| a way that the author didn 't like.
|
| Perhaps we could start by requiring that Google provide ways to
| contact a living, breathing human. (Not an AI bot that they claim
| is equivalent.)
| dylan604 wrote:
| why do you assume that the living, breathing human hired by
| theGoogs will be competent at handling all of the crazy that
| will be flung at them by the living, breathing human on the
| other end of the line. One single person cannot handle that.
| Naturally, you need a team of living, breathing humans. You
| might even have them in triage level groups like level 1
| support, level 2 support and so on where each level is a more
| trained/experienced living, breathing human. Eventually, you'll
| have an entire department of people of varying degrees of
| skill. Oh, wait, I'm sorry, I thought it was the year 2000.
|
| Hopefully, this helps you understand why your living, breathing
| human is such a farcical idea for theGoogs to consider.
| gwbas1c wrote:
| Well, Google did self-appoint itself the "internet police,"
| and the general job of the police is to deal with screwballs.
|
| So you can't take one part of the responsibility and abdicate
| the other part!
| dylan604 wrote:
| Playing devil's advocate, who else was going to step into
| that role? Who would have the clout to be trusted? The
| Googs would want to do something just as a self protecting
| action that evolved into a self aggrandizing sense of
| empowerment that they might not be the protector we need
| but the one we deserved
| liquid_thyme wrote:
| You really think talking to a human and a bot is the same?
| dylan604 wrote:
| I don't even know what you're asking, or how that's the
| question you ask from my comment. Clearly, no, I don't
| think a human and a bot are the same. I'm saying that
| evilCorp is not going to pay for a human support staff in
| the year 2025 when the company is pushing it's AI/LLM
| chatbot as a major part of who they are. If the chatbot
| company doesn't use its own chatbot, why would anyone else?
| Of course they are not going to pay for humans.
|
| How does any of that lead to your asking if I think humans
| === bots?
| liquid_thyme wrote:
| That may be, and we certainly don't need anyone
| explaining Google's position - we already know what that
| is. Nobody here actually cares what Google wants, we're
| expressing what _we_ want. Nerds have helped Google
| enough with free marketing and goodwill, Google 's
| reputation being tarnished can only help us not hurt us.
| dynm wrote:
| This is a bit of a tangent, the whole concept of "domain
| reputation" can be infuriating. For example, my blog has been
| marked as suspicious by spamhaus.org:
| https://check.spamhaus.org/results?query=dynomight.net
|
| As a result, some ISPs apparently block the domain. Why is it
| listed? I have no idea. There are no ads, there is no user
| content, and I've never sent _any_ email from the domain. I 've
| tried contacting spamhaus, but they instantly closed the ticket
| with a nonsensical response to "contact my IT department" and
| then blocked further communication. (Oddly enough, my personal
| blog does not have an IT department.)
|
| Just like it's slowly become quasi-impossible for an individual
| to host their own email, I fear the same may happen with
| independent websites.
| MoreQARespect wrote:
| From reading that my guess would be that the IP of your host
| gotten from your hosting provider had some spammy history
| before you started hosting your blog on it.
|
| Either that or your DNS provider hosts a lot of spam.
| dynm wrote:
| Hmmm, I use https://njal.la/ for DNS. Could spamhaus really
| just auto-mark every njalla user as suspicious?
| MoreQARespect wrote:
| Yeah, possibly. Privacy related services are often used by
| spammers.
| jeroenhd wrote:
| > As a result, some ISPs apparently block the domain
|
| This is the infuriating part. I get that someone buying cheap
| hosting may end up with an IP address that used to send spam,
| but spam lists are not reliable indicators of website security.
|
| Overzealous security products are a blight on the internet. I'd
| be less annoyed at them if they weren't so trivial to bypass as
| a hacker with access to a stolen credit card.
| Retr0id wrote:
| I don't like nor trust google, but "Use your own judgement and
| hard-earned Internet street smarts" doesn't work either, because
| the median internet user does not have anything resembling
| internet street smarts.
| ArnoVW wrote:
| As a CISO I am happy with many of the protections that Google
| creates. They are in a unique position, and probably the only
| ones to be able to do it.
|
| However, I think the issue is that with great power comes great
| responsibility.
|
| They are better than most organisations, and working with many
| constraints that we cannot always imagine.
|
| But several times a week we get a false "this mail is phishing"
| incident, where a mail from a customer or prospect is put in
| "Spam", with a red security banner saying it contains "dangerous
| links". Generally it is caused by domain reputation issues, that
| block all mail that uses an e-mail scanning product. These
| products wrap URLs so they can scan when the mail is read, and
| thus when they do not detect a virus, they become defacto
| purveyors of virii, and their entire domain is tagged as
| dangerous.
|
| I have raised this to Google in May (!) and have been exchanging
| mail on a nearly daily basis. Pointing out a new security product
| that has been blacklisted, explaining the situation to a new
| agent, etc.
|
| Not only does this mean that they are training our staff that
| security warnings are generally false, but it means we are
| missing important mail from prospects and customers. Our
| customers are generally huge corporations, missing a mail for us
| is not like missing one mail for a B2C outfit.
|
| So far the issue is not resolved (we are in Oct now!) and
| recently they have stopped responding. I appreciate our
| organisation is not the US Government, but still, we pay upwards
| of 20K$ / year for "Google Workspace Enterprise" accounts. I
| guess I was expecting something more.
|
| If someone within Google reads this: you need to fix this.
| seethishat wrote:
| I'm old. I've been doing security for a very long time. Started
| back in the 1990s. Here's what I have learned over the last 30
| years...
|
| Half (or more) of security alerts/warnings are false positives.
| Whether it's the vulnerability scanner complaining about some
| non-existent issues (based on the version of Apache alone...
| which was back ported by the package maintaner), or an AI
| report generated by interns at Deloitte fresh out of college,
| or someone reporting www.example.com to Google Safe Browsing as
| malicious, etc. At least half of the things they report on are
| wrong.
|
| You sort of have to have a clue (technically) and know what you
| are doing to weed through all the bullshit. Tools that block
| access, based on these things do more harm than good.
| sire-vc wrote:
| I am a solo developer. I recently created a new web app for a
| client. Google has marked as phishing so they can't use it.
| Obviously I can't do anything about it except report error and
| wait. I'm worried if I move it to a new domain that one will get
| marked as well. Not sure what to do TBH.
| procaryote wrote:
| Is it phishing?
| sire-vc wrote:
| No, however it does include a Microsoft entra/Azure
| AD/Microsoft 365 login for that clients tenant. It is also a
| newly registered domain so I can understand why it looks
| suspicious. The most frustrating thing is that this is all a
| machine I.e. no-one I can speak to, nothing I can do to fix
| it. My fate has been decided by an algorithm.
| seanw265 wrote:
| I've got a random subdomain hosting a little internal tool. About
| twice a year, Google Safe Browsing decides it's phishing and
| flags it. Sometimes they flag the whole domain for good measure.
|
| Search Console always points to my internal login page, which
| isn't public and definitely isn't phishing.
|
| They clear it quickly when I appeal, and since it's just for me,
| I've mostly stopped worrying about it.
| watermelon0 wrote:
| I encountered something similar. I have `*.domain.tld` pointed
| to an internal IP address, and over the past few years it
| happened a few times where some subdomain would be flagged as
| dangerous by Google Safe Browsing.
| jeroenhd wrote:
| Internal IP addresses in public DNS are sometimes used to do
| things like DNS rebind attacks. It's possible that's tripping
| up their detection mechanism.
|
| My workaround is to use an IPv6 ULA for my publicly hosted
| private IP addresses, which is extremely unlikely to ever be
| reused by a bad actor.
| ericselin wrote:
| Since there's a lot of discussion about the Public Suffix list,
| let me point out that it's not just a webform where you can add
| any domain. There's a whole approval process where one very
| important criterion is that the domain to be added has a large
| enough user base. When you have a large enough user base, you
| generally have scammers as well. That's what happened here.
|
| It basically goes: growing user base -> growing amount of
| malicious content -> ability to submit domain to PSL. In that
| order, more or less.
|
| In terms of security, for me, there's no issue with being on the
| same domain as my users. My cookies are scoped to my own
| subdomain, and HTTPS only. For me, being blocked was the only
| problem, one that I can honestly admit was way bigger than I
| thought.
|
| Hence, the PSA. :)
| lucb1e wrote:
| What sort of size would be needed to get on there?
|
| My open source project has some daily users, but not thousands.
| Plenty to attract malicious content, I think a lot of people
| are sending it to themselves though (like onto a malware
| analysis VM that is firewalled off and so they look for a
| public website to do the transfer), but even then the content
| will be on the site for a few hours. After >10 years of hosting
| this, someone seems to have fed a page into a virus scanner and
| now I'm getting blocks left and right with no end in sight. I'd
| be happy to give every user a unique subdomain instead of short
| links on the main domain, and then put the root on the PSL, if
| that's what solves this
| ericselin wrote:
| Based on what I've seen, there's no way to get that project
| into the PSL. I would recommend you to have the content
| available at projectcontent.com if the main site is
| project.com, though. :)
| npodbielski wrote:
| Wow 19EUR for web hosting. I pay like 8 for whole vps. Crazy
| IKnowThings wrote:
| I have recently had the pleasure of speaking with Google senior
| leadership involved in the Safe Browsing product on the topic of
| getting my SaaS product placed on their, "naughty list." The
| platform was down for 6 or so hours due to a false positive hit
| for phishing.
|
| I have read A LOT of blogs/rants/incidents on social media about
| startups, small businesses, and individuals getting screwed by
| large companies in similar capacities. I am VERY sympathetic to
| those cries into the sky, shaking fists at clouds, knowing very
| well we are all very small and how the large providers seem to
| not care. With that in mind, I am not blind to the privilege my
| organization has to rope in Google to discuss root causes for
| incidents.
|
| I am writing about it here because I believe most people will
| never be able to pull a key Google stakeholder into a 40 minute
| video call to deeply discuss the RCAs. The details of the
| discussion are probably protected by NDA so I'll be speaking in
| general terms.
|
| Google has a product called Web Risk
| (https://cloud.google.com/web-risk/docs/overview), I hear it's
| mostly used by Google Enterprise customers in regulated verticals
| and some large social media orgs. Web Risk protects the employees
| of these enterprise organizations by analyzing URLs for
| indicators of risk, such as phishing, brand impersonation, etc.
|
| My SaaS platform is well established and caters mostly to large
| enterprise. I provide enterprise customers with optional branded
| SSO landing pages. Customers can either use sign-in from the
| branded site (SP-initiated) or redirect from their own internal
| identity provider to sign-in (IdP-initiated). The SSO site
| branding is directed by the customer, think along the lines of
| what Microsoft does for Entra ID branded sign-in pages. Company
| logo(s), name, visual styling, and other verbiage may be
| included. The branded/vanity FQDN is
| (company).productname.mydomain.com.
|
| You may be able to see where I'm headed at this point... Why was
| my domain blocked? For suspected phishing.
|
| A mutual enterprise customer was subscribed to Google's Web Risk.
| When their employees navigated to their SSO site, Google scanned
| it. Numerous heuristics flagged the branded SSO site as phishing
| and we were blocked by Safe Browsing across all major web
| browsers (Safari, Chrome, Firefox, Edge, and probably others).
| Google told us that had our customer put the SSO site on their
| Web Risk allow-list, we wouldn't have been blocked.
|
| I'm no spring chicken, I cannot rely nor expect a customer to do
| that, so I pressed for more which led to a lengthy conversation
| on risk and the seemingly, from my perspective, arbitrary
| decisions made by a black box without any sort of feedback loop.
|
| I was provided a tiny bit of insight into the heuristic secret
| sauce, which led to prescribed guidance on what could be done to
| greatly reduce the risk of getting false positive flag for
| phishing again. Those specifics I assume I cannot detail here,
| however the overall gist of it is domain reputation. Google was
| unable to positively ascertain my domain's reputation.
|
| My recommendation is for those of you out there in the inter-
| tubes who have experienced false positive Safe Browsing blocks,
| think about what you can do to increase your domain's public
| reputation. Also, get a GCP account so if you do get blocked, you
| can open a ticket from that portal. I was told it would be
| escalated to the appropriate team and be actioned on within 10-15
| minutes.
| oxguy3 wrote:
| Another day, another IT company learning the hard way about the
| public suffix list, or well-known URIs, or some other well-
| documented-but-niche security technology.
|
| I love that IT is a field where there's no required formal
| education track and you can succeed with any learning path, but
| we definitely need some better way to make sure new devs are
| learning about some of these gotchas.
| andy_xor_andrew wrote:
| > In order to limit the impact of similar issues in the future,
| all sites on statichost.eu are now created with a statichost.page
| domain instead.
|
| This read like a dark twist in a horror novel - the .page tld is
| controlled by Google!
|
| https://get.page/
| j45 wrote:
| One way to build trust.
| ericselin wrote:
| Thank you for this hacker-minded and sharp comment! <3
| Seriously, not all comments on here are as fun to read for me
| as the author and fellow hacker.
|
| And for what it's worth, it feels great to actually pay for
| something Google provides!
| dang wrote:
| PSA: Submitted title was 'PSA: Always use a separate domain for
| user content". We've changed it per
| https://news.ycombinator.com/newsguidelines.html. Might be worth
| knowing for context.
| rgj wrote:
| So... you were hosting user generated content on the same TLD as
| your website, without using the PSL, and you blamed G when things
| went south?
|
| By putting UGC on the same TLD you also put your own security at
| risk, so they basically did you a favor...
| ericselin wrote:
| Many commenters are implying that there is a security issue
| here, and that I'm putting everyone in danger. That is quite
| frankly a pretty absurd claim to just casually make. I'm of
| course very curious to hear more details on what the security
| risk here actually would be?
|
| Do you think I'm reading/writing sensitive data to/from
| subdomain-wide cookies?
|
| Also, yes, the PSL is a great tool to mitigate (in practice
| eliminate) the problem of cross-domain cookies between mutually
| untrusting parties. But getting on that list is non-trivial and
| they (voluntary maintainers) even explicitly state that you can
| forget getting on there before your service is big enough.
| rgj wrote:
| I am not implying you're putting "everyone" in danger. I'm
| merely implying that you're putting your own service in
| danger by allowing clients to act like a trusted subdomain
| like controlpanel.statichost.eu, .secure, or Unicode
| similarities of www.
| ericselin wrote:
| Ok, I see. You mean the possibility of users impersonating
| statichost.eu itself. That is actually a good point, and
| the exact reason why user subdomains are required to have a
| dash in them. :)
|
| I guess control-panel.statichost.eu is still possible, of
| course, but that already seems like a pretty long shot.
| junar wrote:
| I was curious how other browsers handle this. Apparently Safari
| and Firefox delegate to Google.
|
| https://www.apple.com/legal/privacy/data/en/safari/
|
| https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...
|
| Microsoft seems to do its own thing for Edge, though.
|
| https://learn.microsoft.com/en-us/deployedge/microsoft-edge-...
| lucb1e wrote:
| I have the same issue. Think of my site as WeTransfer, but
| instead of only files, you can also use it as a link shortener or
| pastebin. Abuse works the same as on every other site or service:
| I do spot checks and users can report content. This was fine
| until uBlock Origin decided the website was malicious, per one of
| the lists that is default-enabled for everyone
|
| That list doesn't have a clear way to get off of it. I would be
| happy to give them the heads up that their users are complaining
| about a website being broken, but there is no such thing, neither
| for users nor for me. In looking around, there's many "sources"
| that allegedly independently decided around the same day that my
| site needs to not work anymore, so now there's a dozen parties I
| need to talk to and more popping up the further you look.
| Netcraft started sending complaints to the registrar (which got
| the whole domain put on hold), some other list said they sent
| abuse to the IP space owner (my ISP), public resolvers have
| started delisting the domain (pretending "there is no such
| domain" by returning NXDOMAIN), as well as the mentioned
| adblockers
|
| There's only one person who hasn't been contacted: the owner. I
| could actually do something about the abusive content...
|
| It's like the intended path is that users start to complaint
| "your site doesn't work" (works for me, wdym?) and you need to
| figure out what software is it they're using, what DNS resolver
| they use, what antivirus, what browser, if a DOH provider is
| enabled... to find out who it might be that's breaking the site.
| People don't know how many blocklists they're using, and the
| blocklists don't give a shit if you're not a brand name they
| recognize. That's the only difference between my site and a place
| like Github: if I report "github.com hosts malware", nobody
| thinks "oh, we need to nuke that malicious site asap!"
|
| I'd broaden the submitted post to say that it's not only Google
| with too much power, but these blocklists have no notification
| mechanism or general recourse method. It's a whack-a-mole
| situation which, as an open source site with no profit model
| (intentionally so), I will never win. Big tech is what wins. Idk
| if these lists do a trademark registration check or how they
| decide who's okay and who's not, but I suspect it's simply a
| brand name thing and your reviewer needs to know you
|
| > Luckily, Google provided me with a helpful list of the
| offending sites
|
| Google is doing better than most others with that feature. Most
| "intelligence providers", which other blocklists like e.g. Quad9
| uses, are secretive about why they're listing you, or never even
| respond at all
___________________________________________________________________
(page generated 2025-10-10 23:01 UTC)