Live data from Hacker News

Google Domains blocking all Gitbook URLS: post-mortem

blog.gitbook.com

131–140 of 189 posts

Re: Google Domains blocking all Gitbook URLS: post-mortem

#131
post #116

Earlier quoted context omitted.

Where do you draw the line? I mean github.com is the corporate email domain of the GitHub company, it also hosts repositories (user generated content)

But not for any binary content as uploaded by the user, that's served from raw.githubusercontent.com.

Not all of it. Any bug attachments which don't have previews are served from https://github.com directly, for example.

Here, I uploaded that image from the other day that crashes some phones. I gzipped it so it wouldn't generate a preview, and attached it to a bug. When you click the "github.com" link, it downloads the file, and (at least with my web browser) uncompresses it and opens it with your default application. It's bit-for-bit the same as what I uploaded.

https://github.com/kengruven/strukt-bugs/issues/40

I don't know if this is exploitable. I haven't spent any time trying to break GitHub. This is just something I happened to notice once.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#133

Earlier quoted context omitted.

In the postmortem it states that they are moving to Cloudflare

I'd like to interrupt all the sanctimonious blathering in this thread to note that Cloudflare domain registration terms and conditions are almost a verbatim copy of Google's, and includes the same unilateral cancellation clause for phishing. Cloudflare: "Cloudflare and Registry Operator may deny, cancel, suspend, transfer, redirect or modify the Registrar Services or a Registration, or place any domain name(s) on loc…

I think the primary issue with Google Domains here is not that they have these kinds of terms, but that they enforced them in a particularly incompetent way. The original report of the phishing site was over a week old and had already been resolved, when google shut down the domain. Hopefully the people at Cloudflare are a bit better at their jobs.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#135

Earlier quoted context omitted.

I'd like to interrupt all the sanctimonious blathering in this thread to note that Cloudflare domain registration terms and conditions are almost a verbatim copy of Google's, and includes the same unilateral cancellation clause for phishing. Cloudflare: "Cloudflare and Registry Operator may deny, cancel, suspend, transfer, redirect or modify the Registrar Services or a Registration, or place any domain name(s) on loc…

I think the primary issue with Google Domains here is not that they have these kinds of terms, but that they enforced them in a particularly incompetent way. The original report of the phishing site was over a week old and had already been resolved, when google shut down the domain. Hopefully the people at Cloudflare are a bit better at their jobs.

Oh, I don't know that we have enough unbiased information to conclude what you concluded. One of the first comments posted in this thread today was "Is it related to the countless phishing pages hosted on your service?" from which we can deduce that the phishing problem on Gitbook is well-known to random members of the public.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#136
Makes me wonder if they don't understand user-generated content, if Google Domains is more meant for small personal sites maybe?

I used to use a hosting company that had in their terms, that profanity wasn't allowed... The company seemed to have decent hardware, user interfaces and US based support too but ran by Mormons based in the beautiful state of Utah. I don't have much of a opinion of Mormons but I think pushing religious views on your customers is bad business.

So after noticing that in their terms I was curious since I run a personal WordPress blog, if someone wrote a comment even if it wasn't approved just by being in the database if it broke their terms and was told yes... Now that I'm a bit older, I wonder if they really are scanning database table text fields for swearwords or that support rep misunderstood what I meant... But after that discussion, I switched my domain and hosting elsewhere, two separate companies actually instead of just one account with both domain and hosting. If some spam bot or troll writes the F word, they are going to take my entire site down even if no fault of my own? Yeah, no thanks.

They got acquired though by a lot larger company and doesn't seem to have those same terms now though, and heard they now outsource their support. There was someone I used to talk to who was a big fan of them though and referred me. So slightly over a decade later, they are probably not even remotely the same company anymore though since merged with a much larger company. Wouldn't surprise me if they ended up getting rid of a lot of support staff and just kept a handful of people to manage the datacenter, since marketing, accounting, support, etc would probably be centralized between all the hosting companies they own I'd imagine, which is probably a blow to the local areas when they merged unfortunately. I guess that's one of the sad things about getting bigger, they lose that small town friendly startup feel probably as seemed like a great company other than forcing religious views on people. Just did some more research about their company, sounds like they were also anti-lgbt too sadly. Makes me wonder how many other people working their share those views or just something management was pushing down since looks like the church changed their policy last year... I've been wanting to go somewhere with more opportunities, and actually Salt Lake City is one of the areas I've been considering since seems like a bit bigger city and on the list as a place for upcoming startups.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#137
post #131

Earlier quoted context omitted.

But not for any binary content as uploaded by the user, that's served from raw.githubusercontent.com.

Not all of it. Any bug attachments which don't have previews are served from https://github.com directly, for example. Here, I uploaded that image from the other day that crashes some phones. I gzipped it so it wouldn't generate a preview, and attached it to a bug. When you click the "github.com" link, it downloads the file, and (at least with my web browser) uncompresses it and opens it with your default application…

That's interesting. It looks like the link is active, but the request to github.com results in a 302 redirect to S3.

I don't know what that would mean in this type of scenario (phishing) either. I wonder what an html attachment would look like...

Re: Google Domains blocking all Gitbook URLS: post-mortem

#138

Aside from the Google domain issue (which is obviously a problem) -- why on earth would GitBook be hosting user-generated content under their corporate gitbook.com domain? The registrar issue is one problem here -- but I don't see this addressed in their post-mortem. I thought this was a well-known issue. You don't host user-generated content on the same domain that handles your corporate email. Because things like t…

because tech culture permits you to blame Google and their support team instead of knowing basic domain operation practices

Re: Google Domains blocking all Gitbook URLS: post-mortem

#139

GitBook CTO here: Our production domains (gitbook.com and gitbook.io) have been blocked and locked by our registrar (Google Domains). None of our infrastructure is impacted, all user content and databases are safe; our domains simply blocked by a heavy handed policy. As mentioned on Twitter, we are all hands working with Google to fix this issues ASAP. We'll then share an in-depth post-mortem https://twitter.com/GitB…

Ever since you called my content "legacy", I've been leary of your platform.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#140
post #128
post #104

Earlier quoted context omitted.

G Suite is a shit show. Had major problems with a trial. Firstly it would just redirect back to the admin console if I hit gmail. Support couldn’t fix it. Also you can’t give anyone access to YouTube (!) for 60 days after signing up or paying $30 in credit. Which is no good because when you pay them £30 fuck all happens. And again support were useless. Happy O365 customer now. And I’ve used support which was excellen…

What's O365. Honestly I've tried everything and can't find any support pages. In order to get support you need to login to admin console on G Suite, well how the heck am I supposed to do that if I can't login to begin with? This is the generic https://imgur.com/a/lgRby50 page I get. It's been almost a week and a half, more than 5 business days, and I haven't heard back from my request to restore my account. The probl…

> What's O365.

I assume Office 365, from Microsoft.

Post reply on HN