Google Safe Browsing can kill a startup • Hacker News Board

Re: Google Safe Browsing can kill a startup

#61

Post by TazeTSchnitzel » Sat, Jan 16, 2021, 3:46 PM UTC

heipei wrote: post #55

TazeTSchnitzel wrote: post #25

Earlier quoted context omitted.

There's a very obvious reason not to do that: if you apparently maliciously cry wolf a few times, people won't trust your cries any more, and, for example, other browsers might choose to stop using the Google Safe Browsing list.

So what would they use instead? It's not like there are any other free, real-time and mostly accurate malicious-URL databases around for people to plug into their browsers and products.

Perhaps “comes the hour, comes the man” would apply? It's a difficult problem, but if there was an urgent need for a solution, I'm sure one could be found.

Re: Google Safe Browsing can kill a startup

#62

Post by alisonkisk » Sat, Jan 16, 2021, 3:47 PM UTC

jdsalaro wrote: post #27

sethherr wrote: post #10

I think another take away from this article is “don’t allow users to upload malicious files that you then host from your domain” This seems easier to do than jumping domains.

> I think another take away from this article is “don’t allow users to upload malicious files to your domain” I disagree, at which point did we all accept Google's role as defacto regulator and arbiter of the Internet? Why should we tacitly accept the constraints they deem as appropriate and modify the way we build the web? In other words, those are our domains, our apps, our systems and we'll do as we please; that i…

Sorry, but you don't get to tell me I am obligated to browse your site without being notified if you have malware.

Re: Google Safe Browsing can kill a startup

#63

Post by TazeTSchnitzel » Sat, Jan 16, 2021, 3:47 PM UTC

alisonkisk wrote: post #59

TazeTSchnitzel wrote: post #25

Earlier quoted context omitted.

There's a very obvious reason not to do that: if you apparently maliciously cry wolf a few times, people won't trust your cries any more, and, for example, other browsers might choose to stop using the Google Safe Browsing list.

What other browsers? Almost all users of SB are using Chrome.

Firefox and Safari. I know, Chrome is huge these days and it's a problem, but it's not like anything can be done about Chrome.

Re: Google Safe Browsing can kill a startup

#64

Post by veesahni » Sat, Jan 16, 2021, 3:48 PM UTC

Our company [0] was also hit by this too.

We receive email for our customers and a portion of that is spam (given the nature of email). Google decided out of the blue to mark our attachment S3 bucket as dangerous, because of one malicious file.

What's most interesting is that the bucket is private, so the only way they could identify that there is something malicious at a URL is if someone downloads it using Chrome. I'm assuming they make this decision based on some database of checksums.

To mitigate, we now operate a number of proxies in front of the bucket, so we can quickly replace any that get marked as dangerous. We also now programmatically monitor presence of our domains in Google's "dangerous site" database (they have APIs for this).

0: https://www.enchant.com - software for better customer service

Re: Google Safe Browsing can kill a startup

#65

Post by arien » Sat, Jan 16, 2021, 3:49 PM UTC

alisonkisk wrote: post #62

jdsalaro wrote: post #27

Earlier quoted context omitted.

> I think another take away from this article is “don’t allow users to upload malicious files to your domain” I disagree, at which point did we all accept Google's role as defacto regulator and arbiter of the Internet? Why should we tacitly accept the constraints they deem as appropriate and modify the way we build the web? In other words, those are our domains, our apps, our systems and we'll do as we please; that i…

Sorry, but you don't get to tell me I am obligated to browse your site without being notified if you have malware.

Might have, judging from this story.

Re: Google Safe Browsing can kill a startup

#66

Post by dannyw » Sat, Jan 16, 2021, 3:49 PM UTC

anovikov wrote: post #42

ptero wrote: post #26

This is not new; such things happened many times in the past (25 years ago Microsoft was the behemoth trampling small companies) and will happen again. I do not think Google is doing it consciously -- this is probably just collateral damage from some bot or rule. The way to handle it is to reduce dependencies on the cloud. This does not mean cutting cloud services altogether, but once the company is big enough (and t…

Yeah i read stories that Yahoo in 1990s called itself a media company and it's product managers "producers" out of fear that once you call yourself a software company - Microsoft will crush you... As for using clouds - there is absolutely no point in the world to use them for anything above staging level, or very very low level launches. People should switch away from cloud as soon as they see even tentative signs of…

You will save so, so much money switching away from clouds too.

No, you don't need to use a hundred different AWS/GCP/whatever services, and yes, managing your own infrastructure is a lot easier than you think (and sometimes easier/faster than AWS).

The Stack Exchange network, at least around 2018 or so, was hosted on 12 servers they own!

Re: Google Safe Browsing can kill a startup

#67

Post by freedomben » Sat, Jan 16, 2021, 3:50 PM UTC

TazeTSchnitzel wrote: post #25

hirundo wrote: post #8

Is there any reason that Google couldn't, or wouldn't, repurpose Google Safe Browsing to blacklist sites that are "unsafe" due to under- or poorly moderated content? E.g. doing this to Parler after they find hosting again? I can't think of a reliable one.

There's a very obvious reason not to do that: if you apparently maliciously cry wolf a few times, people won't trust your cries any more, and, for example, other browsers might choose to stop using the Google Safe Browsing list.

I would agree, but "apparently maliciously" is too subjective.

According to US conservatives this is what Twitter, Facebook, Amazon, Google, Apple, Twilio, Snapchat, etc all did to Parler for political reasons.

According to US progressives/liberals it was absolutely not malicious, but rather the polar opposite: protecting people.

These days there is no common agreement on that stuff, and given the recent events I see no reason to believe that they wouldn't do as GP asked.

Re: Google Safe Browsing can kill a startup

#68

Post by the8472 » Sat, Jan 16, 2021, 3:51 PM UTC

heipei wrote: post #55

TazeTSchnitzel wrote: post #25

Earlier quoted context omitted.

There's a very obvious reason not to do that: if you apparently maliciously cry wolf a few times, people won't trust your cries any more, and, for example, other browsers might choose to stop using the Google Safe Browsing list.

So what would they use instead? It's not like there are any other free, real-time and mostly accurate malicious-URL databases around for people to plug into their browsers and products.

Nothing at all. Many people survive exposure to the internet without being protected by corporate firewalls, think-of-the-children filters and antivirus.

Or do we expect UK citizens to curl up in fetal position and start screaming as soon as they leave their country because they're no longer protected by their ISP filters?

Re: Google Safe Browsing can kill a startup

#69

Post by dgudkov » Sat, Jan 16, 2021, 3:51 PM UTC

One corporation must not have so much power over billions of citizens of many countries. A power like that must only come from a transparent non-profit organization with a publicly elected management board.

We will get to that point sooner or later. But the road there will be long and painful.

Re: Google Safe Browsing can kill a startup

#70

Post by gomox » Sat, Jan 16, 2021, 3:52 PM UTC

veesahni wrote: post #64

Our company [0] was also hit by this too. We receive email for our customers and a portion of that is spam (given the nature of email). Google decided out of the blue to mark our attachment S3 bucket as dangerous, because of one malicious file. What's most interesting is that the bucket is private, so the only way they could identify that there is something malicious at a URL is if someone downloads it using Chrome.…

Author here. I'm not sure exactly how they actually decide to flag. Alternatively, Amazon might somehow be reporting files in S3 onto the Google blacklist.

It would seem surprising, but it's the other possibility.