Google Safe Browsing can kill a startup • Hacker News Board

Re: Google Safe Browsing can kill a startup

#341

Post by tapland » Sat, Jan 16, 2021, 9:19 PM UTC

lrem wrote: post #232

judge2020 wrote: post #109

Earlier quoted context omitted.

> What's most interesting is that the bucket is private, so the only way they could identify that there is something malicious at a URL is if someone downloads it using Chrome. I'm assuming they make this decision based on some database of checksums. Doesn't Chrome upload everything downloaded to VirusTotal (a Google product)?

Sounds rather too resource-intensive? I've just tried with current Chrome on Windows and a 32MB zip on my personal domain, Wireshark says the file has not been sent anywhere.

Wouldnt it be more efficient to grab it in parallel to your download?

Re: Google Safe Browsing can kill a startup

#342

Post by f-word » Sat, Jan 16, 2021, 9:20 PM UTC

mstipetic wrote: post #238

freedomben wrote: post #138

Earlier quoted context omitted.

Very poignant observation. I have run into this as well in situations in meat-space everywhere from the DMV queue to grocery pickup. Empathy and understanding for fellow humans is at an all time low, no doubt exacerbated by technologies dehumanizing us into data points and JSON objects in a queue waiting for the algorithm to service. As wonderful as tech has made our lives, it is not fully in the category of "better"…

One of the things I hate the most is people I'm transacting with telling me something has to be done in a certain way because that's how "their system" works. A recent example, I forgot to pay my phone bill on time and network access got turned off. I came to pay it on Friday, and they tell me the notice will appear in their systems only on Monday and then it takes 2 days for the system to automatically reactivate my…

Systems (normally) model organizational processes, so companies with garbage processes usually have garbage systems in place too. This highly specific case reeks of fraud, and you should be able to report them to some kind of ombudsman so you could get your couple days' worth of fees back.

Re: Google Safe Browsing can kill a startup

#343

Post by simonw » Sat, Jan 16, 2021, 9:23 PM UTC

McAfee SiteAdvisor recently started flagging the website for my open source project https://datasette.io/

"slightly risky" due to being a "Technical/Business Forums" and a PUP - "Potentially Unwanted Programs

I submitted a review a few weeks ago and I just checked and it's green now, which is a big relief. https://www.siteadvisor.com/sitereport.html?url=datasette.io

Re: Google Safe Browsing can kill a startup

#344

Post by lmarcos » Sat, Jan 16, 2021, 9:25 PM UTC

heybrendan wrote: post #29

Can anyone "in the know" objectively comment if Google Safe Browsing (GSB) has had a net positive result or outcome for the Internet, at large? Has GSB helped users, more than it has hurt them? The anti-Google rhetoric [on HN] is becoming more tiresome as of late. Personally, I welcome the notifications in my browsers that a domain is unsafe. I can't possibly be the only one.

If Safe Browsing were offered by some neutral internet organization (e.g., similar to IANA) I wouldn't mind. But it's offered by a private company: so it's naive to think that GSB benefits anyone other than Google itself.

Re: Google Safe Browsing can kill a startup

#345

Post by teamspirit » Sat, Jan 16, 2021, 9:28 PM UTC

yuvalr1 wrote: post #325

jedberg wrote: post #316

This is actually funny, because I was involved with the creation of this list, way back in 2004. The whole thing started as a way to stop phishing. I was working at eBay/PayPal at the time, and we were finding a bunch of new phishing sites every day. We would keep a list and try to track down the owners of the (almost always hacked) sites and ask them to take it down. But sometimes it would take weeks or months for t…

This is an amazing story. It really demonstrates the way we pave our road to hell with good intentions... We should really do something about this issue, where so few companies (arguably, a single one) hold so much power over the most fundamental technology of the era.

Here-here! I really wish there was more human involvement in a lot of these seemingly arbitrary AI-taken actions. Everything from app review to websites and more. This heavy reliance on automated systems has led us down this road. Shoot, keep it, just give us the option to guarantee human review - with of course transparency. We don't need anymore "some human looked at this and agreed, the decisions is final, goodbye."

I know it's easier said than done, especially when taking the scale of the requests into account, but the alternative has, does, and will continue to do serious harm to the many people and businesses caught in this wide, automated net.

Re: Google Safe Browsing can kill a startup

#346

Post by f-word » Sat, Jan 16, 2021, 9:29 PM UTC

If algorithms they own are operating on a list they maintain and they are making you lose profit, exactly why can you not sue them for that lost profis? What's the legal theory here? A product they own and is entirely disconnected from you is banning you. This is not and should not be OK, nor should you be required to do any special dances and magic gestures to try and mitigate the problem.

Re: Google Safe Browsing can kill a startup

#347

Post by lmarcos » Sat, Jan 16, 2021, 9:35 PM UTC

joseph_grobbles wrote: post #182

A bit of deception on how their site ended up on the block list. They strangely block out a part of their response, but we can see "was cleared", which sounds a lot like "the malware some nefarious agent put on my site was removed". How sites end up on the block list- -they host malware, either intentionally or because they were hacked. -they host a phishing site, either intentionally or because they were hacked. Pro…

> When I get a text to a phishing site, I immediately report it to the safe browsing list.

Please, don't do that. You're just giving more power to a private company (Google). It's so deceiving, I know: reporting/blocking malware sites is a good thing, but doing so via Google diminishes the returns so greatly that it's no longer worth it.

Re: Google Safe Browsing can kill a startup

#348

Post by treis » Sat, Jan 16, 2021, 9:37 PM UTC

gomox wrote: post #161

treis wrote: post #145

Earlier quoted context omitted.

IMHO, it sounds like it worked. The things you changed sound like it's made your site more secure. In the future, Googles hammer can be a bit more precise since you've segregated data. And you don't know what triggered it. It's possible that one of your clients was compromised or one of their customers was trying to use the system to distribute malware.

It's only more secure from Google's blacklist hammer. No significant security is introduced by splitting our company's properties into a myriad of separate domains. This type of incident can be a deadly blow to a B2B SaaS company since you are essentially taking out an uptime sensitive service that a lot of times has downtime penalties written down in a contract. Whether this is downtime will depend on how exactly th…

If you split up your user uploaded material into per client subdomains you will know which one is uploading the malicious files. And your clients can block other subdomains limiting their exposure as well. Is it a huge improvement? No, but at least it's something

Re: Google Safe Browsing can kill a startup

#349

Post by __turbobrew__ » Sat, Jan 16, 2021, 9:37 PM UTC

jedberg wrote: post #316

This is actually funny, because I was involved with the creation of this list, way back in 2004. The whole thing started as a way to stop phishing. I was working at eBay/PayPal at the time, and we were finding a bunch of new phishing sites every day. We would keep a list and try to track down the owners of the (almost always hacked) sites and ask them to take it down. But sometimes it would take weeks or months for t…

> since then it seems that they have forgotten their fear of liability

They most likely have offloaded the liability to a “machine learning algorithm”. It’s easy for companies to point the finger at an algorithm instead of them taking responsibility.

Re: Google Safe Browsing can kill a startup

#350

Post by bborud » Sat, Jan 16, 2021, 9:39 PM UTC

pault wrote: post #206

bborud wrote: post #86

Earlier quoted context omitted.

No, we can't vote with our clicks. That's what it means when a handful of companies dominate most of the web and the web playing a dominant role in global economy. We have very little real choice. Occasionally people will pretend this is not so. In particular those who can't escape the iron grasp these companies have on the industry. Whose success depends on being in good standing with these companies. Or those whose…

Do you think the 1982 breakup of AT&T would have been possible in today's political reality?

No.