Live data from Hacker News

Google Safe Browsing can kill a startup

gomox.medium.com

371–380 of 558 posts

Re: Google Safe Browsing can kill a startup

#371
post #76

After years of seeing developments like this, getting worse and worse, it fills me with rage to think about how clearly nobody in power at Google cares. I naively used to think, "they probably don't realize what's happening and will fix it." I always try to give benefit of the doubt, especially having been on the other side so many times and seeing how 9 times out of 10 it's not malice, just incompetence, apathy, or…

I'm with you on the rest, but what has DO done to not have the benefit of doubt? Also, to your point, an organization becomes something else than the sum of its parts, especially the bigger it gets. Google can be a malicious actor without necessarily having individuals make act maliciously.

Yeah that's a fair question. I had a bad personal experience with them, but I've also seen plenty of issues too. There was a big one a little while ago about how Digital Ocean destroyed somebody's entire company by banning them with AI: https://news.ycombinator.com/item?id=20064169 Original Twitter thread: https://twitter.com/w3Nicolas/status/1134529316904153089

In their defense they acknowledged it and some changes. I can't find the blog post now so going from memory. But that only happened because he got lucky and it blew up on HN/twitter and got the attention of leadership at DO. How many people have beenh destroyed in silence?

In my case, Digital Ocean only allows one payment card at a time and my customer (for whom the services were running) provided me with a card that was charged directly.

A couple months later my customer forgot that he had provided the card. He didn't recognizer "Digital Ocean" and thought he had been hacked (which has happened to him before) and called the bank and placed a chargeback.

When DO got the charge back they emailed me and also completely locked my account so I was totally unable to access the UI or API. I didn't find out about the locked account until the next day. I responded to the email immediately, and called my customer, who apologized and called the bank to reverse the chargeback. I was as responsive as they could have asked for.

The next day I needed to open a port in the firewall for a developer to do some work. I was greeted with the dreaded "account logged" screen. I emailed them begging and pleading with them to unblock my account. They responded that they would not unlock the account until the chargeback reversal had cleared. Research showed that it can take weeks for that to happen.

I emailed again explaining that this was totally unacceptable. It is not ok to have to tell your client "yeah sorry I can't open that firewall port for your developer because my account is locked. Might be a couple of weeks." After a day or so, they finally responded and unlocked my account. Fortunately they didn't terminate my droplets, but I wonder what would have happened if I had already started using object storage as I had been planning. This was all over about $30 by the way.

After that terrifying experience, I decided staying on DO was just too risky. Linode's pricing is nearly identical and they have mostly the same features. Prior to launching my new infrastructure I emailed their support asking about their policy. They do not lock accounts unless the person is long-term unresponsive or has a history of abuse.

I've talked with Linode support several times and they've always been great. They're my go to now.

Re: Google Safe Browsing can kill a startup

#373
post #69

One corporation must not have so much power over billions of citizens of many countries. A power like that must only come from a transparent non-profit organization with a publicly elected management board. We will get to that point sooner or later. But the road there will be long and painful.

> We will get to that point sooner or later. Is there anything in particular that makes you believe that it'll eventually happen? Because personally my outlook on things is a bit more pessimistic - oftentimes the main concerns of individuals and organizations alike are financially-oriented and few share the enthusiasm for transparency and openness like Richard Stallman does. The trend of SaaSS ( https://www.gnu.org/p…

>Is there anything in particular that makes you believe that it'll eventually happen?

Humans have demonstrated the ability to eventually improve social systems to make them account for the needs and demands of the majority of stakeholders. In the offline world it has evolved into what is known as democracy. It started several centuries ago and eventually evolved into modern governments as we know it - publicly elected management boards.

Recently, there was an excellent article [1] on HN. It rightfully compared the current state of internet to the feudal times and warlords common in the offline world many centuries ago. From that point through a long and painful process we've come to elected governments as the most sustainable form of governing a large number of humans. All other forms of government turned out to be unsustainable (no matter how attractive they were to certain individuals or organizations) and inevitably led to all kinds of social catastrophes.

I believe, the same will eventually happen to the internet, our new brave world we used to love, but now seem to become increasingly disenchanted with.

[1] https://locusmag.com/2021/01/cory-doctorow-neofeudalism-and-...

Re: Google Safe Browsing can kill a startup

#374
post #355

Earlier quoted context omitted.

2 millions phishing sites and counting... with 40000 websites added each week. https://transparencyreport.google.com/safe-browsing/overview... I guess the automation started in 2007 or so.

I think you mean 2017? 2007 is when the feature launched.

january/february 2007 looks like the time the list jumped from a few hundred to tens of thousands of sites.

Re: Google Safe Browsing can kill a startup

#375

I run https://neocities.org , and safe browsing has been my nightmare overlord for a long time. No way to manage reports via an API, no way to contact support. I haven't even been able to find a suggestions box, even that would be an upgrade here. Digging to find "the wizard" gets you into some official google "community support" forum where you learn the forum is actually run by a non-employee lawful neutral that wa…

Just want to add that neocities is a cultural treasure and I appreciate the work you put into it! I'm sad to hear that Google "Safe" Browsing once again rears it's ugly head blocking legitimate websites, yet I still see scams and phishing show up on ad sponsored links for Google search results. I could foresee in the future all of us having to pay the toll so our hosted websites are considered "safe" too...

Thanks!

Yeah I don't think Safe Browsing shouldn't exist, but it definitely needs some improvements and feedback that's appropriate for how incredibly powerful/dangerous it is.

Re: Google Safe Browsing can kill a startup

#376
post #291

Earlier quoted context omitted.

How do you do this in practice though? Let's say my marketing site is at turtlepics.com and then the pics, captions, feeds, etc are served off of turtlepicscontent.com. So I can serve my app off of turtlepics.com, that's fine. But it can't load any content directly. I'd have to have a separate https://turtlepicscontent.com/feeds/erik "> or whatever that loads a user's feed. But that needs to be authenticated too, so…

You don't necessarily need to authenticate users on that domain with a cookie. An HMAC token would be ideal, because you don't have to maintain state. Don't hardcore the content domain. In case the content domain gets flagged, it should be easy to change to a new domain. The assets themselves (such as images, scripts, etc) can have any browser cache expiration time. HTML documents cache duration will matter, and once…

*hardcode

Re: Google Safe Browsing can kill a startup

#377

I run https://neocities.org , and safe browsing has been my nightmare overlord for a long time. No way to manage reports via an API, no way to contact support. I haven't even been able to find a suggestions box, even that would be an upgrade here. Digging to find "the wizard" gets you into some official google "community support" forum where you learn the forum is actually run by a non-employee lawful neutral that wa…

If Google is falsely claiming your malicious and its harming your business it seems like a pretty clear case of slander/tortuous interference.

I mean we could certainly use the money obviously, but it's not really my goal to sue Google (I probably can't afford it anyways). I just want them to improve. I see them as a partner and only ask that they see us as the same. They certainly have the resources for it.

Re: Google Safe Browsing can kill a startup

#378
post #295
post #161

Earlier quoted context omitted.

It's only more secure from Google's blacklist hammer. No significant security is introduced by splitting our company's properties into a myriad of separate domains. This type of incident can be a deadly blow to a B2B SaaS company since you are essentially taking out an uptime sensitive service that a lot of times has downtime penalties written down in a contract. Whether this is downtime will depend on how exactly th…

To add to this - by splitting and moving domains you've hurt your search rank, eliminated the chance to share cookies (auth, eg) between these domains, and are now subject to new cross-domain security dings in other tooling. Lose-lose.

We're talking about user uploads into a ticket system. They should not be publicly available at all. It won't hurt search rank.

Re: Google Safe Browsing can kill a startup

#379

This is actually funny, because I was involved with the creation of this list, way back in 2004. The whole thing started as a way to stop phishing. I was working at eBay/PayPal at the time, and we were finding a bunch of new phishing sites every day. We would keep a list and try to track down the owners of the (almost always hacked) sites and ask them to take it down. But sometimes it would take weeks or months for t…

This is an amazing story. It really demonstrates the way we pave our road to hell with good intentions... We should really do something about this issue, where so few companies (arguably, a single one) hold so much power over the most fundamental technology of the era.

Are you implying that the list no longer has a good intention? I wouldn't be surprised if there are multiple orders of magnitude more phishing and hacked websites in 2021 than there was in 2004. Even with human checking, I doubt you'll even have 0% failure rate. Is the solution to just give up on blocking phishing sites?

Re: Google Safe Browsing can kill a startup

#380
post #374

Earlier quoted context omitted.

I think you mean 2017? 2007 is when the feature launched.

january/february 2007 looks like the time the list jumped from a few hundred to tens of thousands of sites.

Malware may be easier to catch, but for phishing, it was fairly small (under 150k) until around 2016 where it starts growing linearly.
Post reply on HN