Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Safe Browsing can kill a startup

gomox.medium.com

Post reply on HN
Print view View original

421–430 of 558 posts

Re: Google Safe Browsing can kill a startup

#421

Post by folmar »

jefftk wrote: post #393
kps wrote: post #338

Earlier quoted context omitted.

> the public suffix list is (sadly) how you communicate that to browsers Sadly, indeed. Had they never heard of DNS?

How would you propose handling this with DNS? Here are some things it covers: * a.example.com and b.example.com are the same site * a.co.uk and b.co.uk are not the same site * a.cloudfront.net and b.cloudfront.net are not the same site * a.higashikawa.hokkaido.jp and b.higashikawa.hokkaido.jp are not the same site * a.example.higashikawa.hokkaido.jp and b.example.higashikawa.hokkaido.jp are the same site There is a p…

  _i_am_tld.cloudfront.net IN TXT "yes"
  _i_am_tld.higashikawa.hokkaido.jp IN TXT "yes"

Re: Google Safe Browsing can kill a startup

#422

Post by samatman »

parineum wrote: post #392
ethbr0 wrote: post #247

Earlier quoted context omitted.

> Google's desire for scale, scale, scale, meant that interactions must be handled through The Algorithms That's fine when you're a plucky growth startup. Less fine when you run half the internet. If Google doesn't want to admit it's a mature business and pivot into margin-eating, but risk-reducing support staffing, then okay: break it back up into enough startup-sized chunks that the response failure of one isn't an…

> That's fine when you're a plucky growth startup. Less fine when you run half the internet. It's never fine. The abdication of responsibility and, more importantly, liability to algorithms is everything that's wrong with the internet and the economy. The reason these tech conglomerates are able to get so big when companies before them couldn't is because it's impossible to scale the way they have without employing t…

> It's never fine.

It kind of is, though.

The idea is that the full algorithm is "automation plus some guy". Automation takes care of 99.9% of it, and some guy handles the 0.01% that's exceptional, falls through the cracks, and so on.

The problem is when you scale from 100,000 events per day to half a trillion, and your fallback is still basically "some guy". At ten failures a day, contacting The Guy means sending an email, and maybe sometimes it takes two. At a million failures a day, your only prayer of reaching The Guy is to get to the top of HN, or write a viral Twitter thread.

There are some things which are important enough that they can't be left up to this formula, and maybe you're thinking of those. I'm not, and I doubt the person you're replying to is either.

Re: Google Safe Browsing can kill a startup

#423

Post by forgotmypw17 »

megous wrote: post #355
jedberg wrote: post #316

This is actually funny, because I was involved with the creation of this list, way back in 2004. The whole thing started as a way to stop phishing. I was working at eBay/PayPal at the time, and we were finding a bunch of new phishing sites every day. We would keep a list and try to track down the owners of the (almost always hacked) sites and ask them to take it down. But sometimes it would take weeks or months for t…

2 millions phishing sites and counting... with 40000 websites added each week. https://transparencyreport.google.com/safe-browsing/overview... I guess the automation started in 2007 or so.

Like some kind of perverse blockchain, no site is ever removed, even though most phishing sites don't live long.

Re: Google Safe Browsing can kill a startup

#424

Post by 90minuteAPI »

wolco5 wrote: post #254
nsgi wrote: post #80

Earlier quoted context omitted.

Don't a lot of startup founders go to elite colleges and come from big companies?

The funded ones with the 2 year timelines generally are. But most startups are more bootstrap/angel investor with a bright owner who has a fatal flaw.

Is this an excerpt from your woefully unpublished startup culture fanfic novella? You can't just leave us hanging.

Re: Google Safe Browsing can kill a startup

#425

Post by kevincox »

ehsankia wrote: post #388
vaduz wrote: post #245

Earlier quoted context omitted.

> Doesn't Chrome upload everything downloaded to VirusTotal (a Google product)? It doesn't, unless you opt for SafeSearch "Enhanced Protection" or enable "Help improve security on the web for everyone" in "Standard Protection". Both are off by default, IIRC. Without it, it periodically downloads what amounts to bloom filter of "potentially unsafe" URLs/domains. On the other hand, GMail and GDrive do run the checks vi…

What happens if it is a hit against the bloom filter / checksum? Would it transmit the URL so that it can be blocklisted?

https://developers.google.com/safe-browsing/v4/update-api#ch...

TL;DR is you download a chunk of SHA-256 hashes and check if the hash for your URL is there. There is of course the chance of collision but that is minuscule.

Re: Google Safe Browsing can kill a startup

#426

Post by samatman »

freedomben wrote: post #365
f-word wrote: post #342

Earlier quoted context omitted.

Systems (normally) model organizational processes, so companies with garbage processes usually have garbage systems in place too. This highly specific case reeks of fraud, and you should be able to report them to some kind of ombudsman so you could get your couple days' worth of fees back.

I would bet they have some terms & conditions the person agreed to that leaves them legally SOL.

I would also bet that the right kind of escalation leads directly to the desk of someone who will give them a refund.

Re: Google Safe Browsing can kill a startup

#427

Post by leowoo91 »

I'll tell you a mini story about a coffee shop I visited few days ago. That place was hidden in yelp search when I looked for 'coffee & tea' in my area (their yelp page existed). While I don't know the actual reason why this happened, I immediately discovered that coffee shop using google (as a double check). It gave me a charm because it reminded me a fact that if you have the 'right service', people will find out. Given this flow, I started to believe gatekeepers might begin losing their odds.

Re: Google Safe Browsing can kill a startup

#428

Post by ocdtrekkie »

yuvalr1 wrote: post #325
jedberg wrote: post #316

This is actually funny, because I was involved with the creation of this list, way back in 2004. The whole thing started as a way to stop phishing. I was working at eBay/PayPal at the time, and we were finding a bunch of new phishing sites every day. We would keep a list and try to track down the owners of the (almost always hacked) sites and ask them to take it down. But sometimes it would take weeks or months for t…

This is an amazing story. It really demonstrates the way we pave our road to hell with good intentions... We should really do something about this issue, where so few companies (arguably, a single one) hold so much power over the most fundamental technology of the era.

The solution is simple: Liability. As soon as it becomes legally infeasible to let algorithms block people, it will stop happening.

Make it easy and affordable to submit legal complaints for tech misbehavior and make the penalties hurt.

Re: Google Safe Browsing can kill a startup

#429

Post by CamperBob2 »

perl4ever wrote: post #309
ghaff wrote: post #228

Earlier quoted context omitted.

I'm not sure it's even attributable to stupidity (necessarily) as attributable to automation or, more long-windedly, attributable to the fact that automation at scale will sometimes scale in wacky ways and said scale also makes it nearly impossible--or at least unprofitable--to insert meaningful human intervention into the loop. Not Google, but a few months back I suddenly couldn't post on Twitter. Why? Who knows. I…

I was just paying a bill online. I had loading images turned off in my browser. So I get the checkbox captcha thing, and checking it is not enough, so I have to click on taxis, etc. Which didn't initially show because of images being off. I eventually did turn on images for the site and reload it. But at first, I was like "wait a minute, why should I have to have images on to pay a bill ?" and I clicked a bunch of th…

Genuinely-handicapped users should certainly have accommodations that allow them to pay bills using the necessary accessibility tools. It's always tricky to keep those tools from being leveraged by spammers and phishers, though, as witnessed by how TDD services for the deaf were misused in the past. Hard problem to solve in general, either through legislation or technology.

But if you're an ordinary user without special challenges, why would you expect anything to work after turning images off in your browser? If you're that much of a Luddite, maybe computers and technology aren't appropriate areas of interest for you to pursue.

Re: Google Safe Browsing can kill a startup

#430

Post by underwater »

jedberg wrote: post #316

This is actually funny, because I was involved with the creation of this list, way back in 2004. The whole thing started as a way to stop phishing. I was working at eBay/PayPal at the time, and we were finding a bunch of new phishing sites every day. We would keep a list and try to track down the owners of the (almost always hacked) sites and ask them to take it down. But sometimes it would take weeks or months for t…

Liability was my first though. How is an assertion that a site contains malware not libel? Site would be easily able to demonstrate lost revenue.
Post reply on HN