Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Safe Browsing can kill a startup

gomox.medium.com

Post reply on HN
Print view View original

491–500 of 558 posts

Re: Google Safe Browsing can kill a startup

#491

Post by hindsightbias »

ThrustVectoring wrote: post #334
jdsalaro wrote: post #38

Earlier quoted context omitted.

"never attribute to malice that which is adequately explained by stupidity" and all that, but after the events and the almost perfectly orchestrated behavior we've seen in the past and last couple of weeks it's becoming increasingly difficult, at least to me, to not attribute this to malice. Probably deliberate negligence is a better term. They know their systems can make mistakes, of course they do, and yet they bui…

Employees and managers at Google get promoted by launching features and products. They're constitutionally incapable of fixing problems caused by over-active features for the same reason they've launched seven different chat apps.

We are all living at the whim of Google’s technical debt.

Re: Google Safe Browsing can kill a startup

#492

Post by chii »

dharmab wrote: post #477
scott00 wrote: post #336

Earlier quoted context omitted.

Do you need a real domain for each customer or is a subdomain sufficient isolation?

Real domain. If you have customer1.example.com and customer2.example.com, and customer2.example.com serves malware, all of example.com can be flagged.

apparently, submit your domain to https://publicsuffix.org/ to prevent this from happening?

Re: Google Safe Browsing can kill a startup

#493

Post by hindsightbias »

f-word wrote: post #342
mstipetic wrote: post #238

Earlier quoted context omitted.

One of the things I hate the most is people I'm transacting with telling me something has to be done in a certain way because that's how "their system" works. A recent example, I forgot to pay my phone bill on time and network access got turned off. I came to pay it on Friday, and they tell me the notice will appear in their systems only on Monday and then it takes 2 days for the system to automatically reactivate my…

Systems (normally) model organizational processes, so companies with garbage processes usually have garbage systems in place too. This highly specific case reeks of fraud, and you should be able to report them to some kind of ombudsman so you could get your couple days' worth of fees back.

Yes, the terms probably were written when it took two days for a check to clear.

No, the ombudsman probably can’t get legal to update the T&Cs

Re: Google Safe Browsing can kill a startup

#494

Post by coldtea »

nearbuy wrote: post #458
cft wrote: post #390

Earlier quoted context omitted.

The solution is for the legitimate sites that are driven out of business by Google AI to sue Google for tortuous interference and libel.

This helps one group and hurts another. If Google is liable for blocking potential malware and phishing pages, they'll either stop blocking it, or adjust their algorithm to strongly err on the side of allowing phishing sites. Businesses become safer, but more regular people will get phished.

>or adjust their algorithm to strongly err on the side of allowing phishing sites.

It'a not the role of Google to disallow phishing sites (as a browser) just like it's not the role of the ISP.

Make it hookable so people can chose their own phising protection service.

Re: Google Safe Browsing can kill a startup

#496

Post by kelnos »

apple_innocent wrote: post #486
jedberg wrote: post #316

This is actually funny, because I was involved with the creation of this list, way back in 2004. The whole thing started as a way to stop phishing. I was working at eBay/PayPal at the time, and we were finding a bunch of new phishing sites every day. We would keep a list and try to track down the owners of the (almost always hacked) sites and ask them to take it down. But sometimes it would take weeks or months for t…

"For years, they said no, because they were worried about the liability of accidentally blocking something that wasn't a phishing site." Can anyone explain how a web browser author could be liable for using a blacklist. Once past the disclaimer in uppercase that precedes every software install, past the Public Suffix (White)List that browsers include, how do you successfully sue the author of a software program, a we…

I think the situation is actually exactly like the Spamhaus case you describe: it wouldn't be the browser user that sues, but the blocked website's owner. The website's owner need not have accepted any kind of agreement from the browser maker in order to be harmed by the blocklist.

Re: Google Safe Browsing can kill a startup

#497

Post by cturner »

bborud wrote: post #86
lucasverra wrote: post #60

Earlier quoted context omitted.

Agree, we can only vote with our clicks. Sadly gmail and google docs are top notch products :(

No, we can't vote with our clicks. That's what it means when a handful of companies dominate most of the web and the web playing a dominant role in global economy. We have very little real choice. Occasionally people will pretend this is not so. In particular those who can't escape the iron grasp these companies have on the industry. Whose success depends on being in good standing with these companies. Or those whose…

Stock picking is not realism.

Re: Google Safe Browsing can kill a startup

#498

Post by Perseids »

unishark wrote: post #488
cthor wrote: post #478

Earlier quoted context omitted.

There's no reason the number of humans dealing with these problems can't scale alongside the number of humans creating them. But it's a lot cheaper to pay for a few really expensive programmers to make a just-good-enough AI than to pay for thousands of human moderators. So we end up with a stupid computer creating tonnes of human misery all for the sake of FAANG's already fat profit margins.

> There's no reason the number of humans dealing with these problems can't scale alongside the number of humans creating them. I would think the attackers are using automation also, to spam attacks as in other areas of fraud. It can only be a battle of AI ultimately.

Depends on which problem your tackling. With App reviews for example it is very easy to rate limit the 100 USD developer licenses. And also in cases like the one the medium article is facing businesses would gladly pay a hundred bucks to get real humans to produce competent answers/reviews/decisions. And if you dislike this solution because it creates a google tax (pay us or we'll block your site), make it not a service payment, but a security deposit which they'll only keep if you are fraudulent in some way.

Re: Google Safe Browsing can kill a startup

#499

Post by mattmanser »

dharmab wrote: post #210
psyc wrote: post #100

Earlier quoted context omitted.

Pardon my ignorance as I have few years of web dev experience. What exactly does it mean to store data on a domain? Does he mean serve data via a domain URL? And if so, how does Google have discovery of that data?

We’re pretty sure they get reports from Chrome. A security researcher at my workplace was running an exploit against a dev instance as part of their secops role and got the domain flagged, despite the site being an isolated and firewalled instance not accessible to the internet.

But that means they can't verify it, right? Couldn't a malicious actor use this to attack their competitors?

Add an internal DNS entry for your competitor's domain, spin up an internal server hosting some malware and open it from chrome.

Re: Google Safe Browsing can kill a startup

#500

Post by mattmanser »

londons_explore wrote: post #224
Marazan wrote: post #123

Earlier quoted context omitted.

You upload action is hosted on a different domain from the domain that serves the content.

Yes, but when Google blocks either domain, your webapp will still be broken...

And in 10 minutes you grab a new domain and it's back up. You change the config setting in your app to use the new domain and, boom, done.

That's the point, it's a sacrificial domain. If you lose it you don't care, it's not your brand.

Post reply on HN