Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Safe Browsing incident

statichost.eu

Post reply on HN
Print view View original

121–130 of 183 posts

Re: Google Safe Browsing incident

#121

Post by ericselin »

neon_erosion wrote: post #85
ericselin wrote: post #73

Earlier quoted context omitted.

The thing is, you cannot just add any domain to the PSL. You need a significant amount of users before they will include your domain. Before recently, there really was no point in even submitting, since the domain would have been rejected as too small. An increase in user base, increase in malicious content and the ability to add your domain to the PSL all happen sort of simultaneously. I'm also trusting my users to…

There are well-documented solutions to this that don't rely on the PSL. Choosing to ignore all of that advice while hosting user content is a very irresponsible choice, at best.

So the problem here is that Alice on alice.statichost.page might set a cookie for the `.statichost.page` domain if she's careless (which is sometimes the case with Alice). This cookie can then be read by Mallory on mallory.statichost.eu. Or the other way around, if Mallory wants to try to trick Alice into reading his cookie. How this can be prevented without the PSL is something I'm very interested to hear more about.

Re: Google Safe Browsing incident

#123

Post by j45 »

neon_erosion wrote: post #82
ericselin wrote: post #19

Earlier quoted context omitted.

I'm not saying that Google or Safe Browsing in particular did anything wrong per se. My point is primarily that Google has too much power over the internet. I know that in this case what actually happened is because of me not putting enough effort into fending off bad guys. The new separate domain is pending inclusion in the PSL, yes. Edit: the "effort" I'm talking about above refers to more real time moderation of c…

How does flagging a domain that was actively hosting phishing sites demonstrate that Google has too much power? They do, but this is a terrible example, undermining any point you are trying to make.

Maybe google can have large impact is a more accurate way of putting it vs power.

Re: Google Safe Browsing incident

#124

Post by j45 »

shadowgovt wrote: post #46
ericselin wrote: post #19

Earlier quoted context omitted.

I'm not saying that Google or Safe Browsing in particular did anything wrong per se. My point is primarily that Google has too much power over the internet. I know that in this case what actually happened is because of me not putting enough effort into fending off bad guys. The new separate domain is pending inclusion in the PSL, yes. Edit: the "effort" I'm talking about above refers to more real time moderation of c…

There are two aspects to the Internet: the technical and the social. In the social, there is always someone with most of the power (distributed power is an unstable equilibrium), and it's incumbent upon us, the web developers, to know the current status quo. Back in the day, if you weren't testing on IE6 you weren't serving a critical mass of your potential users. Nowadays, the nameplates have changed but the same pr…

Social wasn't always sole powered, only began with the later social networks, not the early. And now people are retreating to smaller communities anyways.

Testing on IE6 wasn't the requirement, all browser's was. IE shipped default on windows and basically forced themselves into the browser conversation with an incomplete browser.

Re: Google Safe Browsing incident

#125

Post by j45 »

dawnerd wrote: post #87
kbolino wrote: post #11

Putting user content on another domain and adding that domain to the public suffix list is good advice. So good, in fact, that it should have been known to an infrastructure provider in the first place. There's a lot of vitriol here that is ultimately misplaced away from the author's own ignorance.

To be fair I’ve been in the space for close to 20 years now, worked on some of the largest sites and this is the first I’m hearing of the public suffix list.

Maybe it was effective from obscurity?

Re: Google Safe Browsing incident

#126

Post by j45 »

andy_xor_andrew wrote: post #122

> In order to limit the impact of similar issues in the future, all sites on statichost.eu are now created with a statichost.page domain instead. This read like a dark twist in a horror novel - the .page tld is controlled by Google! https://get.page/

One way to build trust.

Re: Google Safe Browsing incident

#128

Post by ericselin »

shadowgovt wrote: post #44

Not sure who changed the HN headline, but I appreciate the change. Especially since the concept in the headline is buried at the bottom of the post. Post author is throwing a lot of sand at Google for a process that has (a) been around for, what, over a decade now and (b) works. The fact of the matter is this hosting provider was too open, several users of the provider used it to put up content intended to attack use…

Author here. I understand that my post and what I'm trying to say is unclear. And that there are too many different aspects to all this.

What I'm trying to say in the post specifically about Google is that I personally think that they have too much power. They can and will shut down a whole domain for four billion users. That is too much power no matter the intentions, in my opinion. I can agree that the intentions are good and that the net effect is positive on the whole, though.

On the "different aspects" side of things, I'm not sure I agree with the _works_ claim you make. I guess it depends on what your definition of works is, but having a blacklist as you tool to fight bad guys is not something that works very well in my opinion. Yes, specifically my own assets would not have been impacted, had I used a separate domain earlier. But the point still stands.

The fact that it took so long to move user content off the main domain is of course on me. I'm taking some heat here for saying this is more important than one (including me) might think. But nonetheless, let it be a lesson for those of you out there who think that moving that forum / upload functionality / wiki / CMS to its own domain (not subdomain) can be done tomorrow instead of today.

Re: Google Safe Browsing incident

#129

Post by rgj »

So… you were hosting user generated content on the same TLD as your website, without using the PSL, and you blamed G when things went south?

By putting UGC on the same TLD you also put your own security at risk, so they basically did you a favor…

Re: Google Safe Browsing incident

#130

Post by ericselin »

rgj wrote: post #129

So… you were hosting user generated content on the same TLD as your website, without using the PSL, and you blamed G when things went south? By putting UGC on the same TLD you also put your own security at risk, so they basically did you a favor…

Many commenters are implying that there is a security issue here, and that I'm putting everyone in danger. That is quite frankly a pretty absurd claim to just casually make. I'm of course very curious to hear more details on what the security risk here actually would be?

Do you think I'm reading/writing sensitive data to/from subdomain-wide cookies?

Also, yes, the PSL is a great tool to mitigate (in practice eliminate) the problem of cross-domain cookies between mutually untrusting parties. But getting on that list is non-trivial and they (voluntary maintainers) even explicitly state that you can forget getting on there before your service is big enough.

Post reply on HN