Google flags Immich sites as dangerous • Hacker News Board

Re: Google flags Immich sites as dangerous

#41

Post by hu3 » Thu, Oct 23, 2025, 1:11 AM UTC

CaptainOfCoit wrote: post #40

arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

I think it's somewhat tribal webdev knowledge that if you host user generated content you need to be on the PSL otherwise you'll eventually end up where Immich is now. I'm not sure how people not already having hit this very issue before is supposed to know about it beforehand though, one of those things that you don't really come across until you're hit by it.

This is the first time I hear about https://publicsuffix.org

Re: Google flags Immich sites as dangerous

#42

Post by jstrong » Thu, Oct 23, 2025, 1:14 AM UTC

google: we make going to the DMV look delightful by comparison!

Re: Google flags Immich sites as dangerous

#43

Post by ggm » Thu, Oct 23, 2025, 1:18 AM UTC

arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

I think this only is true if you host independent entities. If you simply construct deep names about yourself with demonstrable chain of authority back, I don't think the PSL wants to know. Otherwise there is no hierarchy the dots are just convenience strings and it's a flat namespace the size of the PSLs length.

Re: Google flags Immich sites as dangerous

#44

Post by ggm » Thu, Oct 23, 2025, 1:19 AM UTC

Is there any linkage to the semifactoid that immich Web gui looks very like Google Photos or is that just one of the coincidences?

Re: Google flags Immich sites as dangerous

#45

Post by elphinstone » Thu, Oct 23, 2025, 1:19 AM UTC

jstrong wrote: post #42

google: we make going to the DMV look delightful by comparison!

They are not the government and should not have this vast, unaccountable monopoly power with no accountability and no customer service.

Re: Google flags Immich sites as dangerous

#46

Post by heavyset_go » Thu, Oct 23, 2025, 1:25 AM UTC

Insane that one company can dictate what websites you're allowed to visit. Telling you what apps you can run wasn't far enough.

Re: Google flags Immich sites as dangerous

#47

Post by btown » Thu, Oct 23, 2025, 1:29 AM UTC

hu3 wrote: post #41

CaptainOfCoit wrote: post #40

Earlier quoted context omitted.

I think it's somewhat tribal webdev knowledge that if you host user generated content you need to be on the PSL otherwise you'll eventually end up where Immich is now. I'm not sure how people not already having hit this very issue before is supposed to know about it beforehand though, one of those things that you don't really come across until you're hit by it.

This is the first time I hear about https://publicsuffix.org

You're in good company! From 12 days ago: https://news.ycombinator.com/item?id=45538760

Re: Google flags Immich sites as dangerous

#48

Post by no_wizard » Thu, Oct 23, 2025, 1:33 AM UTC

CaptainOfCoit wrote: post #40

arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

I think it's somewhat tribal webdev knowledge that if you host user generated content you need to be on the PSL otherwise you'll eventually end up where Immich is now. I'm not sure how people not already having hit this very issue before is supposed to know about it beforehand though, one of those things that you don't really come across until you're hit by it.

I’ve been doing this for at least 15 years and it’s the first I heard of this.

Fun learning new things so often but I never once heard of the public suffix list.

That said, I do know the other best practices mentioned elsewhere

Re: Google flags Immich sites as dangerous

#49

Post by aftbit » Thu, Oct 23, 2025, 1:34 AM UTC

arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

I thought this story would be about some malicious PR that convinced their CI to build a page featuring phishing, malware, porn, etc. It looks like Google is simply flagging their legit, self-created Preview builds as being phishing, and banning the entire domain. Getting immich.cloud on the PSL is probably the right thing to do for other reasons, and may decrease the blast radius here.

Re: Google flags Immich sites as dangerous

#50

Post by dspillett » Thu, Oct 23, 2025, 1:37 AM UTC

o11c wrote: post #20

arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

Is that actually relevant when only images are user content? Normally I see the PSL in context of e.g. cookies or user-supplied forms.

> Is that actually relevant when only images are user content?

Yes. For instance in circumstances exactly as described in the thread you are commenting in now and the article it refers to.

Services like google's bad site warning system may use it to indicate that it shouldn't consider a whole domain harmful if it considers a small number of its subdomains to be so, where otherwise they would. It is no guarantee, of course.