Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanks HN: Lessons learned after Google nearly killed my site

uploader.win

Post reply on HN
Print view View original

101–110 of 296 posts

Re: Thanks HN: Lessons learned after Google nearly killed my site

#101

Post by that_guy_iain »

nchelluri wrote: post #98
that_guy_iain wrote: post #86

>Now we run automated tests to monitor server uptime and check server for problems every 30 seconds. Unfortunately automated test scripts were happily getting HTTP/200 replies while people using the Chrome browser were being told this is a scam business trying to steal their bank account information. I was surprised this wasn't part of the lessons learned. But it seems the monitoring basically failed but that wasn't…

It's funny you read it that way, you may understand it correctly but I came away with a different interpretation, that they allow-listed the developer's IP and returned good non-phishing-warning responses to the monitoring check, but not to end-users.

They said their test scripts worked but people using Chrome got an error. So I take that as in their scripts weren't using Chrome at all.

To be fair, I've not had this happen yet so I am going to try and find a site that chrome won't let me visit and see what happens when I visit it programmatically.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#102

Post by ufmace »

I'm wondering if this could actually be spun into being a good thing.

I just looked over the site a little more. The business idea seems to be to have a widget to add to your site that can be used to upload arbitrary files to it. The real advantage looks to be that they have a bunch of integrations set up with Facebook, GDrive, Dropbox, Instagram, etc so that all just works without you having to set up and manage developer accounts with 10 different services. Plus built-in image resizing and such things that all just works. Pretty cool, and I might use it if I built a site that needed to do that.

One way you can frame the point of this business is that they worry about the details of integrating with these other services so that you don't have to. As they found out, hosting external content is inherently dangerous, and it pays to have someone responsible for that who knows the risks and has experience in mitigating them. If a site owner wasn't using this service, they would have to take that responsibility on for themselves and re-learn these same lessons. So that's just another advantage of using this service - "we have experience in mitigating the risk of hostile users abusing upload services to serve malware, so you don't have to worry about it".

Re: Thanks HN: Lessons learned after Google nearly killed my site

#103

Post by ncann »

davidmurdoch wrote: post #80
dencodev wrote: post #78

Earlier quoted context omitted.

Have you considered calling the number tied to the account and asking them to help?

They only show the last two digits of the number. And I've only ever had two phone numbers in my life, and neither of them end with those digits.

Plus it is always a bad idea to give someone a code sent to your number. 99% of the time someone is trying to hack you and a necessary step is obtaining that code.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#104

Post by ghaff »

davidmurdoch wrote: post #95
jokethrowaway wrote: post #83

Earlier quoted context omitted.

I'm in a similar situation with Apple. I can't access my 10 years old account even though I know the password and control the email attached to it because I don't remember my security questions and I don't have my recovery email anymore. I probably put rubbish data in the security questions as they weaken the security of the account. Funnily enough that password leaked and someone managed to take over my account (I w…

I actually have the same issue with my Apple account I used back in the ipod days; they are now requiring that I answer my security question during log in. But I actually don't remember the answer to the security question, as I used to always put gibberish instead of a real answer. Back in those days these questions would only be used to reset your password, and I was confident I wouldn't forget the password. I've gi…

Furthermore, the answers to security questions aren't always stable. "What was your first pet?" Well, I know how I answer this question because one dog in particular I sort of consider my first pet. But I can remember dogs we had before that one so my answer is a somewhat arbitrary one.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#105

Post by dleslie »

x86_64Ubuntu wrote: post #60
inglor_cz wrote: post #39

Earlier quoted context omitted.

Democratic societies try to limit this problem by establishing some semireliable channels to remedy injustice, though.

I don't think anyone considers this to be in the realm of injustice.

It's definitely in the realm of injustice; how could it not be?

Re: Thanks HN: Lessons learned after Google nearly killed my site

#107

Post by MaxBarraclough »

heavyset_go wrote: post #97
davidmurdoch wrote: post #76

Earlier quoted context omitted.

I can't access my 13+ year old gmail account because Google now requires I verify I have access to a phone number I've never owned. There is no 2FA on this account, I know my password, and have access to the "Recovery Email" (which gets emailed a "Somebody knows your password" warning whenever I attempt to sign in to the account with my password). I reached a real person at Google Domains and managed to get things es…

> This account "owns" digital goods, thousands of songs, and many domain names. Google is actively stealing these things, but they don't care and, "can't help". I long for the day that they cross the wrong person with means to take them to court over their negligence.

My very-much-not-a-lawyer understanding is that their legal obligations and liabilities are minimal on account of Gmail being offered free of charge. Anyone know if that's true?

Re: Thanks HN: Lessons learned after Google nearly killed my site

#108

Post by StanislavPetrov »

jokethrowaway wrote: post #83
davidmurdoch wrote: post #76

Earlier quoted context omitted.

I can't access my 13+ year old gmail account because Google now requires I verify I have access to a phone number I've never owned. There is no 2FA on this account, I know my password, and have access to the "Recovery Email" (which gets emailed a "Somebody knows your password" warning whenever I attempt to sign in to the account with my password). I reached a real person at Google Domains and managed to get things es…

I'm in a similar situation with Apple. I can't access my 10 years old account even though I know the password and control the email attached to it because I don't remember my security questions and I don't have my recovery email anymore. I probably put rubbish data in the security questions as they weaken the security of the account. Funnily enough that password leaked and someone managed to take over my account (I w…

>I probably put rubbish data in the security questions as they weaken the security of the account.

I had a similar problem, where I had created an account so long ago there were no security questions. They later added the security question requirement, but since I had never filled them out and they refused to accept a blank answer and I was forever locked out.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#109

Post by mrighele »

MaxBarraclough wrote: post #107
heavyset_go wrote: post #97

Earlier quoted context omitted.

> This account "owns" digital goods, thousands of songs, and many domain names. Google is actively stealing these things, but they don't care and, "can't help". I long for the day that they cross the wrong person with means to take them to court over their negligence.

My very-much-not-a-lawyer understanding is that their legal obligations and liabilities are minimal on account of Gmail being offered free of charge. Anyone know if that's true?

> This account "owns" digital goods, thousands of songs, and many domain names.

It seems it's not only about a free Gmail account.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#110

Post by edoceo »

MaxBarraclough wrote: post #107
heavyset_go wrote: post #97

Earlier quoted context omitted.

> This account "owns" digital goods, thousands of songs, and many domain names. Google is actively stealing these things, but they don't care and, "can't help". I long for the day that they cross the wrong person with means to take them to court over their negligence.

My very-much-not-a-lawyer understanding is that their legal obligations and liabilities are minimal on account of Gmail being offered free of charge. Anyone know if that's true?

Its the terms of service users agreed to. Prices not relevant
Post reply on HN