Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google flags Immich sites as dangerous

immich.app

Post reply on HN
Print view View original

111–120 of 713 posts

Re: Google flags Immich sites as dangerous

#111

Post by shadowgovt »

gmueckl wrote: post #109
lukan wrote: post #93

Earlier quoted context omitted.

"You could take about 90% of that out and into dedicated tools " But then you would loose plattform independency, the main selling point of this atrocity. Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted. The best thing to happen, that I can see, is that a sane subset crystalizes, that people start to…

But do we need e.g serial port or raw USB access straight from a random website? Even WebRTC is a bit of a stretch. There is a lot of cruft in modern browsers that does little except increase attack surface. This all just drives a need to come up with ever more tacked-on protection schemes because browsers have big targets painted on them.

How else am I going to make a game in the browser that be controlled with a controller?

Re: Google flags Immich sites as dangerous

#112

Post by smaudet »

lukan wrote: post #93
gmueckl wrote: post #76

Earlier quoted context omitted.

A part of the issue is IMO that browsers have become ridiculously bloated everything-programs. You could take about 90% of that out and into dedicated tools and end up with something vastly saner and safer and not a lot less capable for all practical purposes. Instead, we collectively are OK with frosting this atrocious layer cake that is today's web with multiple flavors of security measures of sometimes questionabl…

"You could take about 90% of that out and into dedicated tools " But then you would loose plattform independency, the main selling point of this atrocity. Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted. The best thing to happen, that I can see, is that a sane subset crystalizes, that people start to…

> Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted.

I think the giant major downside, is that they've written a rootkit that runs on everything, and to try to make up for that they want to make it so only sites they allow can run.

It's not really very powerful at all if nobody can use it, at that point you are better off just not bothering with it at all.

The Internet may remain, but the Web may really be dead.

Re: Google flags Immich sites as dangerous

#113

Post by liqilin1567 »

donmcronald wrote: post #22
snailmailman wrote: post #17

Earlier quoted context omitted.

I’ve heard anecdotes of people using an entirely internal domain like “plex.example.com” even if it’s never exposed to the public internet, google might flag it as impersonating plex. Google will sometimes block it based only on name, if they think the name is impersonating another service. Its unclear exactly what conditions cause a site to get blocked by safe browsing. My nextcloud.something.tld domain has never be…

I'm almost positive GMail scanning messages is one cause. My domain got put on the list for a URL that would have been unknowable to anyone but GMail and my sister who I invited to a shared Immich album. It was a URL like this that got emailed directly to 1 person: https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xx... Then suddenly the domain is banned even though there was never a way to discover that URL…

This reminds me of another post where a scammer sent a gmail message containing https://site.google.com/xxx link to trick users into click, but gmail didn't detect the risk.

Re: Google flags Immich sites as dangerous

#114

Post by altairprime »

pasteldream wrote: post #75
jdsully wrote: post #54

The one thing I never understood about these warnings is how they don't run afoul of libel laws. They are directly calling you a scammer and "attacker". The same for Microsoft with their unknown executables. They used to be more generic saying "We don't know if its safe" but now they are quite assertive at stating you are indeed an attacker.

> The one thing I never understood about these warnings is how they don't run afoul of libel laws. I’m not a lawyer, but this hasn’t ever been taken to court, has it? It might qualify as libel.

I know of no such cases, and would love to know if someone finds one.

Re: Google flags Immich sites as dangerous

#115

Post by bmandale »

jakub_g wrote: post #19

Regarding how Google safe browsing actually works under the hood, here is a good writeup from Chromium team: https://blog.chromium.org/2021/07/m92-faster-and-more-effici... Not sure if this is exactly the scenario from the discussed article but it's interesting to understand it nonetheless. TL;DR the browser regularly downloads a dump of color profile fingerprints of known bad websites. Then when you load whatever we…

I can't imagine that lasted more than 30 seconds after they made a public blog post about how they were doing it.

Re: Google flags Immich sites as dangerous

#116

Post by thayne »

dspillett wrote: post #50
o11c wrote: post #20

Earlier quoted context omitted.

Is that actually relevant when only images are user content? Normally I see the PSL in context of e.g. cookies or user-supplied forms.

> Is that actually relevant when only images are user content? Yes. For instance in circumstances exactly as described in the thread you are commenting in now and the article it refers to. Services like google's bad site warning system may use it to indicate that it shouldn't consider a whole domain harmful if it considers a small number of its subdomains to be so, where otherwise they would. It is no guarantee, of c…

Well, using the public suffix list _also_ isolates cookies and treats the subdomains as different sites, which may or may not be desirable.

For example, if users are supposed to log in on the base account in order to access content on the subdomains, then using the public suffix list would be problematic.

Re: Google flags Immich sites as dangerous

#117

Post by lukan »

gmueckl wrote: post #109
lukan wrote: post #93

Earlier quoted context omitted.

"You could take about 90% of that out and into dedicated tools " But then you would loose plattform independency, the main selling point of this atrocity. Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted. The best thing to happen, that I can see, is that a sane subset crystalizes, that people start to…

But do we need e.g serial port or raw USB access straight from a random website? Even WebRTC is a bit of a stretch. There is a lot of cruft in modern browsers that does little except increase attack surface. This all just drives a need to come up with ever more tacked-on protection schemes because browsers have big targets painted on them.

WebRTC I use since many years and would miss it a lot. P2P is awesome.

WebUSB I don't use or would miss it right now, but .. the main potential use case is security and it sounds somewhat reasonable

"Use in multi-factor authentication

WebUSB in combination with special purpose devices and public identification registries can be used as key piece in an infrastructure scale solution to digital identity on the internet."

https://en.wikipedia.org/wiki/WebUSB

Re: Google flags Immich sites as dangerous

#118

Post by knowriju »

smaudet wrote: post #103
thayne wrote: post #96

Earlier quoted context omitted.

Looking through some of the links in this post, I there are actually two separate issues here: 1. Immich hosts user content on their domain. And should thus be on the public suffic list. 2. When users host an open source self hosted project like immich, jellyfin, etc. on their own domain it gets flagged as phishing because it looks an awful lot like the publicly hosted version, but it's on a different domain, and pos…

I don't think the Internet should be run by being on special lists (other than like, a globally run registry of domain names)... I get that SPAM, etc., are an issue, but, like f* google-chrome, I want to browse the web, not some carefully curated list of sites some giant tech company has chosen. A) you shouldn't be using google-chrome at all B) Firefox should definitely not be using that list either C) if you are goi…

If you have such strong feelings, you could always use vanilla chromium.

Re: Google flags Immich sites as dangerous

#119

Post by jonas21 »

smaudet wrote: post #103
thayne wrote: post #96

Earlier quoted context omitted.

Looking through some of the links in this post, I there are actually two separate issues here: 1. Immich hosts user content on their domain. And should thus be on the public suffic list. 2. When users host an open source self hosted project like immich, jellyfin, etc. on their own domain it gets flagged as phishing because it looks an awful lot like the publicly hosted version, but it's on a different domain, and pos…

I don't think the Internet should be run by being on special lists (other than like, a globally run registry of domain names)... I get that SPAM, etc., are an issue, but, like f* google-chrome, I want to browse the web, not some carefully curated list of sites some giant tech company has chosen. A) you shouldn't be using google-chrome at all B) Firefox should definitely not be using that list either C) if you are goi…

You can turn it off in Chrome settings if you want.

Re: Google flags Immich sites as dangerous

#120

Post by akersten »

This is #1 on HN for a while now and I suspect it's because many of us are nervous about it happening to us (or have already had our own homelab domains flagged!).

So is there someone from Google around who can send this along to the right team to ensure whatever heuristic has gone wrong here is fixed for good?

Post reply on HN