Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Safe Browsing incident

statichost.eu

Post reply on HN
Print view View original

141–150 of 183 posts

Re: Google Safe Browsing incident

#141

Post by shadowgovt »

j45 wrote: post #124
shadowgovt wrote: post #46

Earlier quoted context omitted.

There are two aspects to the Internet: the technical and the social. In the social, there is always someone with most of the power (distributed power is an unstable equilibrium), and it's incumbent upon us, the web developers, to know the current status quo. Back in the day, if you weren't testing on IE6 you weren't serving a critical mass of your potential users. Nowadays, the nameplates have changed but the same pr…

Social wasn't always sole powered, only began with the later social networks, not the early. And now people are retreating to smaller communities anyways. Testing on IE6 wasn't the requirement, all browser's was. IE shipped default on windows and basically forced themselves into the browser conversation with an incomplete browser.

I don't mean social as in social network. I mean that people have always been a key aspect of the technology and how it it practically works.

Yes, yes, IE6 shipped by default shipped by default on Windows. And therefore if you wanted a website that worked, you tested against IE6. Otherwise people would try and use your website and it wouldn't work and they wouldn't blame the browser, they would blame your website.

Those social aspects introduce a bunch of not necessarily written rules that you just have to know and learn as you develop for the web.

Re: Google Safe Browsing incident

#142

Post by fragmede »

jlarocco wrote: post #137
stickfigure wrote: post #47

Earlier quoted context omitted.

"Google does good thing, therefore Google has too much power over the internet" is not a convincing point to make. This safety feature saves a nontrivial number of people from life-changing mistakes. Yes we publishers have to take extra care. Hard to see a negative here.

Is it? Companies like Google coddle users instead of teaching them how to browse smarter and detect phishing for themselves. Google wants people to stay ignorant so they can squeeze them for money instead of phishers.

How does Google get money out of people in that case? As a corporation, Google contributes greatly to the education sector and also profits greatly, so it seems like they're pro-education to me, and are merely making the best of a bad situation, but I'd love to hear how Google extracts money from the people they've protected from phishing schemes in some secret way that I haven't considered. I do happen to have Google stock in my portfolio though, so maybe that indight's my entire comment for you though.

Re: Google Safe Browsing incident

#143

Post by lucb1e »

I have the same issue. Think of my site as WeTransfer, but instead of only files, you can also use it as a link shortener or pastebin. Abuse works the same as on every other site or service: I do spot checks and users can report content. This was fine until uBlock Origin decided the website was malicious, per one of the lists that is default-enabled for everyone

That list doesn't have a clear way to get off of it. I would be happy to give them the heads up that their users are complaining about a website being broken, but there is no such thing, neither for users nor for me. In looking around, there's many "sources" that allegedly independently decided around the same day that my site needs to not work anymore, so now there's a dozen parties I need to talk to and more popping up the further you look. Netcraft started sending complaints to the registrar (which got the whole domain put on hold), some other list said they sent abuse to the IP space owner (my ISP), public resolvers have started delisting the domain (pretending "there is no such domain" by returning NXDOMAIN), as well as the mentioned adblockers

There's only one person who hasn't been contacted: the owner. I could actually do something about the abusive content...

It's like the intended path is that users start to complaint "your site doesn't work" (works for me, wdym?) and you need to figure out what software is it they're using, what DNS resolver they use, what antivirus, what browser, if a DOH provider is enabled... to find out who it might be that's breaking the site. People don't know how many blocklists they're using, and the blocklists don't give a shit if you're not a brand name they recognize. That's the only difference between my site and a place like Github: if I report "github.com hosts malware", nobody thinks "oh, we need to nuke that malicious site asap!"

I'd broaden the submitted post to say that it's not only Google with too much power, but these blocklists have no notification mechanism or general recourse method. It's a whack-a-mole situation which, as an open source site with no profit model (intentionally so), I will never win. Big tech is what wins. Idk if these lists do a trademark registration check or how they decide who's okay and who's not, but I suspect it's simply a brand name thing and your reviewer needs to know you

> Luckily, Google provided me with a helpful list of the offending sites

Google is doing better than most others with that feature. Most "intelligence providers", which other blocklists like e.g. Quad9 uses, are secretive about why they're listing you, or never even respond at all

Re: Google Safe Browsing incident

#144

Post by ericselin »

blenderob wrote: post #43
hk__2 wrote: post #17

Earlier quoted context omitted.

I’m sure I don’t know ALL the "security best practices that have been around for 20+ years" and this is perfectly fine as long as I’m able to react quickly. See also https://xkcd.com/1053/ .

It's fine if you personally didn't know that. But if I'm paying for a service, I expect the provider to understand basic security best practices that have been industry standard for 20+ years. And if they don't, they should be hiring people who do. XKCD 1053 is not a valid excuse for what amounts to negligence in a production service.

Author here. What kind of security negligence are you referring to? What would be a specific attack vector that I left open?

Regarding the PSL - and I can't believe I'm writing this again: you cannot get on there before your service is big enough and "the request authentically merits such widespread inclusion"[1]. So it's kind of a chicken and egg situation.

Regarding the best practice of hosting user content on a separate domain: this has basically two implications: 1. Cookie scope of my own assets (e.g. dashboard), which one should limit in any case and which I'm of course doing. So this is not an issue. 2. Blacklisting, which is what all of this has been about. I did pay the price here. This has nothing to do with security, though.

I'm sorry to be so frank, but you don't know anything about me or my security practices and your claim of negligence is extremely unfounded.

[1] https://github.com/publicsuffix/list/wiki/Guidelines#validat...

Re: Google Safe Browsing incident

#145

Post by ericselin »

rgj wrote: post #136
ericselin wrote: post #130

Earlier quoted context omitted.

Many commenters are implying that there is a security issue here, and that I'm putting everyone in danger. That is quite frankly a pretty absurd claim to just casually make. I'm of course very curious to hear more details on what the security risk here actually would be? Do you think I'm reading/writing sensitive data to/from subdomain-wide cookies? Also, yes, the PSL is a great tool to mitigate (in practice eliminat…

I am not implying you’re putting “everyone” in danger. I’m merely implying that you’re putting your own service in danger by allowing clients to act like a trusted subdomain like controlpanel.statichost.eu, .secure, or Unicode similarities of www.

Ok, I see. You mean the possibility of users impersonating statichost.eu itself. That is actually a good point, and the exact reason why user subdomains are required to have a dash in them. Edit: Also, only ASCII is allowed. :)

I guess control-panel.statichost.eu is still possible, of course, but that already seems like a pretty long shot.

Re: Google Safe Browsing incident

#146

Post by gcr »

jeroenhd wrote: post #100
neon_erosion wrote: post #82

Earlier quoted context omitted.

How does flagging a domain that was actively hosting phishing sites demonstrate that Google has too much power? They do, but this is a terrible example, undermining any point you are trying to make.

The thing about Google is that they regularly get this stuff wrong, and there is no recourse when they do. I think most people working in tech know the extent to which Google can screw over a business when they make a mistake, but the gravity of the situation becomes much clearer when it actually happens to you. This time it's a phishing website, but what if the same happens five years down the line because of an unf…

This article shows an example of this process working as intended though.

The user's site was hosting phishing material. Google showed the site owner what was wrong, provided concrete steps to remedy the situation, and removed the warning within a few hours of being notified that it was resolved.

Google's support sucks in other ways, but this particular example went very smoothly.

Re: Google Safe Browsing incident

#147

Post by dylan604 »

liquid_thyme wrote: post #138
dylan604 wrote: post #62

Earlier quoted context omitted.

why do you assume that the living, breathing human hired by theGoogs will be competent at handling all of the crazy that will be flung at them by the living, breathing human on the other end of the line. One single person cannot handle that. Naturally, you need a team of living, breathing humans. You might even have them in triage level groups like level 1 support, level 2 support and so on where each level is a more…

You really think talking to a human and a bot is the same?

I don't even know what you're asking, or how that's the question you ask from my comment. Clearly, no, I don't think a human and a bot are the same. I'm saying that evilCorp is not going to pay for a human support staff in the year 2025 when the company is pushing it's AI/LLM chatbot as a major part of who they are. If the chatbot company doesn't use its own chatbot, why would anyone else? Of course they are not going to pay for humans.

How does any of that lead to your asking if I think humans === bots?

Re: Google Safe Browsing incident

#148

Post by ericselin »

mkishi wrote: post #69
ericselin wrote: post #29

Earlier quoted context omitted.

You are right, of course. I'm not sure if those of you who disagree with me think that Safe Browsing did its job (which it did!), that Safe Browsing is a good thing (which it maybe is, but which I slightly disagree with), or that it's ok that Google monitors everything everyone does. The last point is actually the one I'm trying to make.

It's hard to get that point because you're conflating two different stories. Folks around here are generally uneasy about tracking in general too, but remove big brother monitoring from Safe Browsing and this story could still be the same: whole domain blacklisted by Google, only due to manual reporting instead. "Oh, but a human reviewer would've known `*.statichost.eu` isn't managed by us"—not in a lot of cases, not…

Sure, and sorry for being so unclear. The point of my post was meant to be a) Google has this enormous cannon, is this "right"? And b) they will use it to kill anything bigger than a mosquito.

But you're right, complaining about big tech surveillance didn't help with making that point at all.

Re: Google Safe Browsing incident

#149

Post by lucb1e »

ericselin wrote: post #89

Since there's a lot of discussion about the Public Suffix list, let me point out that it's not just a webform where you can add any domain. There's a whole approval process where one very important criterion is that the domain to be added has a large enough user base. When you have a large enough user base, you generally have scammers as well. That's what happened here. It basically goes: growing user base -> growing…

What sort of size would be needed to get on there?

My open source project has some daily users, but not thousands. Plenty to attract malicious content, I think a lot of people are sending it to themselves though (like onto a malware analysis VM that is firewalled off and so they look for a public website to do the transfer), but even then the content will be on the site for a few hours. After >10 years of hosting this, someone seems to have fed a page into a virus scanner and now I'm getting blocks left and right with no end in sight. I'd be happy to give every user a unique subdomain instead of short links on the main domain, and then put the root on the PSL, if that's what solves this

Re: Google Safe Browsing incident

#150

Post by liquid_thyme »

dylan604 wrote: post #147
liquid_thyme wrote: post #138

Earlier quoted context omitted.

You really think talking to a human and a bot is the same?

I don't even know what you're asking, or how that's the question you ask from my comment. Clearly, no, I don't think a human and a bot are the same. I'm saying that evilCorp is not going to pay for a human support staff in the year 2025 when the company is pushing it's AI/LLM chatbot as a major part of who they are. If the chatbot company doesn't use its own chatbot, why would anyone else? Of course they are not goin…

That may be, and we certainly don't need anyone explaining Google's position - we already know what that is. Nobody here actually cares what Google wants, we're expressing what we want. Nerds have helped Google enough with free marketing and goodwill, Google's reputation being tarnished can only help us not hurt us.
Post reply on HN