Google Safe Browsing incident

Post by mh- » Sat, Oct 11, 2025, 3:16 AM UTC

lucb1e wrote: post #149

ericselin wrote: post #89

Since there's a lot of discussion about the Public Suffix list, let me point out that it's not just a webform where you can add any domain. There's a whole approval process where one very important criterion is that the domain to be added has a large enough user base. When you have a large enough user base, you generally have scammers as well. That's what happened here. It basically goes: growing user base -> growing…

What sort of size would be needed to get on there? My open source project has some daily users, but not thousands. Plenty to attract malicious content, I think a lot of people are sending it to themselves though (like onto a malware analysis VM that is firewalled off and so they look for a public website to do the transfer), but even then the content will be on the site for a few hours. After >10 years of hosting thi…

Post by faust201 » Sat, Oct 11, 2025, 5:00 AM UTC

ericselin wrote: post #57

stickfigure wrote: post #47

Earlier quoted context omitted.

"Google does good thing, therefore Google has too much power over the internet" is not a convincing point to make. This safety feature saves a nontrivial number of people from life-changing mistakes. Yes we publishers have to take extra care. Hard to see a negative here.

I respectfully disagree with your premise. In this specific case, yes, "Google does good thing" in a sense. That is not why I'm saying Google has too much power. "Too much" is relative and whether they do good or bad debatable, of course, but it's hard to argue that they don't have a gigantic influence on the whole internet, no? :) Helping people avoid potentially devastating mistakes is of course a good thing.

Post by petepete » Sat, Oct 11, 2025, 8:54 AM UTC

fukka42 wrote: post #3

Still not sure why it's legal for Google to slander companies like this. They often have no proof or it's a false positive, meanwhile they're screaming about how malicious you are.

Post by schoen » Sat, Oct 11, 2025, 9:13 AM UTC

KronisLV wrote: post #166

SquareWheel wrote: post #14

It's generally good advice, but I don't see that Safe Browsing did anything wrong in this case. First, it sounds like they actually were briefly hosting phishing sites: > All sites on statichost.eu get a SITE-NAME.statichost.eu domain, and during the weekend there was an influx of phishing sites. Second, they should be using the public suffix list ( https://publicsuffix.org/ ) to avoid having their entire domain tagg…

> Second, they should be using the public suffix list ( https://publicsuffix.org/ ) to avoid having their entire domain tagged. How else is Google supposed to know that subdomains belong to different users? That's what the PSL is for. How is this kinda not insane? https://publicsuffix.org/list/public_suffix_list.dat A centralized list, where you have to apply to be included and it's up to someone else to decide wheth…

Post by [deleted] » Sat, Oct 11, 2025, 12:46 PM UTC

ericselin wrote: post #105

zamadatix wrote: post #96

Earlier quoted context omitted.

Where'd you see/hear that? It hasn't been my experience at least - but maybe I've just been lucky or undercounting the sites. There are required steps to follow but none are "have x users" or "see a lot of spam". It's mostly "follow proper DNS steps and guidelines in the given format" with a little "show you're doing this for the intended reason rather than to circumvent something the PSL is not meant for/for somethi…

https://github.com/publicsuffix/list/wiki/Guidelines#validat... "Projects that are smaller in scale or are temporary or seasonal in nature will likely be declined. Examples of this might be private-use, sandbox, test, lab, beta, or other exploratory nature changes or requests. It should be expected that despite whatever site or service referred a requestor to seek addition of their domain(s) to the list, projects not…