Google flags Immich sites as dangerous • Hacker News Board

Re: Google flags Immich sites as dangerous

#191

Post by ZenoArrow » Thu, Oct 23, 2025, 6:01 AM UTC

pkulak wrote: post #171

callc wrote: post #159

Us nerds *really* need to come together in creating a publicly owned browser (non chromium) Surely among us devs, as we realize app stores increasingly hostile, that the open web is worth fighting for, and that we have the numbers to build solutions?

Uh… we are. Servo and Ladybird. It’s a shit tonne of work.

Firefox should be on that list. It's clearly a lot closer in functionality to Chrome/Chromium than Servo or Ladybird, so it's easier to switch to it. I like that Servo and Ladybird exist and are developing well, but there's no need to pretend that they're the only available alternatives.

Re: Google flags Immich sites as dangerous

#192

Post by nicce » Thu, Oct 23, 2025, 6:01 AM UTC

akerl_ wrote: post #63

TheDong wrote: post #51

Earlier quoted context omitted.

It's open source, you can find this trivially yourself in less than a minute. https://github.com/immich-app/devtools/tree/a9257b33b5fb2d30...

Wow. What a rude way to answer.

Sometimes it is also rude to ask without looking the obvious place themselves. It is about signaling that ”my” time is more precious than ”your” time so I let them do that check for me, if I can use someone elses time.

Re: Google flags Immich sites as dangerous

#193

Post by nalekberov » Thu, Oct 23, 2025, 6:03 AM UTC

First thing I do when I start to use a browser for the first time is making sure 'Google Safe Browsing' feature is disabled. I don't need yet another annoyance while I browse the web, especially when it's from Google.

Re: Google flags Immich sites as dangerous

#194

Post by 0xedd » Thu, Oct 23, 2025, 6:03 AM UTC

zackify wrote: post #133

The open internet is done. Monopolies control everything. We have an iOS app in the store for 3 years and out of the blue apple is demanding we provide new licenses that don’t exist and threaten to kick our app out. Nothing changed in 3 years. Getting sick of these companies able to have this level of control over everything, you can’t even self host anymore apparently.

[dead]

Re: Google flags Immich sites as dangerous

#195

Post by MrDresden » Thu, Oct 23, 2025, 6:04 AM UTC

eco wrote: post #105

NelsonMinar wrote: post #6

Be sure to see the team's whole list of Cursed Knowledge. https://immich.app/cursed-knowledge

This kind of makes we wish CURSED.md was a standard file in projects. So much hard-earned knowledge could be shared.

You know you can just start doing that in your projects. That's how practice often becomes standard.

Re: Google flags Immich sites as dangerous

#196

Post by lucideer » Thu, Oct 23, 2025, 6:04 AM UTC

smaudet wrote: post #103

thayne wrote: post #96

Earlier quoted context omitted.

Looking through some of the links in this post, I there are actually two separate issues here: 1. Immich hosts user content on their domain. And should thus be on the public suffic list. 2. When users host an open source self hosted project like immich, jellyfin, etc. on their own domain it gets flagged as phishing because it looks an awful lot like the publicly hosted version, but it's on a different domain, and pos…

I don't think the Internet should be run by being on special lists (other than like, a globally run registry of domain names)... I get that SPAM, etc., are an issue, but, like f* google-chrome, I want to browse the web, not some carefully curated list of sites some giant tech company has chosen. A) you shouldn't be using google-chrome at all B) Firefox should definitely not be using that list either C) if you are goi…

> I don't think the Internet should be run by being on special lists

People are reacting as if this list is some kind of overbearing way of tracking what people do on the web - it's almost the opposite of that. It's worth clarifying this is just a suffix list for user-hosted content. It's neither a list of user-hosted domains nor a list of safe websites generally - it's just suffixes for a very small specific use-case: a company providing subdomains. You can think of this as a registry of domain sub-letters.

For instance:

- GitHub.io is on the list but GitHub.com is not - GitHub.com is still considered safe

- I self-host an immich instance on my own domain name - my immich instance isn't flagged & I don't need to add anything to the list because I fully own the domain.

The specific instance is just for Immich themselves who fully own "immich.cloud" but sublet subdomains under it to users.

> *if you are going to have a "safe sites" list"

This is not a safe sites list! This is not even a sites list at all - suffixes are not sites. This also isn't even a "safe" list - in fact it's really a "dangerous" list for browsers & various tooling to effectively segregate security & privacy contexts.

Google is flagging the Immich domain not because it's missing from the safe list but because it has legitimate dangers & it's missing from the dangerous list that informs web clients of said dangers so they can handle them appropriately.

Re: Google flags Immich sites as dangerous

#197

Post by bitwize » Thu, Oct 23, 2025, 6:05 AM UTC

[flagged]

Re: Google flags Immich sites as dangerous

#198

Post by udev4096 » Thu, Oct 23, 2025, 6:06 AM UTC

bitpush wrote: post #57

LennyHenrysNuts wrote: post #55

Earlier quoted context omitted.

The root cause is bad behaviour by google. This is merely a workaround.

[flagged]

[flagged]

Re: Google flags Immich sites as dangerous

#199

Post by realusername » Thu, Oct 23, 2025, 6:06 AM UTC

bitpush wrote: post #57

LennyHenrysNuts wrote: post #55

Earlier quoted context omitted.

The root cause is bad behaviour by google. This is merely a workaround.

[flagged]

The argument would work better if Google wasn't the #1 distributor of scams and malware in the world with adsense. (Which strangely isn't flagged by safe browsing, maybe a coincidence)

Re: Google flags Immich sites as dangerous

#200

Post by donmcronald » Thu, Oct 23, 2025, 6:09 AM UTC

beala wrote: post #34

donmcronald wrote: post #22

Earlier quoted context omitted.

I'm almost positive GMail scanning messages is one cause. My domain got put on the list for a URL that would have been unknowable to anyone but GMail and my sister who I invited to a shared Immich album. It was a URL like this that got emailed directly to 1 person: https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xx... Then suddenly the domain is banned even though there was never a way to discover that URL…

It doesn’t seem like email scanning is necessary to explain this. It appears that simply having a “bad” subdomain can trigger this. Obviously this heuristic isn’t working well, but you can see the naive logic of it: anything with the subdomain “apple” might be trying to impersonate Apple, so let’s flag it. This has happened to me on internal domains on my home network that I've exposed to no one. This also has been r…

In my case though, the Google Search Console explicitly listed the exact URL for a newly created shared folder as the cause.

https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xx...

That's not going to be gleaned from a CT log or guessed randomly. The URL was only transmitted once to one person via e-mail. The sending was done via MXRoute and the recipient was using GMail (legacy Workspace).

The only possible way for Google to have gotten that URL to start the process would have been by scanning the recipient's e-mail.