Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thanks HN: Lessons learned after Google nearly killed my site

uploader.win

Post reply on HN
Print view View original

211–220 of 296 posts

Re: Thanks HN: Lessons learned after Google nearly killed my site

#211

Post by sterlind »

scrollaway wrote: post #175
that_guy_iain wrote: post #173

Earlier quoted context omitted.

Google wouldn't know that someone is curling it which their script said everything was ok. While the website was basically down because Chrome and Firefox will both block a site based on Google's safe browsing list. They could use Google's safe browsing api to check if they're on that list as well as curl.

Frankly, Google's Safe Browsing list is one of those things which should be broken out of Google and ran by an independent entity, much like the Let's Encrypt model. I don't know how to help make this happen.

I'd suggest:

1. Mozilla and the Chrome clones (Edge, Brave, etc.) partner to make an (open as possible) standard for blocking and reviewing, and start maintaining their own list upstream from Google.

2. When Google adds to their blocklist, independently check it according to the consortium's own standards.

3. Cut a deal with Bing or Yandex to scan for malware as part of their crawls, to get technology independence.

4. Put pressure on Google to get onboard.

Step 4 is the hardest.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#212

Post by gruez »

teclordphrack2 wrote: post #195
jeffgreco wrote: post #187

Earlier quoted context omitted.

Whose should it be? Why would they be better than Google?

It would be individual users job to police what sites they go to. It would be hosting providers jobs to police the content of their hosters. The person who makes the search engine, and the browser, and the black list should not be one in the same.

>It would be hosting providers jobs to police the content of their hosters.

this breaks down because there are friendly jurisdictions and/or hosting companies to bad actors. see "bulletproof hosting" for instance.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#213

Post by jhugo »

rgj wrote: post #84

Let’s not forget that the site probably was actually hosting malicious content. The problem is not Google blocking the site, that was the right decision. The problem is that Google is hard to reach in cases like this.

I believe it’s deliberate. A human-staffed support desk will be vulnerable to social engineering by fraudsters looking to get their site reactivated. A public list of very specific policies and disclosure of which one was violated will be vulnerable to engineering too, by making sites that are fraudulent/deceptive/harmful yet somehow fall between those specific policies.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#216

Post by thayne »

So... The proposed mitigation is to use multiple top-level domains. At the same time, third party cookies probably won't be around much longer and already don't work for some browsers, so if you want to share state between pages, you need them to be on the same domain (but can be subdomains). There is no winning scenario here.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#217

Post by thayne »

rossdavidh wrote: post #179

So, clearly Google has too much power over the internet, it's arbitrary and opaque, etc. I agree. However, I think it is worth pointing out that: 1) malware is often very aggressive and fast-spreading, and once it's on a user's computer it's hard to get off, therefore... 2) the system to detect it and stop access to the site has to be automated, not a human-in-the-loop system that might take hours or days to shut off…

Surely there is a better way to address malicious content than blocking the entire domain.

It also doesn't seem like sites like Facebook, Reddit, Youtube, Google photos, etc. run into this problem, even though they allow user uploaded content so there is some kind of bias against smaller companies.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#218

Post by yellowapple »

ambivalence wrote: post #207
kortilla wrote: post #189

Earlier quoted context omitted.

And how helpful is that when they can stop card access? That seems like a perfect example of a regulation that ended up being almost entirely useless.

What's up with the loaded rhetoric? You can still do most things without card access: - keep standing orders flowing; - transfer your money out through the mobile app or website; - withdraw money from an ATM using an authenticator (nation-wide example in Poland: https://www.blik.com/); - if push comes to shove, go to a branch and withdraw your money in person.

> What's up with the loaded rhetoric?

How is that rhetoric loaded? What rhetoric?

> if push comes to shove, go to a branch and withdraw your money in person.

When I was starting out in my IT career, the nearest branch of my credit union was more than an hour away by car, and for much of that time I didn't even have a car. If my credit union had restricted my account to "thou must visiteth a branch and speaketh with a representative", I would've been screwed - on a level of "freezing and starving".

> transfer your money out through the mobile app or website;

Assuming this wouldn't be one of the first things shut off alongside the card.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#219

Post by yellowapple »

teclordphrack2 wrote: post #197
ttt0 wrote: post #18

They can remove your YouTube account, app, entire Google account or even your website at any time and you can only make guesses why did that happen, because they always make the rules really vague and it's never clear what is or is not allowed. And even when they do admit the mistake and get you back up, they still won't explain anything and nothing is ever fixed. Thank you Google, very cool.

The reason it is made vague is because there are people who will set their site up so it technically passes the rules but it certainly does not pass the spirit of what was trying to be done by the rules. By making it opaque they do get to cast a wider net and keep those a$$hats from harming others but they certainly catch other fish with that net.

> there are people who will set their site up so it technically passes the rules but it certainly does not pass the spirit of what was trying to be done by the rules.

Then that's a problem with the rules, which need clarified to better encode the "spirit" thereof. Hiding the rules entirely is a poor substitute for that.

Re: Thanks HN: Lessons learned after Google nearly killed my site

#220

Post by A12-B »

teclordphrack2 wrote: post #195
jeffgreco wrote: post #187

Earlier quoted context omitted.

Whose should it be? Why would they be better than Google?

It would be individual users job to police what sites they go to. It would be hosting providers jobs to police the content of their hosters. The person who makes the search engine, and the browser, and the black list should not be one in the same.

Do you know how many sites would be absolute minefields without google? They incentivise websites to commit to some clean standard so that the 'individual user' doesn't have to run a script every time they visit a website to make sure it's clean. And guess what: whatever script they run will just end up becoming a different google anyway.

Embrace the centralization.

Post reply on HN