Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google flags Immich sites as dangerous

immich.app

Post reply on HN
Print view View original

221–230 of 713 posts

Re: Google flags Immich sites as dangerous

#221

Post by typpilol »

samplatt wrote: post #204
theendisney wrote: post #185

Earlier quoted context omitted.

The same outfit is runimg a domain called blogger. Reminds me of MS blocking a website of mine for dangerous script . The offending thing i did was use document.write to put copyright 2025 (with the current year) at the end of static pages.

My work's email filter regularly flags links to JIRA and github as dangerous. It stopped being even ironically amusing after a while.

I feel like the GitHub one might be okay since a lot of malware binaries are hosted there still.

Re: Google flags Immich sites as dangerous

#222

Post by jeroenhd »

david_van_loon wrote: post #86
Animats wrote: post #7

If you block those internal subdomains from search with robots.txt, does Google still whine?

Yes, my family Immich instance is blocked from indexing both via headers and robots.txt, yet it's still flagged by Google as dangerous.

I'm kind of curious, do you have your own domain for immich or is this part of a malware-flagged subdomain issue? It's kind of wild to me that Google would flag all instances of a particular piece of self-hosted software as malicious.

Re: Google flags Immich sites as dangerous

#224

Post by _cenw »

nemothekid wrote: post #95
Zak wrote: post #89

Earlier quoted context omitted.

The underlying question is how are people supposed to know about this before they have a big problem ?

[flagged]

Nothing in this article indicates UGC is the problem. It's that Google thinks there's an "official" central immich and these instances are impersonating it.

What malicious UGC would you even deliver over this domain? An image with scam instructiins? CSAM isn't even in scope for Safe Browsing, just phishing and malware.

Re: Google flags Immich sites as dangerous

#225

Post by donmcronald »

acoustics wrote: post #151
jdsully wrote: post #54

The one thing I never understood about these warnings is how they don't run afoul of libel laws. They are directly calling you a scammer and "attacker". The same for Microsoft with their unknown executables. They used to be more generic saying "We don't know if its safe" but now they are quite assertive at stating you are indeed an attacker.

This is tricky to get right. If the false positive rate is consistently 0.0%, that is a surefire sign that the detector is not effective enough to be useful. If a false positive is libel, then any useful malware detector would occasionally do libel. Since libel carries enormous financial consequences, nobody would make a useful malware detector. I am skeptical that changing the wording in the warning resolves the fun…

The problem is that it's so one sided. They do what they want with no effort to avoid collateral damage and there's nothing we can do about it.

They could at least send a warning email to the RFC2142 abuse@ or hostmaster@ address with a warning and some instructions on a process for having the mistake reviewed.

Re: Google flags Immich sites as dangerous

#226

Post by heavyset_go »

jdsully wrote: post #54

The one thing I never understood about these warnings is how they don't run afoul of libel laws. They are directly calling you a scammer and "attacker". The same for Microsoft with their unknown executables. They used to be more generic saying "We don't know if its safe" but now they are quite assertive at stating you are indeed an attacker.

Imagine if you bought a plate at Walmart and any time you put food you bought elsewhere on it, it turned red and started playing a warning about how that food will probably kill you because it wasn't Certified Walmart Fresh™

Now imagine it goes one step further, and when you go to eat the food anyway, your Walmart fork retracts into its handle for your safety, of course.

No brand or food supplier would put up with it.

That's what it's like trying to visit or run non-blessed websites and software coming from Google, Microsoft, etc on your own hardware that you "own".

Re: Google flags Immich sites as dangerous

#228

Post by KronisLV »

0xbadcafebee wrote: post #65
arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

In the past, browsers used an algorithm which only denied setting wide-ranging cookies for top-level domains with no dots (e.g. com or org). However, this did not work for top-level domains where only third-level registrations are allowed (e.g. co.uk). In these cases, websites could set a cookie for .co.uk which would be passed onto every website registered under co.uk. Since there was and remains no algorithmic meth…

> Since there was and remains no algorithmic method of finding the highest level at which a domain may be registered for a particular top-level domain

A centralized list like this not just for domains as a whole (e.g. co.uk) but also specific sites (e.g. s3-object-lambda.eu-west-1.amazonaws.com) is both kind of crazy in that the list will bloat a lot over the years, as well as a security risk for any platform that needs this functionality but would prefer not to leak any details publicly.

We already have the concept of a .well-known directory that you can use, when talking to a specific site. Similarly, we know how you can nest subdomains, like c.b.a.x, and it's more or less certain that you can't create a subdomain b without the involvement of a, so it should be possible to walk the chain.

Example:

  c --> https://b.a.x/.well-known/public-suffix
  b --> https://a.x/.well-known/public-suffix
  a --> https://x/.well-known/public-suffix
Maybe ship the domains with the browsers and such and leave generic sites like AWS or whatever to describe things themselves. Hell, maybe that could also have been a TXT record in DNS as well.

Re: Google flags Immich sites as dangerous

#229

Post by dizlexic »

Ran a clickbait site, and got flagged for using a bunch of 302 redirects instead of 301s. Went from almost 500k uniques a month to 1k.

During the appeal it was reviewed from India, and I had been using geoblocking. This caused my appeal to be denied.

I ended up deploying to a new domain and starting over.

Never caught back up.

Re: Google flags Immich sites as dangerous

#230

Post by citrin_ru »

pkulak wrote: post #178
Jackson__ wrote: post #174

If there are any googlers here, I'd like to report an even more dangerous website. As much as 30-50% of the traffic to it relates to malware or scams, and it has gone unpunished for a very long time. The address appears to be adsense.google.com.

sites.google.com

sites.google.com is widely abused but so practically any site which allows users to host content of their choice and make it publicly available. Where google can be different is that they famously refuse yo do work which they cannot automate and probably they cannot (or don’t want) to automate detection/blocking of spam/phishing hosted on sites.google.com and processing of abuse reports.
Post reply on HN