Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google flags Immich sites as dangerous

immich.app

Post reply on HN
Print view View original

261–270 of 713 posts

Re: Google flags Immich sites as dangerous

#261

Post by fc417fc802 »

arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

How does the PSL make any sense? What stops an attacker from offering free static hosting and then making use of their own service?

I appreciate the issue it tries to solve but it doesn't seem like a sane solution to me.

Re: Google flags Immich sites as dangerous

#262

Post by sofixa »

gmueckl wrote: post #109
lukan wrote: post #93

Earlier quoted context omitted.

"You could take about 90% of that out and into dedicated tools " But then you would loose plattform independency, the main selling point of this atrocity. Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted. The best thing to happen, that I can see, is that a sane subset crystalizes, that people start to…

But do we need e.g serial port or raw USB access straight from a random website? Even WebRTC is a bit of a stretch. There is a lot of cruft in modern browsers that does little except increase attack surface. This all just drives a need to come up with ever more tacked-on protection schemes because browsers have big targets painted on them.

> Even WebRTC is a bit of a stretch

You remove that, and videoconferencing (for business or person to person) has to rely on downloading an app, meaning whoever is behind the website has to release for 10-15 OSes now. Some already do, but not everyone has that budget so now there's a massive moat around it.

> But do we need e.g serial port or raw USB access straight from a random website

Being able to flash an IoT (e.g. ESP32) device from the browser is useful for a lot of people. For the "normies", there was also Stadia allowing you to flash their controller to be a generic Bluetooth/usb one on a website, using that webUSB. Without it Google would have had to release an app for multiple OSes, or more likely, would have just left the devices as paperweights. Also, you can use FIDO/U2F keys directly now, which is pretty good.

Browsers are the modern Excel, people complain that they do too much and you only need 20%. But it's a different 20% for everyone.

Re: Google flags Immich sites as dangerous

#263

Post by josfredo »

crazygringo wrote: post #82
jdsully wrote: post #54

The one thing I never understood about these warnings is how they don't run afoul of libel laws. They are directly calling you a scammer and "attacker". The same for Microsoft with their unknown executables. They used to be more generic saying "We don't know if its safe" but now they are quite assertive at stating you are indeed an attacker.

> They are directly calling you a scammer and "attacker". No they're not. The word "scammer" does not appear. They're saying attackers on the site and they use the word "might". This includes third-party hackers who have compromised the site. They never say the owner of the site is the attacker. I'm quite sure their lawyers have vetted the language very carefully.

You can’t possibly use the “they use the word ‘might’” argument and not mention the death red screen those words are printed over. If you are referring to abidance to the law, you are technically right. If we remove the human factor, you technically are.

Re: Google flags Immich sites as dangerous

#264

Post by sofixa »

smaudet wrote: post #112
lukan wrote: post #93

Earlier quoted context omitted.

"You could take about 90% of that out and into dedicated tools " But then you would loose plattform independency, the main selling point of this atrocity. Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted. The best thing to happen, that I can see, is that a sane subset crystalizes, that people start to…

> Having all those APIs in a sandbox that mostly just work on billion devices is pretty powerful and a potential succesor to HTML would have to beat that, to be adopted. I think the giant major downside, is that they've written a rootkit that runs on everything, and to try to make up for that they want to make it so only sites they allow can run. It's not really very powerful at all if nobody can use it, at that poin…

> to try to make up for that they want to make it so only sites they allow can run

What do you mean, you can run whatever you want on localhost, and it's quite easy to host whatever you want for whoever you want too. Maybe the biggest modern added barrier to entry is that having TLS is strongly encouraged/even needed for some things, but this is an easily solved problem.

Re: Google flags Immich sites as dangerous

#265

Post by darkwater »

david_van_loon wrote: post #85

I'm fighting this right now on my own domain. Google marked my family Immich instance as dangerous, essentially blocking access from Chrome to all services hosted on the same domain. I know that I can bypass the warning, but the photo album I sent to my mother-in-law is now effectively inaccessible.

Out of curiosity, is your Immich instance published as https://immich.example.com ?

Re: Google flags Immich sites as dangerous

#267

Post by magackame »

gmueckl wrote: post #217
Kim_Bruning wrote: post #139

Earlier quoted context omitted.

Are you saying we should make a A large set of really simple tools that each do one thing really really really pedantically well? This might be what's needed to break out of the current local optimum.

I haven't thought of it that way, but that might be a solution.

There was an attempt in that direction.

https://www.uzbl.org/

Re: Google flags Immich sites as dangerous

#268

Post by Deestan »

close04 wrote: post #254
samplatt wrote: post #204

Earlier quoted context omitted.

My work's email filter regularly flags links to JIRA and github as dangerous. It stopped being even ironically amusing after a while.

Microsoft's own Outlook.com flags Windows Insider emails coming from a .microsoft.com domain as junk even after marking the domain as "no junk". They know themselves well.

Frequent frustration past week for me:

The integrated button to join a Microsoft Teams meeting directly from my Microsoft Outlook Calendar doesn't work because Microsoft needs to scan the link from Microsoft to Microsoft for malware before proceeding, and the malware scanning service has temporary downtime and serves me static page saying "The content you are accessing cannot currently be verified".

Re: Google flags Immich sites as dangerous

#269

Post by sofixa »

nemothekid wrote: post #98
NelsonMinar wrote: post #6

Be sure to see the team's whole list of Cursed Knowledge. https://immich.app/cursed-knowledge

Some of these seem less cursed, and more just security design? > Some phones will silently strip GPS data from images when apps without location permission try to access them. That strikes me as the right thing to do?

> That strikes me as the right thing to do

Yep, and it's there for very goos reasons. However if you don't know about it, it can be quite surprising and challenging to debug.

Also it's annoying when your phones permissions optimiser runs and removes the location permissions from e.g. Google Photos, and you realise a few months later that your photos no longer have their location.

Re: Google flags Immich sites as dangerous

#270

Post by sofixa »

einpoklum wrote: post #232
ZenoArrow wrote: post #191

Earlier quoted context omitted.

Firefox should be on that list. It's clearly a lot closer in functionality to Chrome/Chromium than Servo or Ladybird, so it's easier to switch to it. I like that Servo and Ladybird exist and are developing well, but there's no need to pretend that they're the only available alternatives.

If you knew how the Mozilla corporation was governed, then you would not think that Firefox should be on the list.

How is it governed?
Post reply on HN