Google Safe Browsing incident • Hacker News Board

Re: Google Safe Browsing incident

#31

Post by wahnfrieden » Fri, Oct 10, 2025, 2:01 PM UTC

jacquesm wrote: post #4

duxup wrote: post #2

It feels like unless you're one of the big social media companies, accepting user content is slowly becoming a larger and larger risk.

It always was. You're one upload and a complaint to your ISP/Google/AWS/MS away from having your account terminated.

Any services successfully offloading UGC to other moderated platforms? E.g. developer tools relying on GitHub instead of storing source/assets in the service itself, and Microsoft can take care of most moderation needs. But are there consumer apps that do things like this?

Re: Google Safe Browsing incident

#32

Post by ericselin » Fri, Oct 10, 2025, 2:01 PM UTC

thehyperflux wrote: post #27

Google services simply behaved the way I would expect them to here. Who knows... they may even have saved some users from coming to harm.

That is a great point. When I see these sites I'm always seeing a dozen red flags, and maybe the biggest one is that it's showing a "NatWest" banking site or something and is hosted on "portal-abc.statichost.eu". But the whole point is of course saving users from coming to harm, and if it did - great!

Re: Google Safe Browsing incident

#33

Post by johnwheeler » Fri, Oct 10, 2025, 2:02 PM UTC

Seems like a reasonable trade-off I mean six hours is not the worst thing in the world. What if you were hosting mission-critical such as such? Were you?

Re: Google Safe Browsing incident

#34

Post by freehorse » Fri, Oct 10, 2025, 2:02 PM UTC

veeti wrote: post #20

It can happen to anyone and cause a reputational risk. Once upon a time $workplace had a Zoho Form that would be blacklisted by Google Safe Browsing or Microsoft Edge for arbitrary periods of time, presumably because someone used Zoho to make a phishing site, leading to some very confused calls.

Sounds a very convenient mistake to do on your competitors? It does not sound believable that they would not know what zoho was or that it makes no sense to flag all the zoho domain.

Re: Google Safe Browsing incident

#35

Post by oefrha » Fri, Oct 10, 2025, 2:03 PM UTC

Honestly, this is extremely basic stuff in hosting, not only due to safe browsing, but also—and more importantly—cookie safety, etc. If a hosting provider didn’t know (already bad enough) and turn to whining after being hit, then

> Static site hosting you can trust

is more like amateur hour static site hosting you can’t trust. Sorry.

Re: Google Safe Browsing incident

#36

Post by fukka42 » Fri, Oct 10, 2025, 2:04 PM UTC

acoustics wrote: post #9

fukka42 wrote: post #3

Still not sure why it's legal for Google to slander companies like this. They often have no proof or it's a false positive, meanwhile they're screaming about how malicious you are.

Notably this post did not examine whether any of the sites it was hosting on this domain was malicious/misleading.

I'm not asking about this specific case. There are plenty of examples of Google wrongly accusing others of being malicious with massive business impact

Re: Google Safe Browsing incident

#37

Post by freehorse » Fri, Oct 10, 2025, 2:04 PM UTC

progbits wrote: post #7

Hosts phishing sites, gets blocked by anti phishing mechanism. Works as expected from my point of view. Get yourself on public suffix list or get better moderation. But of course just moaning about bad google is easier.

You are right, but then again, nobody flags facebook because of the scamming taking place in some facebook pages.

Re: Google Safe Browsing incident

#38

Post by jacquesm » Fri, Oct 10, 2025, 2:05 PM UTC

fukka42 wrote: post #30

jacquesm wrote: post #5

Earlier quoted context omitted.

Because Google has absolutely nothing to lose and you do, besides that they can outlast anybody except for nation states in court.

How does this answer the question of legality?

Questions of legality are answered by a judge, not by a forum

Re: Google Safe Browsing incident

#39

Post by pixl97 » Fri, Oct 10, 2025, 2:06 PM UTC

blenderob wrote: post #18

jacquesm wrote: post #4

Earlier quoted context omitted.

It always was. You're one upload and a complaint to your ISP/Google/AWS/MS away from having your account terminated.

But something has definitely changed over the past few years. Back in the days, it felt completely normal for individuals to spin up and run their own forums. Small communities built and maintained by regular people. How many new truly independent, individual-run forums can you name today? Hardly any. Instead we keep hearing about long-time community sites shutting down because individuals can no longer handle the ri…

>How many new truly independent, individual-run forums can you name today?

Almost none, but it's due to a lot of complicated factors and not just the direct risk of user content.

Take moderation of content that won't get you banned by your ISP. It sucks. Nobody in their right mind would want to do it. There are countless bots and trolls that are going to flood your forums for whatever cause they champion.

Then there is DDOS floods because you pissed off said bots and trolls. This can make the forums unaffordable and piss off your ISP.

But even if nothing goes wrong, popularity is a risk in itself. In the past there was stuff like the Slashdot effect where your site would go down for a while. But now if your small site became popular on tiktok for some reason 20 million people could show up. Even if your site can stand up to that, how will you moderate it? How will you pay for the bandwidth?

Oh, and will you get any advertisers because of said user content? How are you going to pay for the site?

Oh, also you're competing with massive sites for eyeballs, how are you going to get actual users?

Re: Google Safe Browsing incident

#40

Post by ericselin » Fri, Oct 10, 2025, 2:06 PM UTC

kijin wrote: post #22

It's also good from a security perspective. Anyone who can upload HTML pages to subdomain.domain.com can read and write cookies for *.domain.com, unless you declare yourself a public suffix and enough time has passed for all the major browsers to have updated themselves. I've seen web hosts in the wild who could have their control panel sessions trivially stolen by any customer site. Reported the problem to two diffe…

(Author here) This is all true. The main assumption from my part is that anything remotely important or even sensitive should be and is hosted on a domain that is _not_ companysubdomain.domain.com but instead www.company.com.