Google Safe Browsing can kill a startup • Hacker News Board

Re: Google Safe Browsing can kill a startup

#301

Post by xmprt » Sat, Jan 16, 2021, 8:14 PM UTC

zerkten wrote: post #230

londons_explore wrote: post #218

Earlier quoted context omitted.

The hashes of all things that match a "probably evil" bloom filter, yes. Hosting a virus on a domain and then downloading it a few times with different chrome installations sounds like a good way to get the whole domain blacklisted...

That's why user uploads are worth some thought and consideration. File uploads normally gets treated as a nuisance by developers because it can become kind of fiddly even when it works and you are getting file upload bugs from support. It normally isn't that much of a challenge to mitigate the issues, but other things get priorities. Companies end up leaving pivots to XSS attacks and similar bugs too.

Google has a great service for this called Checksum. You upload a file checksum and it validates it against the database of all known bad checksums that might flag your website as unsafe. The pricing is pretty reasonable too and you can proxy file uploads through their service directly.

I'm actually not telling the truth but at what point did you realize that? And what would be the implications if Google actually did release a service like this? It feels a bit like racketeering.

Re: Google Safe Browsing can kill a startup

#302

Post by tialaramex » Sat, Jan 16, 2021, 8:20 PM UTC

rcoveson wrote: post #156

TazeTSchnitzel wrote: post #25

Earlier quoted context omitted.

There's a very obvious reason not to do that: if you apparently maliciously cry wolf a few times, people won't trust your cries any more, and, for example, other browsers might choose to stop using the Google Safe Browsing list.

No, I don't think that's how it would play out. 1. Google bans parler.com on Jan. 8th by adding it as an "unsafe URL" to their blacklist. 2. Mozilla issues statement: "While we don't believe it was prudent to use the Safe Browsing blacklist for this purpose, given recent events, we will not be unblocking parler.com, and do not currently deem it necessary to maintain a separate safe browsing list." 3. Something simila…

I guess just entirely inventing the slope and start points as well as a predicted trajectory is a new achievement in "slippery slope" arguments. Congratulations.

More seriously, maybe invent imaginary third parties rather than arbitrarily assigning your imagined bad motives and awful consequences to real people who did none of what you've suggested?

Google could, if they wanted, just add a new category to Safe Browsing. They could call it "Arbitrary censorship" or "Nazis are bad" or whatever you want. There are already several categories which even use slightly different parameters for the core technology so this wouldn't substantially change the system and yet would add much more flexibility if you wanted (as you might well) to protect against Phishing whether from Nazis or not, while still visiting a popular web site organising the overthrow of American democracy.

Re: Google Safe Browsing can kill a startup

#303

Post by Triv888 » Sat, Jan 16, 2021, 8:20 PM UTC

1vuio0pswjnm7 wrote: post #298

Triv888 wrote: post #167

Most of Google's "safety" features are somewhat evil in some way. I don't want any of them, but some of them can't be disabled (like the one that can lock you out of your account even if you have the correct password).

Which one is that.

Sometime Google doesn't recognize your device and then your password is not enough... even if you have second-factor authentication disabled. So if you don't have a second form of contact like another phone number or another email for recovery, then you are fucked. Sometime they even ask you for a previous password for recovery, so if you use a password manager that doesn't keep history, you might also be fucked.

Re: Google Safe Browsing can kill a startup

#304

Post by gilrain » Sat, Jan 16, 2021, 8:20 PM UTC

rossjudson wrote: post #196

freedomben wrote: post #20

After years of seeing developments like this, getting worse and worse, it fills me with rage to think about how clearly nobody in power at Google cares. I naively used to think, "they probably don't realize what's happening and will fix it." I always try to give benefit of the doubt, especially having been on the other side so many times and seeing how 9 times out of 10 it's not malice, just incompetence, apathy, or…

Following "Consider Google as a malicious actor/threat" with "I am not saying Google is acting with malice" is probably a strong indicator that you should have thought it through before posting it.

"Consider as" does not mean "is". Your lack of reading comprehension is not the fault of the poster.

Re: Google Safe Browsing can kill a startup

#305

Post by Isinlor » Sat, Jan 16, 2021, 8:20 PM UTC

echopom wrote: post #290

Isinlor wrote: post #249

Earlier quoted context omitted.

I'm not a US citizen, but just 5 min of scanning US laws makes me think that there are basis for a lawsuit. Essential facilities doctrine seems to be appropriate: https://en.wikipedia.org/wiki/Essential_facilities_doctrine

Google has already been condemned by UE for this type of issue for 150M. That's literally nothing , at least not enough to hit their wallet. This type of battle take months if not years in court and cost millions of dollars. Google products can be shipped and removed in a few weeks , far beyond the reach of operation of the current judiciary system. Today the problem is GHS , tomorrow it'll be "GSuite Safe Account" o…

EU is working on addressing these issues. They specifically want to label companies like Google as "gatekeepers" in The Digital Markets Act.

From: https://www.pinsentmasons.com/out-law/news/gatekeepers-face-...

> In case of violations, the new law would provide for fines of up to 10% of a gatekeeper's total global turnover. Lasseur said: "The fines are high, but they correspond to the usual sanction regime for violations of European competition law."

> In the event of a repeated offence, following a detailed market investigation by the Commission, the company could even be broken if the Commission finds that there is no effective alternative to ensure that the gatekeeper obligations are complied with.

The fines will no longer be just a cost of doing business, but an existential threat. It may take 10 or 15 years in courts but EU will break down likes of Google for repeated offenses even if the relevant products will no longer exist.

Re: Google Safe Browsing can kill a startup

#306

Post by ReptileMan » Sat, Jan 16, 2021, 8:21 PM UTC

nojvek wrote: post #264

ethbr0 wrote: post #247

Earlier quoted context omitted.

> Google's desire for scale, scale, scale, meant that interactions must be handled through The Algorithms That's fine when you're a plucky growth startup. Less fine when you run half the internet. If Google doesn't want to admit it's a mature business and pivot into margin-eating, but risk-reducing support staffing, then okay: break it back up into enough startup-sized chunks that the response failure of one isn't an…

I agree. Google is such a large behemoth who actively tries to avoid customer support if they can. Splitting it to smaller business with a bit of autonomy and not having to rely on ad money fueling everything else means those smaller businesses have to give a shit about customers and compete on even ground. Same applies to Facebook and other tech companies. The root issue is taking huge profits from area of business…

And as long as the internet giants are on the correct side of the culture war there will be scant appetite for breaking them up or reigning them in. As long as you need 5 phone calls to silence someone and erase them from the online, there is no chance in hell that the government will try to break them up.

Re: Google Safe Browsing can kill a startup

#307

Post by wott » Sat, Jan 16, 2021, 8:26 PM UTC

erikpukinskis wrote: post #257

thaumasiotes wrote: post #252

Earlier quoted context omitted.

> It simply lumbers forward, doing its thing. It is to be modeled as a threat not because it is malign, but because it doesn't notice you exist as it takes another step forward. This is a concept that I think deserves more popular currency. Every so often, you step on a snail. People actually hate doing this, because it's gross, and they will actively seek to avoid it. But that doesn't always work, and the fact that…

I'm curious if whales more dangerous on an hour-by-hour basis than driving? That's generally my rubric for whether a safety concern is possibly worth avoiding an activity over.

> I'm curious if whales more dangerous on an hour-by-hour basis than driving?

It depends on how many passengers you pack in a whale.

Re: Google Safe Browsing can kill a startup

#308

Post by kevingadd » Sat, Jan 16, 2021, 8:28 PM UTC

vaduz wrote: post #187

It's a relatively long article - but it does not answer one simple question, which is quite important when discussing this: were there any malicious files hosted on that semi-random Cloudfront URL ? I realise that Google did not provide help identifying it - but that does not mean one should simply recomission the server under a new domain and continue as if nothing has happened! From TFA: > We quickly realized an Am…

If there was malicious content, the search console would have provided a sample URL. It didn't.

Re: Google Safe Browsing can kill a startup

#309

Post by perl4ever » Sat, Jan 16, 2021, 8:29 PM UTC

ghaff wrote: post #228

CodeWriter23 wrote: post #85

Earlier quoted context omitted.

> I keep reading this on the internet as if it’s some sort of truism I don’t believe this statement was initially intended to be axiomatic, rather, to serve as a reminder that the injury one is currently suffering is perhaps more likely than not, the result of human frailty.

I'm not sure it's even attributable to stupidity (necessarily) as attributable to automation or, more long-windedly, attributable to the fact that automation at scale will sometimes scale in wacky ways and said scale also makes it nearly impossible--or at least unprofitable--to insert meaningful human intervention into the loop. Not Google, but a few months back I suddenly couldn't post on Twitter. Why? Who knows. I…

I was just paying a bill online.

I had loading images turned off in my browser.

So I get the checkbox captcha thing, and checking it is not enough, so I have to click on taxis, etc. Which didn't initially show because of images being off.

I eventually did turn on images for the site and reload it. But at first, I was like "wait a minute, why should I have to have images on to pay a bill?" and I clicked a bunch of things I'd never tried before to see if there was an alternative. It appears that you have to be able to do either the image captcha or some sort of auditory thing. I guess accessibility doesn't include Helen Keller, or to someone who has both images and speaker turned off (which I have done at some times).

Maybe this is hard for someone younger to understand, but when I was first using computers, many had neither high quality graphics nor audio - that was a special advanced thing called "multimedia". It feels like something is severely wrong with the world if that is now a requirement to interact and do basic stuff online.

Re: Google Safe Browsing can kill a startup

#310

Post by shrimpx » Sat, Jan 16, 2021, 8:31 PM UTC

freedomben wrote: post #20

After years of seeing developments like this, getting worse and worse, it fills me with rage to think about how clearly nobody in power at Google cares. I naively used to think, "they probably don't realize what's happening and will fix it." I always try to give benefit of the doubt, especially having been on the other side so many times and seeing how 9 times out of 10 it's not malice, just incompetence, apathy, or…

It's probably "scale thinking" that makes google seem like they don't care: Everything is huge when you're "at scale"; the impact of a small blunder can take down companies or black out nation states. It's part of the game of being "at scale". They probably believe that it's untenable to build the necessary infrastructure to where everything (website, startup, person, etc.) matters.

This will sound crass, but it reminds me of Soviets cutting off the food supply to millions of people over the winter, due to industrial restructuring, and they brushed it off as "collateral damage".