Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google flags Immich sites as dangerous

immich.app

Post reply on HN
Print view View original

321–330 of 713 posts

Re: Google flags Immich sites as dangerous

#321

Post by lucideer »

aniviacat wrote: post #280
lucideer wrote: post #231

Earlier quoted context omitted.

A website where a user can upload "active code". The definition of "active code" is broad & sometimes debatable - e.g. do old MySpace websites count - but broadly speaking the best way of thinking about it is in terms of threat model, & the main two there are: - credential leakage - phishing The first is fairly narrow & pertains to uploading server side code or client javascript. If Alice hosts a login page on alice.…

It may be dangerous but it is an established pattern. There are many cases (like Cloudflare Pages) of others doing the same, hosting strangers' sites on subdomains of a dedicated domain (pages.dev for Cloudflare, immich.cloud for Immich). By preventing newcomers from using this pattern, Google's system is flawed, severely stifling competition. Of course, this is perfectly fine for Google.

It is but this established pattern is well standardised & documented by the public suffix list project. There's generally two conventions followed for this pattern:

1. Use a separate dedicated domain (Immich didn't do this - they're now switching to one in response to this)

2. List the separate dedicated domain in the public suffix list. As far as I can tell Immich haven't mentioned this.

Re: Google flags Immich sites as dangerous

#322

Post by inopinatus »

IshKebab wrote: post #247
KronisLV wrote: post #228

Earlier quoted context omitted.

> Since there was and remains no algorithmic method of finding the highest level at which a domain may be registered for a particular top-level domain A centralized list like this not just for domains as a whole (e.g. co.uk) but also specific sites (e.g. s3-object-lambda.eu-west-1.amazonaws.com) is both kind of crazy in that the list will bloat a lot over the years, as well as a security risk for any platform that ne…

I presume it has to be a curated list otherwise spammers would use it to evade blocks. Otherwise why not just use DNS?

Whois would be the choice. DNS’s less glamourous sibling, purpose built for delegated publication of accountability records

Re: Google flags Immich sites as dangerous

#324

Post by goku12 »

immibis wrote: post #304
whatsupdog wrote: post #289

Earlier quoted context omitted.

[flagged]

Use one of the forks. librewolf, waterfox, zen. Firefox itself lost trust when Mozilla tried to push the new Terms of Use earlier this year. That was so aggressively user-hostile that nobody should trust Mozilla ever again. Using a fork puts an insulation layer between you and Mozilla. Librewolf is just a directly de-mozillaed and privacy-enhanced Firefox, similar to Ungoogled Chromium. I've been trying to get in the…

The problem is that all those forks are beholden to Mozilla's corporate interests the same way the chromium derivatives are beholden to Google's corporate interests. What we need is one of the newer independent engines to mature - libweb, servo or blitz.

Re: Google flags Immich sites as dangerous

#325

Post by p0w3n3d »

dkersten wrote: post #272
Jackson__ wrote: post #174

If there are any googlers here, I'd like to report an even more dangerous website. As much as 30-50% of the traffic to it relates to malware or scams, and it has gone unpunished for a very long time. The address appears to be adsense.google.com.

Also YouTube.com serves a lot of scam advertisements. They should block that too.

I think google is crumbling under the weight of their size. They are no longer able to process the requested commercials with due diligence.

Re: Google flags Immich sites as dangerous

#326

Post by frm88 »

nicce wrote: post #179
jrowen wrote: post #146

Earlier quoted context omitted.

[flagged]

On this day, only Google Maps does not have real competitor on Android. Otherwise, it is possible to drop Google and even get better services. Brands are difficult to compete.

Try Mapy. Outperforms Google maps any day.

Re: Google flags Immich sites as dangerous

#327

Post by BSDobelix »

Jackson__ wrote: post #174

If there are any googlers here, I'd like to report an even more dangerous website. As much as 30-50% of the traffic to it relates to malware or scams, and it has gone unpunished for a very long time. The address appears to be adsense.google.com.

What i really don't understand at least here in Europe the advertising partner (adsense) must investigate at least minimally whether the advertising is illegal or fraudulent, i understand that sites.google etc are under "safe harbor" but that's not the point with adsense since people from google "click" the publish button and also get money to publish that ad.

Re: Google flags Immich sites as dangerous

#328

Post by Chris2048 »

p0w3n3d wrote: post #325
dkersten wrote: post #272

Earlier quoted context omitted.

Also YouTube.com serves a lot of scam advertisements. They should block that too.

I think google is crumbling under the weight of their size. They are no longer able to process the requested commercials with due diligence.

I see the same scam/deepfake ad(s) pretty much persistently. Maybe they actually differ slightly (they are AI gen mostly), but it's pretty obvious what they are, and I'm sure they get flagged a lot.

They just need to introduce a basic deposit to post ads, and you lose it if you put up a scam ad. Would soon pay for the staff needed to police it, and prevent scammers from bypassing admin by trivially creating new accounts.

Re: Google flags Immich sites as dangerous

#329

Post by Nextgrid »

BSDobelix wrote: post #327
Jackson__ wrote: post #174

If there are any googlers here, I'd like to report an even more dangerous website. As much as 30-50% of the traffic to it relates to malware or scams, and it has gone unpunished for a very long time. The address appears to be adsense.google.com.

What i really don't understand at least here in Europe the advertising partner (adsense) must investigate at least minimally whether the advertising is illegal or fraudulent, i understand that sites.google etc are under "safe harbor" but that's not the point with adsense since people from google "click" the publish button and also get money to publish that ad.

The law is only for plebs like you and me. Companies get a pass.

I'm still amazed how deploying spyware would've rightfully landed you in jail a couple decades back, but do the same thing on the web under the justification of advertising/marketing and suddenly it's ok.

Re: Google flags Immich sites as dangerous

#330

Post by arccy »

fc417fc802 wrote: post #261
arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

How does the PSL make any sense? What stops an attacker from offering free static hosting and then making use of their own service? I appreciate the issue it tries to solve but it doesn't seem like a sane solution to me.

PSL isn't a list of dangerous sites per-se.

Browsers already do various levels of isolation based on domain / subdomains (e.g. cookies). PSL tells them to treat each subdomain as if it were a top level domain because they are operated (leased out to) different individuals / entities. WRT to blocking, it just means that if one subdomain is marked bad, it's less likely to contaminate the rest of the domain since they know it's operated by different people.

Post reply on HN