Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Safe Browsing incident

statichost.eu

Post reply on HN
Print view View original

41–50 of 183 posts

Re: Google Safe Browsing incident

#41

Post by dormento »

ericselin wrote: post #19
SquareWheel wrote: post #14

It's generally good advice, but I don't see that Safe Browsing did anything wrong in this case. First, it sounds like they actually were briefly hosting phishing sites: > All sites on statichost.eu get a SITE-NAME.statichost.eu domain, and during the weekend there was an influx of phishing sites. Second, they should be using the public suffix list ( https://publicsuffix.org/ ) to avoid having their entire domain tagg…

I'm not saying that Google or Safe Browsing in particular did anything wrong per se. My point is primarily that Google has too much power over the internet. I know that in this case what actually happened is because of me not putting enough effort into fending off bad guys. The new separate domain is pending inclusion in the PSL, yes. Edit: the "effort" I'm talking about above refers to more real time moderation of c…

Exactly.

> Second, they should be using the public suffix list (https://publicsuffix.org/) to avoid having their entire domain tagged.

NO, Google should be "mindful" (I know companies are not people but w/e) of the power it unfortunately has. Also, Cloudflare. All my homies hate Cloudflare.

Re: Google Safe Browsing incident

#42

Post by sokoloff »

ericselin wrote: post #19
SquareWheel wrote: post #14

It's generally good advice, but I don't see that Safe Browsing did anything wrong in this case. First, it sounds like they actually were briefly hosting phishing sites: > All sites on statichost.eu get a SITE-NAME.statichost.eu domain, and during the weekend there was an influx of phishing sites. Second, they should be using the public suffix list ( https://publicsuffix.org/ ) to avoid having their entire domain tagg…

I'm not saying that Google or Safe Browsing in particular did anything wrong per se. My point is primarily that Google has too much power over the internet. I know that in this case what actually happened is because of me not putting enough effort into fending off bad guys. The new separate domain is pending inclusion in the PSL, yes. Edit: the "effort" I'm talking about above refers to more real time moderation of c…

> My point is primarily that Google has too much power over the internet.

That is probably true, but in this case I think most people would think that they used that power for good.

It was inconvenient for you and the legitimate parts of what was hosted on your domain, but it was blocking genuinely phishing content that was also hosted on your domain.

Re: Google Safe Browsing incident

#43

Post by blenderob »

hk__2 wrote: post #17
bluesmoon wrote: post #13

Earlier quoted context omitted.

Exactly! For a web dev in 2025 to still not know security best practices that have been around for 20+ years is a failure on the part of the dev.

I’m sure I don’t know ALL the "security best practices that have been around for 20+ years" and this is perfectly fine as long as I’m able to react quickly. See also https://xkcd.com/1053/ .

It's fine if you personally didn't know that. But if I'm paying for a service, I expect the provider to understand basic security best practices that have been industry standard for 20+ years. And if they don't, they should be hiring people who do.

XKCD 1053 is not a valid excuse for what amounts to negligence in a production service.

Re: Google Safe Browsing incident

#44

Post by shadowgovt »

Not sure who changed the HN headline, but I appreciate the change. Especially since the concept in the headline is buried at the bottom of the post.

Post author is throwing a lot of sand at Google for a process that has (a) been around for, what, over a decade now and (b) works. The fact of the matter is this hosting provider was too open, several users of the provider used it to put up content intended to attack users, and as far as Google (or anyone else on the web is concerned) the TLD is where the buck stops for that kind of behavior. This is one of the reasons why you host user-generated content off your TLD, and several providers have gotten the memo; it is unfortunate statichost.eu had not yet.

I'm sorry this domain admin had to learn an industry lesson the hard way, but at least they won't forget it.

Re: Google Safe Browsing incident

#45

Post by tartarus4o »

freehorse wrote: post #37
progbits wrote: post #7

Hosts phishing sites, gets blocked by anti phishing mechanism. Works as expected from my point of view. Get yourself on public suffix list or get better moderation. But of course just moaning about bad google is easier.

You are right, but then again, nobody flags facebook because of the scamming taking place in some facebook pages.

"Might makes right" as they say.

There is no real way a normal person even can flag facebook.

Re: Google Safe Browsing incident

#46

Post by shadowgovt »

ericselin wrote: post #19
SquareWheel wrote: post #14

It's generally good advice, but I don't see that Safe Browsing did anything wrong in this case. First, it sounds like they actually were briefly hosting phishing sites: > All sites on statichost.eu get a SITE-NAME.statichost.eu domain, and during the weekend there was an influx of phishing sites. Second, they should be using the public suffix list ( https://publicsuffix.org/ ) to avoid having their entire domain tagg…

I'm not saying that Google or Safe Browsing in particular did anything wrong per se. My point is primarily that Google has too much power over the internet. I know that in this case what actually happened is because of me not putting enough effort into fending off bad guys. The new separate domain is pending inclusion in the PSL, yes. Edit: the "effort" I'm talking about above refers to more real time moderation of c…

There are two aspects to the Internet: the technical and the social.

In the social, there is always someone with most of the power (distributed power is an unstable equilibrium), and it's incumbent upon us, the web developers, to know the current status quo.

Back in the day, if you weren't testing on IE6 you weren't serving a critical mass of your potential users. Nowadays, the nameplates have changed but the same principles hold.

Re: Google Safe Browsing incident

#47

Post by stickfigure »

ericselin wrote: post #19
SquareWheel wrote: post #14

It's generally good advice, but I don't see that Safe Browsing did anything wrong in this case. First, it sounds like they actually were briefly hosting phishing sites: > All sites on statichost.eu get a SITE-NAME.statichost.eu domain, and during the weekend there was an influx of phishing sites. Second, they should be using the public suffix list ( https://publicsuffix.org/ ) to avoid having their entire domain tagg…

I'm not saying that Google or Safe Browsing in particular did anything wrong per se. My point is primarily that Google has too much power over the internet. I know that in this case what actually happened is because of me not putting enough effort into fending off bad guys. The new separate domain is pending inclusion in the PSL, yes. Edit: the "effort" I'm talking about above refers to more real time moderation of c…

"Google does good thing, therefore Google has too much power over the internet" is not a convincing point to make.

This safety feature saves a nontrivial number of people from life-changing mistakes. Yes we publishers have to take extra care. Hard to see a negative here.

Re: Google Safe Browsing incident

#48

Post by ericselin »

freehorse wrote: post #25

I don't see how a separate domain would solve the main issue here. If something on that separate domain was flagged, it would still affect all user content on that domain. If your business is about serving such user content, the main service of your business would be down, even though your main domain would still be up.

You are right, it would still affect all users. Until the pending PSL inclusion is complete, that is. But it now separates my own resources, such as the website and dashboard of statichost.eu from that.

Re: Google Safe Browsing incident

#49

Post by hiatus »

ericselin wrote: post #15
kbolino wrote: post #11

Putting user content on another domain and adding that domain to the public suffix list is good advice. So good, in fact, that it should have been known to an infrastructure provider in the first place. There's a lot of vitriol here that is ultimately misplaced away from the author's own ignorance.

This is of course true! It just takes an incident like this to get ones head out of ones ass and actually do it. :)

One can only imagine the other beginner mistakes made by this operator.

Re: Google Safe Browsing incident

#50

Post by shadowgovt »

dormento wrote: post #41
ericselin wrote: post #19

Earlier quoted context omitted.

I'm not saying that Google or Safe Browsing in particular did anything wrong per se. My point is primarily that Google has too much power over the internet. I know that in this case what actually happened is because of me not putting enough effort into fending off bad guys. The new separate domain is pending inclusion in the PSL, yes. Edit: the "effort" I'm talking about above refers to more real time moderation of c…

Exactly. > Second, they should be using the public suffix list ( https://publicsuffix.org/ ) to avoid having their entire domain tagged. NO, Google should be "mindful" (I know companies are not people but w/e) of the power it unfortunately has. Also, Cloudflare. All my homies hate Cloudflare.

It is mindful.

... by using the agreed-upon tool to track domains that treat themselves as TLDs for third-party content: the public suffix list. Microsoft Edge and Firefox also use the PSL and their mechanisms for protecting users would be similarly suspicious that attacks originating from statichost.eu were originating from the owners of that domain and not some third-party that happened to independently control foo.statichost.eu.

Post reply on HN