Google flags Immich sites as dangerous • Hacker News Board

Re: Google flags Immich sites as dangerous

#421

Post by StilesCrisis » Thu, Oct 23, 2025, 12:59 PM UTC

bloomingeek wrote: post #413

AtlasBarfed wrote: post #408

Earlier quoted context omitted.

"Google will put more effort into fixing them" Why would they do that? Do they lose money from these people? Why would they care? they're a monopoly they don't need to care

Perhaps we need a different "type" of internet. I don't have the expertise to even explain what this would look like, but I know that if politics, religion, junk science and a hundred other influences have anything to do with it, it will eventually become too stupid to use.

Making a "smart person only" Internet is a social problem, not a technology problem.

Re: Google flags Immich sites as dangerous

#422

Post by yabones » Thu, Oct 23, 2025, 1:03 PM UTC

This is another case where it's highly important to "plant your flag" [1] and set up all those services like Search Console, even if you don't plan to use them. Not only can this sort of thing happen, but bad-guys can find crafty ways of hijacking your search console account if you're not super vigilant.

Google Postmaster Console [2] is another one everybody should set up on every domain, even if you don't use gmail. And Google Ads, even if you don't run ads.

I also recommend that people set up Bing search console [3] and some service to monitor DMARC reports.

It's unfortunate that so much of the internet has coalesced around a few private companies, but it's undeniably important to "keep them happy" to make sure your domain's reputation isn't randomly ruined.

[1] https://krebsonsecurity.com/2020/08/why-where-you-should-you...

[2] https://postmaster.google.com/

[3] https://www.bing.com/webmasters/

Re: Google flags Immich sites as dangerous

#423

Post by tremon » Thu, Oct 23, 2025, 1:05 PM UTC

AshamedCaptain wrote: post #375

BSDobelix wrote: post #327

Earlier quoted context omitted.

What i really don't understand at least here in Europe the advertising partner (adsense) must investigate at least minimally whether the advertising is illegal or fraudulent, i understand that sites.google etc are under "safe harbor" but that's not the point with adsense since people from google "click" the publish button and also get money to publish that ad.

I have reported over a dozen ads to AdSense (Europe) because of them being outright scams (e.g. on weather apps, an AdSense banner claiming "There is a new upgrade to this program, click here to download it") . Google has invariably closed my reports claiming that they do not find any violation of the adsense policies.

Do you report those only to Google, or also to your local watchdog/police/commerce regulator?

Re: Google flags Immich sites as dangerous

#424

Post by nucleative » Thu, Oct 23, 2025, 1:05 PM UTC

We really need an internet Bill of Rights. Google has too much power to delete your company from existence with no due process or recourse.

If any company controls some (high) percentage of a particular market, say web browsers, search, or e-commerce, or social media, the public's equal access should start to look more like a right and less like an at-will contract.

30 years ago, if a shop had a falling out with the landlord, it could move to the next building over and resume business. Now if you annoy eBay, Amazon or Walmart, you're locked out nationwide. If you're an Uber, Lyft, or Doordash (etc) gig worker and their bots decide they don't like you anymore, then sayonara sucker! Your account has been disabled, have a nice day and don't reapply.

Our regulatory structure and economies of scale encourage consolidation and scale and grant access to this market to these businesses, but we aren't protecting the now powerless individuals and small businesses who are randomly and needlessly tossed out with nobody to answer their pleas of desperation, no explanation of rules broken, and no opportunity to appeal with transparency.

It's a sorry state of affairs at the moment.

Re: Google flags Immich sites as dangerous

#425

Post by [deleted] » Thu, Oct 23, 2025, 1:06 PM UTC

0xbadcafebee wrote: post #65

arccy wrote: post #8

If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....

In the past, browsers used an algorithm which only denied setting wide-ranging cookies for top-level domains with no dots (e.g. com or org). However, this did not work for top-level domains where only third-level registrations are allowed (e.g. co.uk). In these cases, websites could set a cookie for .co.uk which would be passed onto every website registered under co.uk. Since there was and remains no algorithmic meth…

[deleted]

Re: Google flags Immich sites as dangerous

#426

Post by Groxx » Thu, Oct 23, 2025, 1:07 PM UTC

lukan wrote: post #71

0xbadcafebee wrote: post #65

Earlier quoted context omitted.

In the past, browsers used an algorithm which only denied setting wide-ranging cookies for top-level domains with no dots (e.g. com or org). However, this did not work for top-level domains where only third-level registrations are allowed (e.g. co.uk). In these cases, websites could set a cookie for .co.uk which would be passed onto every website registered under co.uk. Since there was and remains no algorithmic meth…

"The engineering equivalent of a car made of duct tape" Kind of. But do you have a better proposition?

I'm under the impression that CORS largely solves it?

which is still much too new to be able to shut down the PSL of course. but maybe in 2050.

Re: Google flags Immich sites as dangerous

#427

Post by tremon » Thu, Oct 23, 2025, 1:07 PM UTC

Kbelicius wrote: post #317

immibis wrote: post #304

Earlier quoted context omitted.

Use one of the forks. librewolf, waterfox, zen. Firefox itself lost trust when Mozilla tried to push the new Terms of Use earlier this year. That was so aggressively user-hostile that nobody should trust Mozilla ever again. Using a fork puts an insulation layer between you and Mozilla. Librewolf is just a directly de-mozillaed and privacy-enhanced Firefox, similar to Ungoogled Chromium. I've been trying to get in the…

> Firefox itself lost trust when Mozilla tried to push the new Terms of Use earlier this year. Those terms of use aren't in place any longer. I'm surprised that listening to the users is viewed as something bad.

Rolling back a change that causes loss of user trust does not automatically restore that trust. It takes time and ongoing public commitment to regain that trust.

Re: Google flags Immich sites as dangerous

#428

Post by shadowgovt » Thu, Oct 23, 2025, 1:09 PM UTC

KronisLV wrote: post #228

0xbadcafebee wrote: post #65

Earlier quoted context omitted.

In the past, browsers used an algorithm which only denied setting wide-ranging cookies for top-level domains with no dots (e.g. com or org). However, this did not work for top-level domains where only third-level registrations are allowed (e.g. co.uk). In these cases, websites could set a cookie for .co.uk which would be passed onto every website registered under co.uk. Since there was and remains no algorithmic meth…

> Since there was and remains no algorithmic method of finding the highest level at which a domain may be registered for a particular top-level domain A centralized list like this not just for domains as a whole (e.g. co.uk) but also specific sites (e.g. s3-object-lambda.eu-west-1.amazonaws.com) is both kind of crazy in that the list will bloat a lot over the years, as well as a security risk for any platform that ne…

It does smell very much like a feature that is currently implemented as a text file but will eventually need to grow to its own protocol, like, indeed, the hostfile becoming DNS.

One key difference between this list and standard DNS (at least as I understand it; maybe they added an extension to DNS I haven't seen) is the list requires independent attestation. You can't trust `foo.com` to just list its subdomains; that would be a trivial attack vector for a malware distributor to say "Oh hey, yeah, trustme.com is a public suffix; you shouldn't treat its subdomains as the same thing" and then spin up malware1.trustme.com, malware2.trustme.com, etc. Domain owners can't be the sole arbiter of whether their domain counts as a "public suffix" from the point of view of user safety.

Re: Google flags Immich sites as dangerous

#429

Post by vladms » Thu, Oct 23, 2025, 1:10 PM UTC

szszrk wrote: post #402

vladms wrote: post #395

Earlier quoted context omitted.

> God I hate the web. The engineering equivalent of a car made of duct tape. Most of the complex thing I have seen being made (or contributed to) needed duct tape sooner or later. Engineering is the art of trade-offs, of adapting to changing requirements (that can appear due to uncontrollable events external to the project), technology and costs. Related, this is how the first long distance automobile trip was done:…

Why would you compare Web to that? A first fax message would be more appropriate comparison. Web is not a new thing and hardly a technical experiment of a few people any more. If you add the time since announcing the concept of Web to that trip date, you have a very decent established industry already. With many sport and mass production designs: https://en.wikipedia.org/wiki/Category:Cars_introduced_in_19...

For me the web is something along the lines at the definition of: https://en.wikipedia.org/wiki/World_Wide_Web to sum up "...universal linked information system...". I think the fax misses many aspects of the core definition to be a good comparison.

Not sure what is your point about "decent established industry" if we relate to "duct tape". I see two possibilities:

a) you imply that the web does not have a decent established industry (but I would guess not).

b) you would claim that there was no "duct tape" in 1924 car industry. I am no expert but I would refer you to the article describing what was the procedure to start the car at https://www.quora.com/How-do-people-start-their-cars-in-the-..., to quote:

> Typical cold-start routine (common 1930s workflow)

> 1. Set hand choke (pull knob).

> 2. Set throttle lever to slight fast‑idle.

> 3. Retard spark if manual advance present.

> 4. Engage starter (electric) or use hand crank.

> 5. Once running, push choke in gradually, advance spark, reduce throttle.

Not sure about your opinion but compared to what a car's objective is (move from point A to point B) to me that sounds rather involved. Not sure if it qualifies as "duct-tape" but definitely it is not a "nicely implemented system that just works".

To resume my point: I think on average progress is slower and harder than people think. And that is mostly because people do not have exposure to the work people are doing to improve things until something can become more "widely available".

Re: Google flags Immich sites as dangerous

#430

Post by shadowgovt » Thu, Oct 23, 2025, 1:11 PM UTC

vincnetas wrote: post #170

modeless wrote: post #149

Earlier quoted context omitted.

Show me a platform not made out of duct tape and I'll show you a platform nobody uses.

regular cars?

Jeep just had an OTA update cause the car to shut down on the highway (it is rumored).

Before we put computers in cars, we had the myriad small things that would break (stuck doors, stuck windows, failed seals, leaking gaskets), a continuous stream of recalls for low-probability safety issues, and the occasional Gremlin or Pinto.

My favorite example is the Hyundai Elantra. They changed the alloy used in one of the parts in the undercarriage. Tested that model to death for a year, as they do, but their proving ground is in the southern United States.

Several winters later, it turns out that road salt attacks the hell out of that alloy and people have wheels flying off their cars in the middle of the road.