Live data from Hacker News

Google flags Immich sites as dangerous

immich.app

431–440 of 713 posts

Re: Google flags Immich sites as dangerous

#431

Happened to me last week. One morning we wake up and the whole company website does not work. Not advice with some time to fix any possible problem, just blocked. We gave very bad image to our clients and users, and had to give explanations of a false positive from google detection. The culprit, according to google search console, was a double redirect on our web email domain (/ -> inbox -> login). After just moving…

> The culprit, according to google search console, was a double redirect on our web email domain (/ -> inbox -> login).

I find it hard to believe that the double redirect itself tripped it: multiple redirects in a row is completely normal—discouraged in general because it hurts performance, but you encounter them all the time. For example, http://foo.examplehttps://foo.examplehttps://www.foo.example (http → https, then add or remove www subdomain) is the recommended pattern. And site root to app path to login page is also pretty common. This then leads me to the conclusion that they’re not disclosing what actually tripped it. Maybe multiple redirects contributed to it, a bad learned behaviour in an inscrutable machine learning model perhaps, but it alone is utterly innocuous. There’s something else to it.

Re: Google flags Immich sites as dangerous

#433
post #251
post #214

Earlier quoted context omitted.

The only reason I can think of to 0-index months is so you can do monthName[date.getMonth()] instead of monthName[date.getMonth() - 1]. I don't think adding counterintuitive behavior to your data to save a "- 1" here and there is a good idea, but I guess this is just legacy from the ancient times.

That would have a better solution in a date.getCurrentMonth(), in my opinion.

Temporal[0] is coming which solves many many many issues with JS Date, 1-based months[1] included!

Can't wait for it to be stable and widely available, it's just too good.

> month values start at 1, which is different from legacy Date where months are represented by zero-based indices (0 to 11)

[0] https://tc39.es/proposal-temporal/docs/

[1] https://tc39.es/proposal-temporal/docs/plaindate.html#month

Re: Google flags Immich sites as dangerous

#434

Happened to me last week. One morning we wake up and the whole company website does not work. Not advice with some time to fix any possible problem, just blocked. We gave very bad image to our clients and users, and had to give explanations of a false positive from google detection. The culprit, according to google search console, was a double redirect on our web email domain (/ -> inbox -> login). After just moving…

File a small claim for damages up to 10,000 to 20,000 USD depending on your local statues. It’s actually pretty quick and easy. They cannot defend themselves with lawyers, so a director usually has to show up.

In all US states corporations may be represented by lawyers in small claims cases. The actual difference is that in higher courts corporations usually must be represented by lawyers whereas many states allow normal employees to represent corporations when defending small claims cases, but none require it.

Re: Google flags Immich sites as dangerous

#435

Earlier quoted context omitted.

File a small claim for damages up to 10,000 to 20,000 USD depending on your local statues. It’s actually pretty quick and easy. They cannot defend themselves with lawyers, so a director usually has to show up.

In all US states corporations may be represented by lawyers in small claims cases. The actual difference is that in higher courts corporations usually must be represented by lawyers whereas many states allow normal employees to represent corporations when defending small claims cases, but none require it.

Not to mention that they have general council, who are lawyers but also just employees.

Re: Google flags Immich sites as dangerous

#436

We really need an internet Bill of Rights. Google has too much power to delete your company from existence with no due process or recourse. If any company controls some (high) percentage of a particular market, say web browsers, search, or e-commerce, or social media, the public's equal access should start to look more like a right and less like an at-will contract. 30 years ago, if a shop had a falling out with the…

Force interoperability. In 2009 I could run Pidgin and load messages from AIM, FB Messages, Yahoo... Where did that go?

I suspect the EU will be the first region to push the big tech companies on this.

Re: Google flags Immich sites as dangerous

#437

I don't see how this is an issue. To me, this does seem at least confusing, but possibly dangerous. If you have internal auth testing domains at the same place as user generated content, what's to stop somebody thinking a user-generated page isn't a legit page when it asked you to login or something? To me this seems like a reasonable flag.

There is no user generated content involved here.

Re: Google flags Immich sites as dangerous

#438
post #386

Earlier quoted context omitted.

I love Immich & greatly appreciate the amazing work the team put into maintaining it, but between the OP & this "Cursed Knowledge" page, the apparent team culture of shouting from the rooftops complaints that expose their own ignorance about technology is a little concerning to be honest. I've now read the entire Cursed Knowledge list & - while I found some of them to be invaluable insights & absolutely love the idea…

> Carriage returns in bash scripts are cursed Also the full story here seemed to be 1. Person installs git on Windows with autocrlf enabled, automatically converting all LF to CRLF (very cursed in itself in my opinion). 2. Does their thing with git on the Windows' side (clone, checkout, whatever). 3. Then runs the checked out (and now broken due to autocrlf) code on Linux instead of Windows via WSL. The biggest footg…

This is imo ultimately a problem with git.

If git didn't have this setting, then after checking out a bash file with LFs in it, there are many Windows editors that would not be able to edit that file properly. That's a limitation of those editors & nobody should be using those pieces of software to edit bash files. This is a problem that is entirely out of scope for a VCS & not something Git should ever have tried to solve.

In fact, having git solve this disincentives Windows editors from solving it correctly.

Re: Google flags Immich sites as dangerous

#439
post #269

Earlier quoted context omitted.

Some of these seem less cursed, and more just security design? > Some phones will silently strip GPS data from images when apps without location permission try to access them. That strikes me as the right thing to do?

> That strikes me as the right thing to do Yep, and it's there for very goos reasons. However if you don't know about it, it can be quite surprising and challenging to debug. Also it's annoying when your phones permissions optimiser runs and removes the location permissions from e.g. Google Photos, and you realise a few months later that your photos no longer have their location.

There is never a good reason to permanently modify my files, if that is what is going on here. Seems like I wouldn't be able to search my photos by location reliably if that data was stripped from them.

Re: Google flags Immich sites as dangerous

#440

Earlier quoted context omitted.

Stop trying to look for technological answers to political problems. We already have a way to avoid excessive accumulation of power by private entities, it's called "anti-trust laws" (heck, "laws" in general). Any new protocol not only has to overcome the huge incumbent that is the web, it has to do so grassroots against the power of global capital (trillions of dollars of it). Of course, it also has to work in the f…

I don't really see how anti-trust would address something like Google Chrome's safe browsing infrastructure. The problem is that the divide of alignment of interests there is between new, small companies and users . New companies want to put up a website without tripping over one of the thousand unwritten rules of "How to not look like a phishing site or malware depot" (many of which are unwritten because protecting…

> The problem is that the divide of alignment of interests there is between new, small companies and users. New companies want to put up a website without tripping over one of the thousand unwritten rules of "How to not look like a phishing site or malware depot" (many of which are unwritten because protecting users and exploiting users is a cat-and-mouse game)... And users don't want to get owned

Some candidate language:

- Monopolistic companies may not actively impose restrictions which harm others (includes businesses)

or

- Some restrictions are allowed, but the company must respond to an appeal of restrictions within X minutes; Appeals to the company can themselves be appealed to a governmental independent board which binds the company with no further review permitted; All delays and unreasonable responses incur punitive penalties as judged by the board; All penalties must be paid immediately

or

- If an action taken unilaterally by a company 1) harms someone AND 2) is automated: Then, that automation must be immediately, totally, and unconditionally reversed upon the unilateral request of the victim. The company may reinstate the action upon the sworn statement of an employee that they have made the decision as a human, and agree to be accountable for the decision. The decision must then follow the above appeals process.

or

- No monopolies allowed

Post reply on HN