Live data from Hacker News

Google flags Immich sites as dangerous

immich.app

551–560 of 713 posts

Re: Google flags Immich sites as dangerous

#551
post #409

Earlier quoted context omitted.

No later than last weekend I was comtemplating migrating my family pictures to a self-hosted Immich instance... I guess a workaround Google's crap would be to put an htpasswd/basic auth in front of Immich, blocking Google to get to the content and flagging it.

That probably wouldn't work, I get hit with Chrome's red screen of annoyance regularly with stuff only reachable on my LAN. I suspect the trigger is that the URLs are like [product name].home.[mydomain.com].

I'm actually already avoiding this issue but for another reason: hackers will scan subdomains matching known products with known vulnerabilities, so hosting a Wordpress behind "wordpress.domain.tld" will get you way more ill-intentioned requests than "tbyehl.domain.tld".

Thus if I started hosting my Immich instance, I would probably put it behind "pxl.domain.tld" or something like that.

Not a garantee to pass the Google purity test, but, according to some reports, it would avoid raising some redflags.

Re: Google flags Immich sites as dangerous

#552

Never host your test environments as Subdomains of your actual production domain. You'll also run into email reputation as well as cookie hell. You can get a lot of cookies from the production env if not managed well.

This. I cannot believe the rest of the comments on this are seemingly completely missing the problem here & kneejerk-blaming Google for being an evil corp. This is a real issue & I don't feel like the article from the Immich team acknowledges it. Far too much passing the buck, not enough taking ownership.

Yes they could do better, but who appointed Google "chief of web security"? Google can eff right off.

Re: Google flags Immich sites as dangerous

#553
I had this same problem with my self-hosted Home Assistant deployment, where Google marked the entire domain as phishing because it contains a login page that looks like other self-hosted Home Assistant deployments.

Fortunately, I expose it to the internet on its own domain despite running through the same reverse proxy as other projects. It would have sucked if this had happened to a domain used for anything else, since the appeal process is completely opaque.

Re: Google flags Immich sites as dangerous

#554

Earlier quoted context omitted.

The Honda issue where setting a certain radio station, would brick the infotainment? That good enough?

> That good enough? Not really. Does the car still drive? That sounds like a software bug; hardly indicative that the entire car is held together with duct tape, but a pretty bad bug non the less.

The browser still drives when Google throws up a safety warning.

It's just harder to drive to one house, and the homeowner is justifiably irritated about this.

Re: Google flags Immich sites as dangerous

#555

Earlier quoted context omitted.

I don't really see how anti-trust would address something like Google Chrome's safe browsing infrastructure. The problem is that the divide of alignment of interests there is between new, small companies and users . New companies want to put up a website without tripping over one of the thousand unwritten rules of "How to not look like a phishing site or malware depot" (many of which are unwritten because protecting…

> The problem is that the divide of alignment of interests there is between new, small companies and users. New companies want to put up a website without tripping over one of the thousand unwritten rules of "How to not look like a phishing site or malware depot" (many of which are unwritten because protecting users and exploiting users is a cat-and-mouse game)... And users don't want to get owned Some candidate lang…

> Monopolistic companies may not actively impose restrictions which harm others (includes businesses)

That's not generally how monopoly is interpreted in the US (although jurisprudence on this may be shifting). In general, the litmus test is consumer harm. A company is allowed to control 99% of the market if they do it by providing a better experience to consumers than other companies can; that's just "being successful." Microsoft ran afoul of antitrust because their browser sucked and embedding it in the OS made the OS suck too; if they hadn't tried to parlay one product into the other they would be unlikely to have run afoul of US antitrust law, and they haven't run afoul of it over the fact that 70-90% of x86 architecture PCs run Windows.

> Some restrictions are allowed, but the company must respond to an appeal of restrictions within X minutes; Appeals to the company can themselves be appealed to a governmental independent board which binds the company with no further review permitted; All delays and unreasonable responses incur punitive penalties as judged by the board; All penalties must be paid immediately

There may be meat on those bones (a general law restricting how browsers may operate in terms of rendering user content). Risky because it would codify into law a lot of ideas that are merely technical specifications (you can look to other industries to see the consequences of that, like how "five-over-ones" are cropping up in cities all over the US because they satisfy a pretty uniform fire and structural safety building code to the letter). But this could be done without invoking monopoly protection.

> If an action taken unilaterally by a company 1) harms someone AND 2) is automated: Then, that automation must be immediately, totally, and unconditionally reversed upon the unilateral request of the victim.

Too broad. It harms me when Google blocks my malware distribution service because I'm interested in getting malware on your machine; I really want your Bitcoin wallet passwords, you see. ;)

Most importantly: this whole topic is independent of monopolies. We could cut Chrome out of Google tomorrow and the exact same issues with safe browsing impeding new sites with malware-ish shapes would exist (with the only change probably being the false positive rate would go up, since a Chrome cut off from Google would have to build out its detection and reporting logic from scratch without relying on the search crawler DB). More importantly, a user can install another browser that doesn't have site protection today (or, if I understand correctly, switch it off). The reason this is an issue is that users like Chrome and are free to use it and tend to find site protection useful (or at least "not a burden to them") and that's not something Google imposed on the industry, it's a consequence of free user choice.

Re: Google flags Immich sites as dangerous

#556
post #491

Earlier quoted context omitted.

I know someone with a small business that applied for Venmo Business account (which is the main payment method in their community industry) and Venmo refused to open the account and didn't provide any reason as to why saying that they have the right to choose to refuse providing the service, which they do . But all the competitors of that business in the area do have a Venmo and take payment this way so it is basical…

Same thing with Paypal - I opened a business account, was able to do one transaction and was shut down for fraud. I tested a donation to myself. Under $10. Lifetime ban. fuck paypal

I sold some camera equipment on eBay once. PayPal flagged my account as fraudulent, asked for a receipt for the equipment which I did not have (I bought it years before), so they banned my account indefinitely.

Randomly, years later, they turned it back on. Thanks, I guess?

Re: Google flags Immich sites as dangerous

#557
post #214

Earlier quoted context omitted.

The only reason I can think of to 0-index months is so you can do monthName[date.getMonth()] instead of monthName[date.getMonth() - 1]. I don't think adding counterintuitive behavior to your data to save a "- 1" here and there is a good idea, but I guess this is just legacy from the ancient times.

A [StackOverflow thread]( https://stackoverflow.com/a/41992352 ) about this interface says it was introduced by Java way back in 1995, and copied by the first JavaScript implementation.

(We don't have Markdown formatting here, BTW. But thanks for the heads up, and welcome to YC.)

Re: Google flags Immich sites as dangerous

#558
post #550

Earlier quoted context omitted.

Google's services, especially their free services, are never really free. It's just that the price tag is so well hidden that ordinary users really believe this. But the HN audience is more technical than that and they see through the smokescreen. Except for those that are making money off adds directly or indirectly, and who believe in their god given right to my attention and my data. > I'm increasingly blown away…

It's just that the price tag is so well hidden that ordinary users really believe this. And if they die believing that, what price did they really pay? I don't think the difference mostly comes down to a lack of knowledge or understanding, but more a difference of care or assigned value. There are a lot of smart people on HN, but with that often comes exaggerated anxieties and paranoias. If most people don't give a c…

The people that put effort into anti-abortion laws are usually trying to force their view of how other people should live onto those other people.

I block ads out of my life because I am easily distracted and have seen the internet go from a great place to a billboard that continuously screams at me for my attention. It's pure self-preservation, I don't begrudge you your 45 minutes of advertising time per day at all.

Re: Google flags Immich sites as dangerous

#559

Earlier quoted context omitted.

The Honda issue where setting a certain radio station, would brick the infotainment? That good enough?

> That good enough? Not really. Does the car still drive? That sounds like a software bug; hardly indicative that the entire car is held together with duct tape, but a pretty bad bug non the less.

The road network is a much better analogy here.

Re: Google flags Immich sites as dangerous

#560

Earlier quoted context omitted.

> To try to do something about it requires curation, somebody needs to decide what is junk, which is completely antithetical to open protocols. The contra-example, of course, is email. SpamAssassin figured this out 24 years (!) ago. There is zero reason you couldn't apply similar heuristics to detect AI-slop or whatever particular kind of content you don't want to accept. > Radical recentralization to companies that…

A. SpamAssassin has never been tested at Gmail scale, and would likely fail in such a scenario. B. SpamAssassin is benefiting from centralized players, like Gmail, harming spam's economics. You're a free rider from the onslaught that would occur if spamming actually worked. Spam is at 45.6% of email globally with aggressive spam filters, but could easily double, triple, quadruple in volume if filters started failing…

I think you misunderstand what I'm getting at. SpamAssassin is older than Gmail. It's an old example, much newer and better spam-filtering-at-scale solutions exist (although SA is still maintained). Trying to claim that only the big boys can filter spam is an uninformed opinion.

No, you don't need an AI model to detect AI content (lmao). Heuristics already exist, and you see people mention them online all the time -- excessive use of lists, em dashes, common phrases, etc. Yes, a basic text heuristic scorer from the 1980s can pick these up without much difficulty. The magic of auto-learning heuristics (which have also existed since the 1980s, and performed fine at scale with less processing power than your smartwatch) is you can train them on whatever content you don't want to receive: marketing, political content, etc. You can absolutely apply this to whatever content suits your fancy, and it doesn't really take any more effort than moving messages you want filtered out to a Junk folder or similar.

Post reply on HN