Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google flags Immich sites as dangerous

immich.app

Post reply on HN
Print view View original

581–590 of 713 posts

Re: Google flags Immich sites as dangerous

#581

Post by immibis »

goku12 wrote: post #324
immibis wrote: post #304

Earlier quoted context omitted.

Use one of the forks. librewolf, waterfox, zen. Firefox itself lost trust when Mozilla tried to push the new Terms of Use earlier this year. That was so aggressively user-hostile that nobody should trust Mozilla ever again. Using a fork puts an insulation layer between you and Mozilla. Librewolf is just a directly de-mozillaed and privacy-enhanced Firefox, similar to Ungoogled Chromium. I've been trying to get in the…

The problem is that all those forks are beholden to Mozilla's corporate interests the same way the chromium derivatives are beholden to Google's corporate interests. What we need is one of the newer independent engines to mature - libweb, servo or blitz.

No they're not. They can pull what they like and not pull what they don't.

Librewolf is trying to be de-Mozillaed, privacy-enhanced Firefox, so it'll probably take whatever not-overtly-spyware patches Mozilla adds. Some others, like Waterfox and Pale Moon, are more selective.

Re: Google flags Immich sites as dangerous

#582

Post by IshKebab »

inopinatus wrote: post #322
IshKebab wrote: post #247

Earlier quoted context omitted.

I presume it has to be a curated list otherwise spammers would use it to evade blocks. Otherwise why not just use DNS?

Whois would be the choice. DNS’s less glamourous sibling, purpose built for delegated publication of accountability records

Whois isn't curated either.

Re: Google flags Immich sites as dangerous

#583

Post by stOneskull »

whatsupdog wrote: post #365
ZenoArrow wrote: post #191

Earlier quoted context omitted.

Firefox should be on that list. It's clearly a lot closer in functionality to Chrome/Chromium than Servo or Ladybird, so it's easier to switch to it. I like that Servo and Ladybird exist and are developing well, but there's no need to pretend that they're the only available alternatives.

Majority of users are on mobile now, and Firefox mobile sucks ass. I cannot bring myself to use it. Simple things like clicking the home button should take you to homepage, but Firefox opens a new tab. It's so stupid.

i think it's great and syncs well with my computer's firefox. i think there should be a setting to choose how to open homepage but i don't mind the extra tabs really.

Re: Google flags Immich sites as dangerous

#584

Post by Merad »

MzHN wrote: post #386
lucideer wrote: post #349

Earlier quoted context omitted.

I love Immich & greatly appreciate the amazing work the team put into maintaining it, but between the OP & this "Cursed Knowledge" page, the apparent team culture of shouting from the rooftops complaints that expose their own ignorance about technology is a little concerning to be honest. I've now read the entire Cursed Knowledge list & - while I found some of them to be invaluable insights & absolutely love the idea…

> Carriage returns in bash scripts are cursed Also the full story here seemed to be 1. Person installs git on Windows with autocrlf enabled, automatically converting all LF to CRLF (very cursed in itself in my opinion). 2. Does their thing with git on the Windows' side (clone, checkout, whatever). 3. Then runs the checked out (and now broken due to autocrlf) code on Linux instead of Windows via WSL. The biggest footg…

You will have the same problem if you build a Linux container image using scripts that were checked out on the windows host machine. What's even more devious is that some editors (at least VS Code) will automatically save .sh files with LF line endings on Windows, so the problem doesn't appear for the original author, only someone who clones the repo later. I spent probably half a day troubleshooting this a while back. IMO it's not the fault of any one tool, it's just a thing that most people will never think about until it bites them.

TL;DR - if your repo will contain bash scripts, use .gitattributes to make sure they have LF line endings.

Re: Google flags Immich sites as dangerous

#585

Post by lucideer »

superconduct123 wrote: post #529
lucideer wrote: post #349

Earlier quoted context omitted.

I love Immich & greatly appreciate the amazing work the team put into maintaining it, but between the OP & this "Cursed Knowledge" page, the apparent team culture of shouting from the rooftops complaints that expose their own ignorance about technology is a little concerning to be honest. I've now read the entire Cursed Knowledge list & - while I found some of them to be invaluable insights & absolutely love the idea…

You're taking the word cursed way too seriously This is just a list of things that can catch devs off guard

I guess you're right - I find the tone off but it's not egregious & it is mostly a very useful list.

Re: Google flags Immich sites as dangerous

#586

Post by froggit »

alias_neo wrote: post #277
MonaroVXR wrote: post #176

Earlier quoted context omitted.

The Honda issue where setting a certain radio station, would brick the infotainment? That good enough?

> That good enough? Not really. Does the car still drive? That sounds like a software bug; hardly indicative that the entire car is held together with duct tape, but a pretty bad bug non the less.

So i can't remember the specifics or find any references, but many years ago i remember reading about a car (prius maybe?) that would shut off and lock the doors when pulling away from a stop. (Ex: stopped at a red light, when it turns green the car would go far enough to cut off in the middle of an intersection then trap everyone inside.)

"This is Fine."

Re: Google flags Immich sites as dangerous

#587

Post by lucideer »

Gormo wrote: post #513
lucideer wrote: post #449

Earlier quoted context omitted.

> mitigating false positives First & foremost I really need to emphasise that, despite the misleading article title, this was not a false positive. Google flagged this domain for legitimate reasons. I think there's likely a conversation to be had about messaging - Chrome's warning page seems a little scarier than it should be, Firefox's is more measured in its messaging. But in terms of the API service Google are pro…

> First & foremost I really need to emphasise that, despite the misleading article title, this was not a false positive. Google flagged this domain for legitimate reasons. Where are you getting that from? I don't see any evidence that there actually was any malicious activity going on on the Immich domain. > But in terms of the API service Google are providing here this is absolutely not a false positive. Google is a…

> its target variable is not present, that is the very definition of a false positive

The target variable is user hosted content on subdomains of a domain not listed in Mozilla's public suffix list. Firefox & Chrome apply a much stricter set of security settings for domains on that list, due to the inherent dangers of multiuser domains. That variable is present, Immich have acknowledged it & are migrating to a new domain (which they will hopefully add to Mozilla's list).

> The fact that you didn't lock your door does not legitimize the thief's behavior. Google's behavior is still improper here

I made no claims about legitimising the thief's behaviour - only that leaving your door unlocked was negligent from the perspective of your housemate. That doesn't absolve the thief. Just as any malicious actor trying to compromise Immich users would still be the primary offender here, but that doesn't absolve Immich of a responsibility to take application security seriously.

And I don't really understand where Google fits in your analogy? Is Google the thief? It seems like a confusing analogy.

Re: Google flags Immich sites as dangerous

#588

Post by lucideer »

CaptainOfCoit wrote: post #541
lucideer wrote: post #449

Earlier quoted context omitted.

> mitigating false positives First & foremost I really need to emphasise that, despite the misleading article title, this was not a false positive. Google flagged this domain for legitimate reasons. I think there's likely a conversation to be had about messaging - Chrome's warning page seems a little scarier than it should be, Firefox's is more measured in its messaging. But in terms of the API service Google are pro…

> First & foremost I really need to emphasise that, despite the misleading article title, this was not a false positive. Google flagged this domain for legitimate reasons. Judging by what a person from the Immich team said, that does not seem to be true? > the whole system only works for PRs from internal branches - https://news.ycombinator.com/item?id=45681230 So unless one of the developers in the team published so…

Anyone can open a PR. Deploys are triggered by an Immich collaborator labelling the PR, but it doesn't require them to review or approve the code being deployed.

Re: Google flags Immich sites as dangerous

#589

Post by lucideer »

marcosdumay wrote: post #568
lucideer wrote: post #449

Earlier quoted context omitted.

> mitigating false positives First & foremost I really need to emphasise that, despite the misleading article title, this was not a false positive. Google flagged this domain for legitimate reasons. I think there's likely a conversation to be had about messaging - Chrome's warning page seems a little scarier than it should be, Firefox's is more measured in its messaging. But in terms of the API service Google are pro…

Do you know the legitimate reasons? Because the article seems to only ever get an excuse from Google that is easy to dismiss because most sites do something similar.

The legitimate reason is that the domain is correctly classified as having user generated active content, because the Immich GitHub repo allows anyone to submit arbitrary code via PR, and PRs can be autodeployed to this domain without passing review or approval.

Domains with user generated active content should typically by listed on Mozilla's Public Suffix list, which Firefox & Chrome both check & automatically apply stricter security settings to, to protect users.

Re: Google flags Immich sites as dangerous

#590

Post by lucideer »

MetaWhirledPeas wrote: post #479
lucideer wrote: post #449

Earlier quoted context omitted.

> mitigating false positives First & foremost I really need to emphasise that, despite the misleading article title, this was not a false positive. Google flagged this domain for legitimate reasons. I think there's likely a conversation to be had about messaging - Chrome's warning page seems a little scarier than it should be, Firefox's is more measured in its messaging. But in terms of the API service Google are pro…

> Google flagged this domain for legitimate reasons. Why would it flag a domain rather than a subdomain?

Which subdomain?
Post reply on HN