Google Domains blocking all Gitbook URLS: post-mortem • Hacker News Board

Re: Google Domains blocking all Gitbook URLS: post-mortem

#61

Post by acituan » Thu, Jun 04, 2020, 9:14 PM UTC

robk wrote: post #60

If you were hosting phishing sites then I'm glad they did this. You should have better controls.

According to the postmortem they had removed the site in question a week back. Google was acting on a week old data.

Besides, any user-content serving platform will have to deal with malicious users. It is not a perfect process, especially against bot traffic. Shutting down the whole domain was very heavy handed.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#62

Post by MattGaiser » Thu, Jun 04, 2020, 9:15 PM UTC

robk wrote: post #60

If you were hosting phishing sites then I'm glad they did this. You should have better controls.

There is spam on Facebook, there is spam on Reddit, there is spam on Twitter, there is spam on Hacker News.

Proactive spam control is not a solved problem anywhere. Banning a website over it is absurd.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#63

Post by Animats » Thu, Jun 04, 2020, 9:18 PM UTC

The biggest hoster of phishing sites is Google.[1] Here's a list of major sites which have live entries in PhishTank.[2] Hosting phishing sites on Google Drive is very popular.

Many of those are long gone, but PhishTank hasn't cleaned them out, so they're still listed.

[1] http://www.sitetruth.com/reports/phishes.html [2] http://www.sitetruth.com/fcgi/ratingdetails.fcgi?details=tru...

Re: Google Domains blocking all Gitbook URLS: post-mortem

#64

Post by dundercoder » Thu, Jun 04, 2020, 9:18 PM UTC

This mirrors my experience with google support, even as a paying gsuite customer. I lost a YouTube channel and wasn’t given any option to restore it. Their advice was to just re upload all the content and forget about view counts and old links that would no longer work.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#65

Post by boromi » Thu, Jun 04, 2020, 9:30 PM UTC

dundercoder wrote: post #64

This mirrors my experience with google support, even as a paying gsuite customer. I lost a YouTube channel and wasn’t given any option to restore it. Their advice was to just re upload all the content and forget about view counts and old links that would no longer work.

I'm going through issues with G Suite as an admin. They randomly blocked my account falsely accusing me of sending spam. I can't even access the help support team sicne I can't login to the system.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#66

Post by coronadisaster » Thu, Jun 04, 2020, 9:40 PM UTC

A bit off topic but Google blocks me constantly from accessing my gmail account... is there anyway to disable the "suspicious activity" "protection"?

Re: Google Domains blocking all Gitbook URLS: post-mortem

#67

Post by zadokshi » Thu, Jun 04, 2020, 9:46 PM UTC

411111111111111 wrote: post #43

Semaphor wrote: post #35

Earlier quoted context omitted.

> they support a lot of the new TLDs like .io which is also a lot cheaper. You might want to pick another example, .io is 23 years old [0] [0]: https://en.wikipedia.org/wiki/.io

For some reason people keep forgetting that io stands for indian ocean and is actually a regional tld like co.uk .net .de etc Same with .ai fwiw.

No one forgot. Everyone knows. No one cares.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#68

Post by coffeefirst » Thu, Jun 04, 2020, 10:06 PM UTC

strooper wrote: post #20

Just out of curiosity- when Google is infamous for hard-to-reach human support, what in the Internet would make anyone interested to register their domain with them? Do they provide some sort of security or insurance that I am unaware of? All the popular dedicated domain registrars I have used so far have excellent human support. Godaddy, namecheap, namesilo to name a few. I don't know if big companies or corporate u…

Because I bought it 10 years ago, when Google was a very different organization, and moving would appear to risk some email downtime.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#69

Post by fouric » Thu, Jun 04, 2020, 10:09 PM UTC

boromi wrote: post #65

dundercoder wrote: post #64

This mirrors my experience with google support, even as a paying gsuite customer. I lost a YouTube channel and wasn’t given any option to restore it. Their advice was to just re upload all the content and forget about view counts and old links that would no longer work.

I'm going through issues with G Suite as an admin. They randomly blocked my account falsely accusing me of sending spam. I can't even access the help support team sicne I can't login to the system.

This is completely insane - there's absolutely no legitimate reason for Google to lock you out of your account, even if you were sending spam emails. Disable your ability to send new emails, maybe. Lock you out of your email inbox, maybe. But completely prevent you from accessing your account, and therefore even appealing? Inexcusable.

Re: Google Domains blocking all Gitbook URLS: post-mortem

#70

Post by heipei » Thu, Jun 04, 2020, 10:14 PM UTC

Animats wrote: post #63

The biggest hoster of phishing sites is Google.[1] Here's a list of major sites which have live entries in PhishTank.[2] Hosting phishing sites on Google Drive is very popular. Many of those are long gone, but PhishTank hasn't cleaned them out, so they're still listed. [1] http://www.sitetruth.com/reports/phishes.html [2] http://www.sitetruth.com/fcgi/ratingdetails.fcgi?details=tru...

To be fair, every platform which allows user-generated HTML pages suffers massively from phishing and most of them don't deal with it very well: Google, Microsoft, smaller players like Codebox and countless others. Then there's phishing on Dropbox, phishing on Google Forms, OneDrive, etc. Then you have phishing at all the various hosters like DigitalOcean, CloudFlare, etc. Even there you'll sometimes have IPs which have hosting phishing pages for various brands for a long time. It's not an isolated problem. Some deal with it more aggressively, true, but the pace and ease with which phishing can be stood up and modified makes it a whac-a-mole. Plus, the expectation is that most phishing pages will only be active for a few hours before being taken down and/or detected, so phishers pump out new ones on a constant basis.

I run the service at https://urlscan.io which tracks phishing and frequently run into these cases which render any kind of black/whitelisting impossible. Imagine Microsoft phishing hosted on Microsoft domains and infrastructure. Here's a fun search which will return lots of phishing on windows[.]net and googleapis[.]com: https://urlscan.io/search/#page.domain%3A(googleapis.com%20O...