6 ms·

It's generally good advice, but I don't see that Safe Browsing did anything wrong in this case. First, it sounds like they actually were briefly hosting phishi

It's generally good advice, but I don't see that Safe Browsing did anything wrong in this case. First, it sounds like they actually were briefly hosting phishing sites: > All sites on statichost.eu get a SITE-NAME.statichost.eu domain, and during the weekend there was an influx of phishing sites. Second, they should be using the public suffix list (https://publicsuffix.org/ https://publicsuffix.org/) to avoid having their entire domain tagged. How else is Google supposed to know that subdomains belong to different users? That's what the PSL is for. From my reading, Safe Browsing did its job correctly in this case, and they restored the site quickly once the threat was removed.

ericselin 11mo ago
I'm not saying that Google or Safe Browsing in particular did anything wrong per se. My point is primarily that Google has too much power over the internet. I know that in this case what actually happened is because of me not putting enough effort into fending off bad guys. The new separate domain is pending inclusion in the PSL, yes. Edit: the "effort" I'm talking about above refers to more real time moderation of content.
- dormento 11mo ago
  Exactly. > Second, they should be using the public suffix list (https://publicsuffix.org/ https://publicsuffix.org/) to avoid having their entire domain tagged. NO, Google should be "mindful" (I know companies are not people but w/e) of the power it unfortunately has. Also, Cloudflare. All my homies hate Cloudflare.
  - shadowgovt 11mo ago
    It is mindful. ... by using the agreed-upon tool to track domains that treat themselves as TLDs for third-party content: the public suffix list. Microsoft Edge and Firefox also use the PSL and their mechanisms for protecting users would be similarly suspicious that attacks originating from statichost.eu were originating from the owners of that domain and not some third-party that happened to independently control foo.statichost.eu.
- sokoloff 11mo ago
  > My point is primarily that Google has too much power over the internet. That is probably true, but in this case I think most people would think that they used that power for good. It was inconvenient for you and the legitimate parts of what was hosted on your domain, but it was blocking genuinely phishing content that was also hosted on your domain.
  - fragmede 11mo ago
    Every website operator employee worth their salary in this area would have told the site's operator this beforehand, and could have avoided this incident. Hell, even ChatGPT could tell you that by now. The word that comes to mind is incompetence on someone's part, but I don't know of the details on particularly who was the incompetent one in this situation. Thankfully, they've learned a lesson about the situation and ideally won't make the same mistake again going forwards.
    - trod1234 11mo ago
      I disagree, as a professional in this field for over a decade. For this to be a legitimately backed statement, professional's would have needed to know about the PSL. This is largely unmet. For it to be met, there would need to be documentation in the form of RFC's and whitepapers in industry working groups which would be needed. This didn't happen. M3AAWG only has two blog post mentions, and that's only after the great layoffs of 2023, and only that its being used by volunteers and needs support. No discussion about organization, what its being used for, process/due process, etc. It wholly lacks the needed outreach to professionals in order to make such a statement and have it be true.
      - fragmede 11mo ago
        I mean, it's a very big field, and it's easy enough for me to armchair quarterback and call it a skill issue without being vulnerable and putting my own credentials into question. There's a whole big world of things to know about making and running websites, and I'll readily admit I don't know everything. I don't do a lot of CSS or website SEO or run ad campaigns, so someone experienced there will run circles around me. Putting user generated content on its own domain is more on the security side of things to know about running a website, and our industry doesn't regulate who's allowed to build websites. Everyone's got their own set of different best practices. Regardless of the exact date that GitHub moved which kinds of user generated content (UGC) over to which domain/domains, I do expect a curious webdev in 2025 to have used GitHub and to have wondered enough about it to ask what's up with stuff coming from eg raw.githubusercontent.com at some point in their web browsing career to ask Google about it. They should have walked away with the idea that they're putting UGC on a separate domain intentionally for security stuff, even if they never hear mention of the PSL or how exactly it works and is implemented. The /r/webdev post you'll find links to a GitHub blog post that gives a lot of detail as to why they did that, and that doesn't mention the PSL once. It's fair to point out the PSL isn't common knowledge. I would agree that it isn't. I don't think it's necessary, however. All it takes is being a user of GitHub and a modicum of curiosity. I expect anyone that call themselves a webdev in 2025 to be able to explain to me what git and GitHub is and why they're different. They don't need to know where git came from but I don't think I'm being unreasonable in asking that much. From there, I expect someone to be able to make up an answer as to why there's raw.githubusercontent.com during an interview and mumble something about security, even if they can't give specific details about cookies and phishing and how that all works. It's possible I'm being unreasonable here but I don't think I am. This isn't knowledge that takes attending W3C meetings about web browser standards to have come across. Regardless of if I am or not though, everyone who's come across this thread should now know that UGC goes in its own domain, even if they can't give details as to why.
- shadowgovt 11mo ago
  There are two aspects to the Internet: the technical and the social. In the social, there is always someone with most of the power (distributed power is an unstable equilibrium), and it's incumbent upon us, the web developers, to know the current status quo. Back in the day, if you weren't testing on IE6 you weren't serving a critical mass of your potential users. Nowadays, the nameplates have changed but the same principles hold.
  - j45 11mo ago
    Social wasn't always sole powered, only began with the later social networks, not the early. And now people are retreating to smaller communities anyways. Testing on IE6 wasn't the requirement, all browser's was. IE shipped default on windows and basically forced themselves into the browser conversation with an incomplete browser.
    - shadowgovt 11mo ago
      I don't mean social as in social network. I mean that people have always been a key aspect of the technology and how it it practically works. Yes, yes, IE6 shipped by default shipped by default on Windows. And therefore if you wanted a website that worked, you tested against IE6. Otherwise people would try and use your website and it wouldn't work and they wouldn't blame the browser, they would blame your website. Those social aspects introduce a bunch of not necessarily written rules that you just have to know and learn as you develop for the web.
- stickfigure 11mo ago
  "Google does good thing, therefore Google has too much power over the internet" is not a convincing point to make. This safety feature saves a nontrivial number of people from life-changing mistakes. Yes we publishers have to take extra care. Hard to see a negative here.
  - ericselin 11mo ago
    I respectfully disagree with your premise. In this specific case, yes, "Google does good thing" in a sense. That is not why I'm saying Google has too much power. "Too much" is relative and whether they do good or bad debatable, of course, but it's hard to argue that they don't have a gigantic influence on the whole internet, no? :) Helping people avoid potentially devastating mistakes is of course a good thing.
    - thetimman8 11mo ago
      You're not wrong. You just picked a poor example which illustrates the opposite of the point you're making.
      - ericselin 11mo ago
        Fair enough! :)
    - neon_erosion 11mo ago
      What point are you trying to make here? You hosted phishing sites on your primary domain, which was then flagged as unsafe. You chose not to use the tools that would have marked those sites as belonging to individual users, and the system worked as designed.
      - ericselin 11mo ago
        Please note that this tool (PSL) is not available until you have a significant user base. Which probably means a significant amount of spam as well.
- neon_erosion 11mo ago
  How does flagging a domain that was actively hosting phishing sites demonstrate that Google has too much power? They do, but this is a terrible example, undermining any point you are trying to make.
  - j45 11mo ago
    Maybe google can have large impact is a more accurate way of putting it vs power.
  - jeroenhd 11mo ago
    The thing about Google is that they regularly get this stuff wrong, and there is no recourse when they do. I think most people working in tech know the extent to which Google can screw over a business when they make a mistake, but the gravity of the situation becomes much clearer when it actually happens to you. This time it's a phishing website, but what if the same happens five years down the line because of an unflattering page about a megalomaniac US politician?
    - neon_erosion 11mo ago
      Then that would be an example of a system having failed and one that needs to change. Instead, this is an example of a hosting company complaining about the consequences of skipping some of the basic, well-documented safety and security practices that help to isolate domains for all sorts of reasons, from reputation to little things like user cookies.
    - gcr 11mo ago
      This article shows an example of this process working as intended though. The user's site was hosting phishing material. Google showed the site owner what was wrong, provided concrete steps to remedy the situation, and removed the warning within a few hours of being notified that it was resolved. Google's support sucks in other ways, but this particular example went very smoothly.
    - arcfour 11mo ago
      > Oh my god, my site was unavailable for 7 hours because I hosted phishing! Won't someone please think of the website operator?
- faust201 11mo ago
  > Google has too much power over the internet. In this case they did use it for good cause. Yes, alternatively you could have prevented the whole thing from happening if you cared about customers.
deleted 11mo ago
[deleted]
rasengan 11mo ago
Getting on the public suffix list is easier said than done [1]. They can simply say no if they feel like it and are making sure to be able to keep said rights as a "project" vs a "business," [2] which has its pros and cons. [1] https://github.com/publicsuffix/list/blob/main/public_suffix_list.dat https://github.com/publicsuffix/list/blob/main/public_suffix... [2] https://groups.google.com/g/publicsuffix-discuss/c/xJZHBlyqqJ0?pli=1 https://groups.google.com/g/publicsuffix-discuss/c/xJZHBlyqq...
- RandomBK 11mo ago
  > Getting on the public suffix list is easier said than done [1]. Can you elaborate on this? I didn't see anything in either link that would indicate unreasonable challenges. The PSL naturally has a a series of validation requirements, but I haven't heard of any undue shenanigans. Is it great that such vital infrastructure is held together by a ragtag band of unpaid volunteers? No; but that's hardly unique in this space.
KronisLV 11mo ago
> Second, they should be using the public suffix list (https://publicsuffix.org/ https://publicsuffix.org/) to avoid having their entire domain tagged. How else is Google supposed to know that subdomains belong to different users? That's what the PSL is for. How is this kinda not insane? https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat A centralized list, where you have to apply to be included and it's up to someone else to decide whether you will be allowed in? How is this what they went for: "You want to specify some rules around how subdomains should be treated? Sure, name EVERY domain that this applies to." Why not just something like https://example.com/.well-known/suffixes.dat https://example.com/.well-known/suffixes.dat at the main domain or whatever? Regardless of the particulars, this feels like it should have been an RFC and a standard that avoids such centralization.
- schoen 11mo ago
  There was an IETF working group that was working on a more distributed alternative based on a DNS record (so you could make statements in the DNS about common administrative control of subdomains, or lack of such common control, and other related issues). I believe the working group concluded its work without successfully creating a standard for this, though.
- zorked 11mo ago
  The problem is that you then have to trust the site's own statement about whether its subdomains are independent.
trod1234 11mo ago
Yes, its generally good advice to keep user content on a separate domain. That said, there are a number of IT professionals that aren't aware of the PSL as these are largely initiatives that didn't exist prior to 2023 and don't get a lot of advertisement, or even a requirement. They largely just started being used silently by big players which itself presents issues. There are hundreds if not thousands of whitepapers on industry, and afaik there's only one or two places its mentioned in industry working groups, and those were in blog posts, not whitepapers (at M3AAWG). There's no real documentation of the organization, what its for, and how it should be used in any of the working group whitepapers. Just that it is being used and needs support; not something professional's would pay attention to imo. > Second, they should be using the public suffix list This is flawed reasoning as is. Its hard to claim this with a basis when professionals don't know about this, a small subset just arbitrarily started doing this, and seems more like false justification after-the-fact for throwing the baby out with the bath water. Security is everyone's responsibility, and Google could have narrowly tailored the offending domain name accesses instead of blocking the top-level. They didn't do that, and worse that behavior could even be automated in a way that the process could be extended and there could be a noticing period to the toplevel provider before it started hitting everyone's devices. They also didn't do that apparently. Regardless, no single entity should be able to dictate what other people perceive or see arbitrarily from their devices (without a choice; opt-in) but that is what they've designed these systems to do. Enumerating badness doesn't work. Worse, say the domain names get reassigned to another unrelated customer. Those people are different people, but they are still blocked as happens with small mail servers quite often. Who is responsible when someone who hasn't been engaged with phishing is being arbitrarily punished without due process. Who is to say that google isn't doing this purposefully to retain their monopolies for services they also provide. Its a perilous torturous path where trust cannot be given because they've violated that trust in the past, and have little credibility with all net incentives towards their own profit at the expense of others. They are even willing to regularly break the law, and have never been held to account for it. (i.e. Google Maps WIFI wiretapping). Hanlon's razor is a joke intended as a joke, but there are people that use it literally and inappropriately to deceitfully take advantage of others. Gross negligence coupled with some form of loss is sufficient for general intent which makes the associated actions malicious/malice. Throwing out the baby with the bath water without telling anyone or without warning, is gross negligence.

ericselin 11mo ago

I'm not saying that Google or Safe Browsing in particular did anything wrong per se. My point is primarily that Google has too much power over the internet. I know that in this case what actually happened is because of me not putting enough effort into fending off bad guys. The new separate domain is pending inclusion in the PSL, yes. Edit: the "effort" I'm talking about above refers to more real time moderation of content.

dormento 11mo ago
Exactly. > Second, they should be using the public suffix list (https://publicsuffix.org/ https://publicsuffix.org/) to avoid having their entire domain tagged. NO, Google should be "mindful" (I know companies are not people but w/e) of the power it unfortunately has. Also, Cloudflare. All my homies hate Cloudflare.
- shadowgovt 11mo ago
  It is mindful. ... by using the agreed-upon tool to track domains that treat themselves as TLDs for third-party content: the public suffix list. Microsoft Edge and Firefox also use the PSL and their mechanisms for protecting users would be similarly suspicious that attacks originating from statichost.eu were originating from the owners of that domain and not some third-party that happened to independently control foo.statichost.eu.
sokoloff 11mo ago
> My point is primarily that Google has too much power over the internet. That is probably true, but in this case I think most people would think that they used that power for good. It was inconvenient for you and the legitimate parts of what was hosted on your domain, but it was blocking genuinely phishing content that was also hosted on your domain.
- fragmede 11mo ago
  Every website operator employee worth their salary in this area would have told the site's operator this beforehand, and could have avoided this incident. Hell, even ChatGPT could tell you that by now. The word that comes to mind is incompetence on someone's part, but I don't know of the details on particularly who was the incompetent one in this situation. Thankfully, they've learned a lesson about the situation and ideally won't make the same mistake again going forwards.
  - trod1234 11mo ago
    I disagree, as a professional in this field for over a decade. For this to be a legitimately backed statement, professional's would have needed to know about the PSL. This is largely unmet. For it to be met, there would need to be documentation in the form of RFC's and whitepapers in industry working groups which would be needed. This didn't happen. M3AAWG only has two blog post mentions, and that's only after the great layoffs of 2023, and only that its being used by volunteers and needs support. No discussion about organization, what its being used for, process/due process, etc. It wholly lacks the needed outreach to professionals in order to make such a statement and have it be true.
    - fragmede 11mo ago
      I mean, it's a very big field, and it's easy enough for me to armchair quarterback and call it a skill issue without being vulnerable and putting my own credentials into question. There's a whole big world of things to know about making and running websites, and I'll readily admit I don't know everything. I don't do a lot of CSS or website SEO or run ad campaigns, so someone experienced there will run circles around me. Putting user generated content on its own domain is more on the security side of things to know about running a website, and our industry doesn't regulate who's allowed to build websites. Everyone's got their own set of different best practices. Regardless of the exact date that GitHub moved which kinds of user generated content (UGC) over to which domain/domains, I do expect a curious webdev in 2025 to have used GitHub and to have wondered enough about it to ask what's up with stuff coming from eg raw.githubusercontent.com at some point in their web browsing career to ask Google about it. They should have walked away with the idea that they're putting UGC on a separate domain intentionally for security stuff, even if they never hear mention of the PSL or how exactly it works and is implemented. The /r/webdev post you'll find links to a GitHub blog post that gives a lot of detail as to why they did that, and that doesn't mention the PSL once. It's fair to point out the PSL isn't common knowledge. I would agree that it isn't. I don't think it's necessary, however. All it takes is being a user of GitHub and a modicum of curiosity. I expect anyone that call themselves a webdev in 2025 to be able to explain to me what git and GitHub is and why they're different. They don't need to know where git came from but I don't think I'm being unreasonable in asking that much. From there, I expect someone to be able to make up an answer as to why there's raw.githubusercontent.com during an interview and mumble something about security, even if they can't give specific details about cookies and phishing and how that all works. It's possible I'm being unreasonable here but I don't think I am. This isn't knowledge that takes attending W3C meetings about web browser standards to have come across. Regardless of if I am or not though, everyone who's come across this thread should now know that UGC goes in its own domain, even if they can't give details as to why.
shadowgovt 11mo ago
There are two aspects to the Internet: the technical and the social. In the social, there is always someone with most of the power (distributed power is an unstable equilibrium), and it's incumbent upon us, the web developers, to know the current status quo. Back in the day, if you weren't testing on IE6 you weren't serving a critical mass of your potential users. Nowadays, the nameplates have changed but the same principles hold.
- j45 11mo ago
  Social wasn't always sole powered, only began with the later social networks, not the early. And now people are retreating to smaller communities anyways. Testing on IE6 wasn't the requirement, all browser's was. IE shipped default on windows and basically forced themselves into the browser conversation with an incomplete browser.
  - shadowgovt 11mo ago
    I don't mean social as in social network. I mean that people have always been a key aspect of the technology and how it it practically works. Yes, yes, IE6 shipped by default shipped by default on Windows. And therefore if you wanted a website that worked, you tested against IE6. Otherwise people would try and use your website and it wouldn't work and they wouldn't blame the browser, they would blame your website. Those social aspects introduce a bunch of not necessarily written rules that you just have to know and learn as you develop for the web.
stickfigure 11mo ago
"Google does good thing, therefore Google has too much power over the internet" is not a convincing point to make. This safety feature saves a nontrivial number of people from life-changing mistakes. Yes we publishers have to take extra care. Hard to see a negative here.
- ericselin 11mo ago
  I respectfully disagree with your premise. In this specific case, yes, "Google does good thing" in a sense. That is not why I'm saying Google has too much power. "Too much" is relative and whether they do good or bad debatable, of course, but it's hard to argue that they don't have a gigantic influence on the whole internet, no? :) Helping people avoid potentially devastating mistakes is of course a good thing.
  - thetimman8 11mo ago
    You're not wrong. You just picked a poor example which illustrates the opposite of the point you're making.
    - ericselin 11mo ago
      Fair enough! :)
  - neon_erosion 11mo ago
    What point are you trying to make here? You hosted phishing sites on your primary domain, which was then flagged as unsafe. You chose not to use the tools that would have marked those sites as belonging to individual users, and the system worked as designed.
    - ericselin 11mo ago
      Please note that this tool (PSL) is not available until you have a significant user base. Which probably means a significant amount of spam as well.
neon_erosion 11mo ago
How does flagging a domain that was actively hosting phishing sites demonstrate that Google has too much power? They do, but this is a terrible example, undermining any point you are trying to make.
- j45 11mo ago
  Maybe google can have large impact is a more accurate way of putting it vs power.
- jeroenhd 11mo ago
  The thing about Google is that they regularly get this stuff wrong, and there is no recourse when they do. I think most people working in tech know the extent to which Google can screw over a business when they make a mistake, but the gravity of the situation becomes much clearer when it actually happens to you. This time it's a phishing website, but what if the same happens five years down the line because of an unflattering page about a megalomaniac US politician?
  - neon_erosion 11mo ago
    Then that would be an example of a system having failed and one that needs to change. Instead, this is an example of a hosting company complaining about the consequences of skipping some of the basic, well-documented safety and security practices that help to isolate domains for all sorts of reasons, from reputation to little things like user cookies.
  - gcr 11mo ago
    This article shows an example of this process working as intended though. The user's site was hosting phishing material. Google showed the site owner what was wrong, provided concrete steps to remedy the situation, and removed the warning within a few hours of being notified that it was resolved. Google's support sucks in other ways, but this particular example went very smoothly.
  - arcfour 11mo ago
    > Oh my god, my site was unavailable for 7 hours because I hosted phishing! Won't someone please think of the website operator?
faust201 11mo ago
> Google has too much power over the internet. In this case they did use it for good cause. Yes, alternatively you could have prevented the whole thing from happening if you cared about customers.

deleted 11mo ago

[deleted]

rasengan 11mo ago

Getting on the public suffix list is easier said than done [1]. They can simply say no if they feel like it and are making sure to be able to keep said rights as a "project" vs a "business," [2] which has its pros and cons. [1] https://github.com/publicsuffix/list/blob/main/public_suffix_list.dat https://github.com/publicsuffix/list/blob/main/public_suffix... [2] https://groups.google.com/g/publicsuffix-discuss/c/xJZHBlyqqJ0?pli=1 https://groups.google.com/g/publicsuffix-discuss/c/xJZHBlyqq...

RandomBK 11mo ago
> Getting on the public suffix list is easier said than done [1]. Can you elaborate on this? I didn't see anything in either link that would indicate unreasonable challenges. The PSL naturally has a a series of validation requirements, but I haven't heard of any undue shenanigans. Is it great that such vital infrastructure is held together by a ragtag band of unpaid volunteers? No; but that's hardly unique in this space.

KronisLV 11mo ago

> Second, they should be using the public suffix list (https://publicsuffix.org/ https://publicsuffix.org/) to avoid having their entire domain tagged. How else is Google supposed to know that subdomains belong to different users? That's what the PSL is for. How is this kinda not insane? https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat A centralized list, where you have to apply to be included and it's up to someone else to decide whether you will be allowed in? How is this what they went for: "You want to specify some rules around how subdomains should be treated? Sure, name EVERY domain that this applies to." Why not just something like https://example.com/.well-known/suffixes.dat https://example.com/.well-known/suffixes.dat at the main domain or whatever? Regardless of the particulars, this feels like it should have been an RFC and a standard that avoids such centralization.

schoen 11mo ago
There was an IETF working group that was working on a more distributed alternative based on a DNS record (so you could make statements in the DNS about common administrative control of subdomains, or lack of such common control, and other related issues). I believe the working group concluded its work without successfully creating a standard for this, though.
zorked 11mo ago
The problem is that you then have to trust the site's own statement about whether its subdomains are independent.

trod1234 11mo ago

Yes, its generally good advice to keep user content on a separate domain. That said, there are a number of IT professionals that aren't aware of the PSL as these are largely initiatives that didn't exist prior to 2023 and don't get a lot of advertisement, or even a requirement. They largely just started being used silently by big players which itself presents issues. There are hundreds if not thousands of whitepapers on industry, and afaik there's only one or two places its mentioned in industry working groups, and those were in blog posts, not whitepapers (at M3AAWG). There's no real documentation of the organization, what its for, and how it should be used in any of the working group whitepapers. Just that it is being used and needs support; not something professional's would pay attention to imo. > Second, they should be using the public suffix list This is flawed reasoning as is. Its hard to claim this with a basis when professionals don't know about this, a small subset just arbitrarily started doing this, and seems more like false justification after-the-fact for throwing the baby out with the bath water. Security is everyone's responsibility, and Google could have narrowly tailored the offending domain name accesses instead of blocking the top-level. They didn't do that, and worse that behavior could even be automated in a way that the process could be extended and there could be a noticing period to the toplevel provider before it started hitting everyone's devices. They also didn't do that apparently. Regardless, no single entity should be able to dictate what other people perceive or see arbitrarily from their devices (without a choice; opt-in) but that is what they've designed these systems to do. Enumerating badness doesn't work. Worse, say the domain names get reassigned to another unrelated customer. Those people are different people, but they are still blocked as happens with small mail servers quite often. Who is responsible when someone who hasn't been engaged with phishing is being arbitrarily punished without due process. Who is to say that google isn't doing this purposefully to retain their monopolies for services they also provide. Its a perilous torturous path where trust cannot be given because they've violated that trust in the past, and have little credibility with all net incentives towards their own profit at the expense of others. They are even willing to regularly break the law, and have never been held to account for it. (i.e. Google Maps WIFI wiretapping). Hanlon's razor is a joke intended as a joke, but there are people that use it literally and inappropriately to deceitfully take advantage of others. Gross negligence coupled with some form of loss is sufficient for general intent which makes the associated actions malicious/malice. Throwing out the baby with the bath water without telling anyone or without warning, is gross negligence.