8 ms·

Stop StopBadware.org and Google from UNFAIRLY blocking websites

Google (via StopBadware.org) has blocked our website. The blocking started immediately: before allowing us to respond to their accusations and even before we realized any accusations had been laid. Should Google (and StopBadware.org) have the power to effectively banish websites from the web without any due process? Your business or organizations is also at risk of summary conviction and immediate punishment (blocked!) without any due process. What do you think about that?!? Note that websites are blocked for Chrome and Firefox users, since both of these use StopBadware.org. See "DETAILS" in a reply below (it wouldn't fit in Hackernews' 2000 char limit). Our website is not some click-bait shady website. We are the national governing body for a sport. Our members need our website to find out about tournaments. Our tournament organizers need our website to lookup info about players to run their tournaments. So there is real economic and reputational damage to us as a result of Google deciding to block us without any due process. The punishment remains in effect while we wait for another review. Should Google have this power? Should Google be allowed to inflict immediate punishment (blocking)? Should Google give at least 5 business days notice before they inflict punishment? Or should it be more like the criminal justice system, innocent until proven guilty including after an appeal. This is important as there can be real economic and reputational damage resulting from these autocratic actions.

BareNakedCoder 6y ago
DETAILS: On July 3, our website was blocked the 1st time. This was justified (although I disagree with the immediate punishment): it was an old Drupal 7 site that was installed in 2011 and, because of budget constraints, rarely received security patches. For years, it had the Drupageddon and Drupalgeddon exposures. Not surprising it was infested with malware. This is when I got involved (volunteering my time & skills). The website was rewritten as a static site (virtually unhackable) using Hugo on Netlify. On July 26, we were unblocked. At 1am ET this morning (Aug 1), we were blocked by Google again! The new (Hugo) website had one link to the old (Drupal) website (now with a different subdomain) so users could access content we had not yet migrated to the new website. This link was the reason Google gave for blocking us. I read Google's notification at 6am and immediately removed the links and requested a review via Google's Search Console. At 9am, Google said the review had failed, our website was still blocked, without any additional information. Search Console still says the bad link is to the old website's subdomain. I verified my Hugo source files: there is zero instances of the old website's subdomain name. At 10:30 I submitted another request for review and am still waiting for a response. Their request pop-up says "Warning! Requesting a review of issues that weren't fixed will result in longer review cycles" so I may be waiting a longer time. (BTW, anyone with inside Google connections, help would be appreciated)
- dragonwriter 6y ago
  So, it's your complaint isn't, as you initially presented it, that you were unfairly listed as a badware site, but instead that you were rightly listed once, asked to be delisted after incompletely dealing with the problem, rightly failed the subsequent review, but this time you really did deal with it?
  - BareNakedCoder 6y ago
    Huh? The key point here is I don't think Google should block any website without providing some warning an an opportunity to fix the issue before imposing an immediate punishment. What if google.com search engine linked to a badware website? Should it be immediately blocked until fixed pending a review? No, of course not. Do onto others as you would have others do onto you.
    - dragonwriter 6y ago
      > The key point here is I don't think Google should block any website without providing some warning an an opportunity to fix the issue before imposing an immediate punishment. This isn't punishment, it's end-user protection of the same type as other anti-malware tools. And the protection fundamentally cannot work if operated in the way you suggest. To use your criminal justice analogue you've not only confessed to the crime, but confessed to continuing the crime while seeking pre-trial release, after an evolving series of denials.
gus_massa 6y ago
> We are the national governing body for a sport. Link?
- BareNakedCoder 6y ago
  I hesitated to include it: didn't want HN to mess with our analytics and free hosting limits (or our review at the mercy of Google). What the hell, here it is: https://www.chess.ca/ https://www.chess.ca/
  - gus_massa 6y ago
    We used to have Matt Cutts [1] here, and he used to take a look at somewhat similar problem. I just guess that if someone is going to give e hand, s/he needs the link to take an unofficial look. There is still a link to the old site in https://www.chess.ca/en/ws/under-construction/ https://www.chess.ca/en/ws/under-construction/ [1] https://en.wikipedia.org/wiki/Matt_Cutts https://en.wikipedia.org/wiki/Matt_Cutts
    - BareNakedCoder 6y ago
      The /en/ws/under-construction link is to http://www.chess.ca/en/ws/old-chess-ca/ http://www.chess.ca/en/ws/old-chess-ca/ which is a page on the new website that explains the dangers before you click a button to actually go to the old site. The link on the explanation page is what I removed.
      - dragonwriter 6y ago
        > which is a page on the new website that explains the dangers before you click a button to actually go to the old site. So the new site still intentionally (contrary to your prior claim that all links were removed and that you verified this in your source) links to the old site, and you don't understand why the appeal of the badware listing due to that link failed?
        6y ago
dragonwriter 6y ago
> Or should it be more like the criminal justice system, innocent until proven guilty including after an appeal. In the criminal justice system, jail or restrictive bail conditions pending outcome of trial is common.
- BareNakedCoder 6y ago
  Yes, when the accused is a threat to society or a flight risk. Our website is neither.
  - dragonwriter 6y ago
    Yes, a site that you admit was infested with malware due to extended neglect is a threat to society. And you recent admission that, contrary to your second description, it still deliberately links to the old site but with a warning page makes your whole claim of improper listing clearly baseless.
    - BareNakedCoder 6y ago
      (oh dear)
BareNakedCoder 6y ago
This is a very scary situation. It means Google could block your website, not for something bad on your website, but for something bad on another website that you just happen to link to. That's beyond your control! Imagine this happening to a website like wikipedia.org, which as millions of links to external websites. If one of those millions of websites gets hacked, will Google block wikipedia.org? This is like being charged with a crime you didn't commit and being punished immediately without even an initial hearing to respond to the charges! Google and StopBadware.org should not have this power on the internet!
BareNakedCoder 6y ago
UPDATE: For anyone else running into this problem. Of course, Google never clearly stated this reason, I (and you) have to guess until you get it right. Each guess takes more and more time. My last (and successful) attempt, I had to wait 16 hours for Google to do its review and unblock our site. Turns out sites are guilty by association. If Google finds malware on "old.chess.ca" it will bock every website ending in "chess.ca". Including "www.chess.ca" even though that website is on different servers (different IP) and contains zero links to the other bad website. Removing the server from DNS, plus disabling with .htaccess rules that redirect all requests, ... plus waiting 16 hours for Google to do another review ... is what got us back up & running.

BareNakedCoder 6y ago

DETAILS: On July 3, our website was blocked the 1st time. This was justified (although I disagree with the immediate punishment): it was an old Drupal 7 site that was installed in 2011 and, because of budget constraints, rarely received security patches. For years, it had the Drupageddon and Drupalgeddon exposures. Not surprising it was infested with malware. This is when I got involved (volunteering my time & skills). The website was rewritten as a static site (virtually unhackable) using Hugo on Netlify. On July 26, we were unblocked. At 1am ET this morning (Aug 1), we were blocked by Google again! The new (Hugo) website had one link to the old (Drupal) website (now with a different subdomain) so users could access content we had not yet migrated to the new website. This link was the reason Google gave for blocking us. I read Google's notification at 6am and immediately removed the links and requested a review via Google's Search Console. At 9am, Google said the review had failed, our website was still blocked, without any additional information. Search Console still says the bad link is to the old website's subdomain. I verified my Hugo source files: there is zero instances of the old website's subdomain name. At 10:30 I submitted another request for review and am still waiting for a response. Their request pop-up says "Warning! Requesting a review of issues that weren't fixed will result in longer review cycles" so I may be waiting a longer time. (BTW, anyone with inside Google connections, help would be appreciated)

dragonwriter 6y ago
So, it's your complaint isn't, as you initially presented it, that you were unfairly listed as a badware site, but instead that you were rightly listed once, asked to be delisted after incompletely dealing with the problem, rightly failed the subsequent review, but this time you really did deal with it?
- BareNakedCoder 6y ago
  Huh? The key point here is I don't think Google should block any website without providing some warning an an opportunity to fix the issue before imposing an immediate punishment. What if google.com search engine linked to a badware website? Should it be immediately blocked until fixed pending a review? No, of course not. Do onto others as you would have others do onto you.
  - dragonwriter 6y ago
    > The key point here is I don't think Google should block any website without providing some warning an an opportunity to fix the issue before imposing an immediate punishment. This isn't punishment, it's end-user protection of the same type as other anti-malware tools. And the protection fundamentally cannot work if operated in the way you suggest. To use your criminal justice analogue you've not only confessed to the crime, but confessed to continuing the crime while seeking pre-trial release, after an evolving series of denials.

gus_massa 6y ago

> We are the national governing body for a sport. Link?

BareNakedCoder 6y ago
I hesitated to include it: didn't want HN to mess with our analytics and free hosting limits (or our review at the mercy of Google). What the hell, here it is: https://www.chess.ca/ https://www.chess.ca/
- gus_massa 6y ago
  We used to have Matt Cutts [1] here, and he used to take a look at somewhat similar problem. I just guess that if someone is going to give e hand, s/he needs the link to take an unofficial look. There is still a link to the old site in https://www.chess.ca/en/ws/under-construction/ https://www.chess.ca/en/ws/under-construction/ [1] https://en.wikipedia.org/wiki/Matt_Cutts https://en.wikipedia.org/wiki/Matt_Cutts
  - BareNakedCoder 6y ago
    The /en/ws/under-construction link is to http://www.chess.ca/en/ws/old-chess-ca/ http://www.chess.ca/en/ws/old-chess-ca/ which is a page on the new website that explains the dangers before you click a button to actually go to the old site. The link on the explanation page is what I removed.
    - dragonwriter 6y ago
      > which is a page on the new website that explains the dangers before you click a button to actually go to the old site. So the new site still intentionally (contrary to your prior claim that all links were removed and that you verified this in your source) links to the old site, and you don't understand why the appeal of the badware listing due to that link failed?
      - 6y ago

dragonwriter 6y ago

> Or should it be more like the criminal justice system, innocent until proven guilty including after an appeal. In the criminal justice system, jail or restrictive bail conditions pending outcome of trial is common.

BareNakedCoder 6y ago
Yes, when the accused is a threat to society or a flight risk. Our website is neither.
- dragonwriter 6y ago
  Yes, a site that you admit was infested with malware due to extended neglect is a threat to society. And you recent admission that, contrary to your second description, it still deliberately links to the old site but with a warning page makes your whole claim of improper listing clearly baseless.
  - BareNakedCoder 6y ago
    (oh dear)

BareNakedCoder 6y ago

This is a very scary situation. It means Google could block your website, not for something bad on your website, but for something bad on another website that you just happen to link to. That's beyond your control! Imagine this happening to a website like wikipedia.org, which as millions of links to external websites. If one of those millions of websites gets hacked, will Google block wikipedia.org? This is like being charged with a crime you didn't commit and being punished immediately without even an initial hearing to respond to the charges! Google and StopBadware.org should not have this power on the internet!

BareNakedCoder 6y ago

UPDATE: For anyone else running into this problem. Of course, Google never clearly stated this reason, I (and you) have to guess until you get it right. Each guess takes more and more time. My last (and successful) attempt, I had to wait 16 hours for Google to do its review and unblock our site. Turns out sites are guilty by association. If Google finds malware on "old.chess.ca" it will bock every website ending in "chess.ca". Including "www.chess.ca" even though that website is on different servers (different IP) and contains zero links to the other bad website. Removing the server from DNS, plus disabling with .htaccess rules that redirect all requests, ... plus waiting 16 hours for Google to do another review ... is what got us back up & running.