3 ms·

Dropbox actually provides an unique domain for each and every user - and separates the UGC from the web front code and Dropbox own assets that way - that's wher

by vaduz 6y ago

Dropbox actually provides an unique domain for each and every user - and separates the UGC from the web front code and Dropbox own assets that way - that's where the files you preview/download are actually coming from. I have no doubt a fair number of those is blacklisted.

zeusk 6y ago
unique TLD? that should be very costly? or does GSB not ban the entire TLD when a subdomain has malicious content? Would be great if our overlords at least publish the overzealous rules we need to abide by.
- vaduz 6y ago
  Dropbox DL and Preview urls take a form of https://uc[26 https://uc[26 character hex string].dl.dropboxusercontent.com/... and https://uc[26 https://uc[26 character hex string].preview.dropboxusercontent.com/... - it does not have to be a separate TLD to avoid being blocked, but it has to be differentiated. This is the same reason why the block of the TFA company did not cause an outage of everyone using CloudFront - GSB does not block full TLDs if it can be shown content is distinct. Same for anyone using S3, Azure equivalents and so on.
  - veesahni 6y ago
    I wonder if there's a threshold here.. When I researched this issue (while we were figuring out how to mitigate it), I did encounter some people who had their entire domains blocked because 1 subdomain had bad content. In fact, this thread itself has mention of that happening to neocities
  - gomox 6y ago
    Author here. It's really not clear what criteria GSB uses to decide at which level the ban should apply.
    - londons_explore 6y ago
      Probably when the ratio of bad sites to good sites at a particular subdomain level passes a threshold.
      - cft 6y ago
        Or when a significant litigation risk is perceived, if the domain level block review is human
- aftbit 6y ago
  My Google-fu is failing me right now, but there is a list of domains like dropboxusercontent.com that are treated as pseudo second-level domains for purposes like this. e.g. u1234.dropboxusercontent.com is treated as a unique domain just like u1234-dropboxusercontent.com would be. Edit: here we go, from another comment - the Public Suffix List: https://publicsuffix.org/ https://publicsuffix.org/

by vaduz 6y ago

zeusk 6y ago

unique TLD? that should be very costly? or does GSB not ban the entire TLD when a subdomain has malicious content? Would be great if our overlords at least publish the overzealous rules we need to abide by.

vaduz 6y ago
Dropbox DL and Preview urls take a form of https://uc[26 https://uc[26 character hex string].dl.dropboxusercontent.com/... and https://uc[26 https://uc[26 character hex string].preview.dropboxusercontent.com/... - it does not have to be a separate TLD to avoid being blocked, but it has to be differentiated. This is the same reason why the block of the TFA company did not cause an outage of everyone using CloudFront - GSB does not block full TLDs if it can be shown content is distinct. Same for anyone using S3, Azure equivalents and so on.
- veesahni 6y ago
  I wonder if there's a threshold here.. When I researched this issue (while we were figuring out how to mitigate it), I did encounter some people who had their entire domains blocked because 1 subdomain had bad content. In fact, this thread itself has mention of that happening to neocities
- gomox 6y ago
  Author here. It's really not clear what criteria GSB uses to decide at which level the ban should apply.
  - londons_explore 6y ago
    Probably when the ratio of bad sites to good sites at a particular subdomain level passes a threshold.
    - cft 6y ago
      Or when a significant litigation risk is perceived, if the domain level block review is human
aftbit 6y ago
My Google-fu is failing me right now, but there is a list of domains like dropboxusercontent.com that are treated as pseudo second-level domains for purposes like this. e.g. u1234.dropboxusercontent.com is treated as a unique domain just like u1234-dropboxusercontent.com would be. Edit: here we go, from another comment - the Public Suffix List: https://publicsuffix.org/ https://publicsuffix.org/