5 ms·

To be quite honest, this seems like a case of Libel and possibly Tortious Interference on behalf of Google/Alphabet. Especially if you can show damages/custome

To be quite honest, this seems like a case of Libel and possibly Tortious Interference on behalf of Google/Alphabet. Especially if you can show damages/customers cancelling service, I think this would be a hill to die on. Google et al have too much power, even over people and orgs that aren't even customers. Its high time we reign their powers in, find them strongly culpable for what they do (and what they change and then refuse to do), and consider breaking up these monster companies up when they show they are against the public interest. Were you, uploaderwin, given a notice prior (say to abuse@uploader.win , admin@uploader.win or other appropriate mails) to being effectively banned WRT google? I'd go on a limb and say you didnt. No, you have to be aware of the right page at Google, register you as an admin to the site, and hope they share what they consider abuse. And frankly, you were lucky you got the social media escalation. You should have never had this happen... But here we are.

kemayo 6y ago
Based on what the article says, it sounds like the Google auto-blocking was correct. The website owner's theory is that someone used their demo to upload a genuinely malicious file, and presumably then shared it to others. Adding the site to their blocklist immediately is a reasonable action taken in defense of Google's users. It's certainly not libel for them to truthfully say the website is hosting malicious content. Well, not in the US; other jurisdictions don't necessarily have truth as a defense. (Tortious interference is complicated, but typically requires that the person interfering knows about the business relationship they're obstructing, and is taking the action for the purpose of obstructing it. It seems like a stretch here.) As always with Google, the real issue here is their awful communication and slow responses to people who can't find a way to go outside the normal channels. EDIT: and the article has some useful suggestions for practices to follow if you need to let people upload files as a demo. I hadn't really considered the purpose of a separate domain for such things from this angle before.
- croh 6y ago
  > Based on what the article says, it sounds like the Google auto-blocking was correct. Even it is correct, we can't assume it will be always correct. > As always with Google, the real issue here is their awful communication and slow responses to people who can't find a way to go outside the normal channels. Real problem is their slow repsponse can kill business (or may be people). If they are yielding this much power, there must be atleast some paid support service. I guess, it is time, all govs should look into this and regulate FAANG.
hn_throwaway_99 6y ago
I think it's fairly easy to acknowledge the the following are all true: 1. The poster was hosting malicious content from their domain (user uploaded no doubt, but still on the domain they control). 2. On one hand, it is desirable that people who are not malicious be given enough information as fast as possible to rectify their sites. 3. On the other hand, this same sort of information can make it easier for malicious users to evade detection. That is, it seems to me like there is an inherent tension between #2 and #3 that make a simple solution difficult. Seems to me that: 1. As the poster discovered, user content should always be hosted on a separate domain. Google should recommend this as a standard good practice. 2. Perhaps I'm missing something, but when Google blocks an entire domain, I don't see the harm in telling the site owner which subdomain is causing the flag, which could let good users identify the problem faster.
- mortehu 6y ago
  If you're hosting lots of malware on different subdomains, there is harm in Google telling you which ones it detected. You could use that information to keep hosting the undetected malware, perhaps out of laziness.
  - hn_throwaway_99 6y ago
    Perhaps just telling the site owner a max of 1 compromised subdomain, e.g. "We detected malware on sub.yourdomain.com" or "We detected malware on sub.yourdomain.com and potentially other subdomains." Seems like that would provide a huge benefit to people trying to be compliant without much benefit to bad guys hosting lots of malware on different subdomains.
- LocalH 6y ago
  > On the other hand, this same sort of information can make it easier for malicious users to evade detection I never bought that excuse. That sounds like saying we should be secretive about legal charges brought against a person, lest that information help criminals evade detection.
  - 6y ago

kemayo 6y ago

Based on what the article says, it sounds like the Google auto-blocking was correct. The website owner's theory is that someone used their demo to upload a genuinely malicious file, and presumably then shared it to others. Adding the site to their blocklist immediately is a reasonable action taken in defense of Google's users. It's certainly not libel for them to truthfully say the website is hosting malicious content. Well, not in the US; other jurisdictions don't necessarily have truth as a defense. (Tortious interference is complicated, but typically requires that the person interfering knows about the business relationship they're obstructing, and is taking the action for the purpose of obstructing it. It seems like a stretch here.) As always with Google, the real issue here is their awful communication and slow responses to people who can't find a way to go outside the normal channels. EDIT: and the article has some useful suggestions for practices to follow if you need to let people upload files as a demo. I hadn't really considered the purpose of a separate domain for such things from this angle before.

croh 6y ago
> Based on what the article says, it sounds like the Google auto-blocking was correct. Even it is correct, we can't assume it will be always correct. > As always with Google, the real issue here is their awful communication and slow responses to people who can't find a way to go outside the normal channels. Real problem is their slow repsponse can kill business (or may be people). If they are yielding this much power, there must be atleast some paid support service. I guess, it is time, all govs should look into this and regulate FAANG.

hn_throwaway_99 6y ago

I think it's fairly easy to acknowledge the the following are all true: 1. The poster was hosting malicious content from their domain (user uploaded no doubt, but still on the domain they control). 2. On one hand, it is desirable that people who are not malicious be given enough information as fast as possible to rectify their sites. 3. On the other hand, this same sort of information can make it easier for malicious users to evade detection. That is, it seems to me like there is an inherent tension between #2 and #3 that make a simple solution difficult. Seems to me that: 1. As the poster discovered, user content should always be hosted on a separate domain. Google should recommend this as a standard good practice. 2. Perhaps I'm missing something, but when Google blocks an entire domain, I don't see the harm in telling the site owner which subdomain is causing the flag, which could let good users identify the problem faster.

mortehu 6y ago
If you're hosting lots of malware on different subdomains, there is harm in Google telling you which ones it detected. You could use that information to keep hosting the undetected malware, perhaps out of laziness.
- hn_throwaway_99 6y ago
  Perhaps just telling the site owner a max of 1 compromised subdomain, e.g. "We detected malware on sub.yourdomain.com" or "We detected malware on sub.yourdomain.com and potentially other subdomains." Seems like that would provide a huge benefit to people trying to be compliant without much benefit to bad guys hosting lots of malware on different subdomains.
LocalH 6y ago
> On the other hand, this same sort of information can make it easier for malicious users to evade detection I never bought that excuse. That sounds like saying we should be secretive about legal charges brought against a person, lest that information help criminals evade detection.
- 6y ago