3 ms·

Something tells me that Google doesn't ban G Drive, Dropbox or MS's what ever it is named when those host malware. I rather not have only the giants host user g

Something tells me that Google doesn't ban G Drive, Dropbox or MS's what ever it is named when those host malware. I rather not have only the giants host user generated content ...

lrem 6y ago
Google does the silly separate domain dance GP recommended. I couldn't figure out what is it for, until I read this advice in the previous discussion. Disclaimer: I'm a Google SRE. But never supported anything reachable from the outside.
- alisonkisk 6y ago
  Google doesn't have a separate domain for Drive files, for example, nor do they have separate per-user domains under googleusercontent.com for photos etc
  - lrem 6y ago
    According to my Firefox, the JPEG file I just tried came from googleusercontent. But you're right, it's not per-user.
- asdfasgasdgasdg 6y ago
  That's not what it's for. It's to prevent user content from being served from the same origin as Google services. If the content were to be served from the same origin, scripts loaded from that origin would be able to access your google cookies and therefore would be able to access your account data.
  - lrem 6y ago
    Oh. I even heard about this mechanism before ;) Thanks, this makes more sense.
temp667 6y ago
First - most of these places are running pretty advanced virus / malware scanners. So when you go to download a file from drive etc, a scan is done (at least for files that are not enormous). This is actually a big issue sometimes for folks who use google drive, because malware will infect their files, they will then be synced to google, then blocked from downloading them ever again! That leads to support requests list this: https://support.google.com/a/thread/60528209?hl=en https://support.google.com/a/thread/60528209?hl=en Even if you pay the ransomeware fee, google WILL NOT let you access your own files again. So years worth of files - GONE. They do use different origins for these services. Google DOES actively ban users (everything, youtube, drive and email) from their service even users using google services (vs a third party upload service). Ie, if you are going to run a phishing scam, host the image on this service, not google, or your drive account + a lot of other stuff is at risk. I've even seen google follow links to other accounts your google account is an admin on, so can have business impacts and more. I don't know where the idea comes from that google is very hands off on this stuff, they run a major spam fighting op that blocks lots of even potentially legit email, they do tons of scans through chrome, they do advanced stuff for opt-in domains on their paid platforms (even more intrusive but let's them pick stuff up behind password locked pages etc). This last one can really confuse site owners, when NON PUBLIC content results in site bans.

Something tells me that Google doesn't ban G Drive, Dropbox or MS's what ever it is named when those host malware. I rather not have only the giants host user generated content ...

lrem 6y ago

Google does the silly separate domain dance GP recommended. I couldn't figure out what is it for, until I read this advice in the previous discussion. Disclaimer: I'm a Google SRE. But never supported anything reachable from the outside.

alisonkisk 6y ago
Google doesn't have a separate domain for Drive files, for example, nor do they have separate per-user domains under googleusercontent.com for photos etc
- lrem 6y ago
  According to my Firefox, the JPEG file I just tried came from googleusercontent. But you're right, it's not per-user.
asdfasgasdgasdg 6y ago
That's not what it's for. It's to prevent user content from being served from the same origin as Google services. If the content were to be served from the same origin, scripts loaded from that origin would be able to access your google cookies and therefore would be able to access your account data.
- lrem 6y ago
  Oh. I even heard about this mechanism before ;) Thanks, this makes more sense.

temp667 6y ago

First - most of these places are running pretty advanced virus / malware scanners. So when you go to download a file from drive etc, a scan is done (at least for files that are not enormous). This is actually a big issue sometimes for folks who use google drive, because malware will infect their files, they will then be synced to google, then blocked from downloading them ever again! That leads to support requests list this: https://support.google.com/a/thread/60528209?hl=en https://support.google.com/a/thread/60528209?hl=en Even if you pay the ransomeware fee, google WILL NOT let you access your own files again. So years worth of files - GONE. They do use different origins for these services. Google DOES actively ban users (everything, youtube, drive and email) from their service even users using google services (vs a third party upload service). Ie, if you are going to run a phishing scam, host the image on this service, not google, or your drive account + a lot of other stuff is at risk. I've even seen google follow links to other accounts your google account is an admin on, so can have business impacts and more. I don't know where the idea comes from that google is very hands off on this stuff, they run a major spam fighting op that blocks lots of even potentially legit email, they do tons of scans through chrome, they do advanced stuff for opt-in domains on their paid platforms (even more intrusive but let's them pick stuff up behind password locked pages etc). This last one can really confuse site owners, when NON PUBLIC content results in site bans.