3 ms·

The fact remains is web platforms are in every way at the mercy of Google to be reachable to their clients. Chrome (which your clients most definitely will be u

The fact remains is web platforms are in every way at the mercy of Google to be reachable to their clients. Chrome (which your clients most definitely will be using) has full power to decide if your website is malicious, but you don't even know the criteria of their decision, and so, have little-to-no knowledge on how to adjust your website to pass the criteria again. I have seen web development platforms being blocked out of use for weeks; because some scammers use their service to build their scamming site, causing the whole domain to be marked as spam. However there are still two ways to look at this: The defeatists will say that the open web of the old is now fubar, there is no point in building websites now because whatever you do you are at the whim of BigTechs to dictate the term of your website. I try to keep more optimistic viewpoint. We can see that this is more or less the standard behavior of any antivirus measure, and your browser/antivirus service is tasked with an impossible job of deciding if the data it renders is benign or malicious, and whatever heuristic/criteria it comes up with is going to be leaky and cannot cover every edge cases. Platform should structure their system so that your components are localized, so it will be less susceptible to those kind of outage. Of the top of my mind, what step you should be taking: - Separation of domains between for your own assets/web and what the clients upload. A CDN, online bucket may help you here. - If you are doing a website builder, try to enforce the client to bring their domain to publish. Your default domain should be for evaluation purpose only. It's hard world out there, sympathy to OP for being in this shitty position.

Espionage724 3y ago
Google is correct. The site was hosting malicious content, the site was public-facing, and Google took steps to protect its users trying to visit a site that was hosting malicious content which is more than anyone else would do. What else could you ask for? I can go host malware on my site now, get flagged, take it down, tell Google, get my site un-flagged, and re-host the malware. Google can play cat-and-mouse with me at the expense of its users, or just keep the site flagged until enough time has passed and/or if I make enough noise about it. It's not common for a site to intentionally host malware, and especially uncommon for sites to host malware for non-nefarious purposes.
- gunal2 3y ago
  Google is doing the same business with VirusTotal.com. We're hosting malware as zipped files, and providing passwords to users. It's not possible to accidentally run the malware as user. And the problem is not about this, we removed all the files and Google said you didnt. They're not saying you're not trustable website, they said you still have the files but we haven't.
  - antran22 3y ago
    You have to agree that verifying a website is free from a malware is not possible, while verifying that it has a malware is easy. If I play devil's advocate and say that: 1. A bad actor is publishing a malware at example.com/malware-a.zip; 2. The antivirus measure block them; 3. They move it to example.com/malware-b.zip but tell Google that the site is free from all malware, because if Google hit the old url `example.com/malware-a.zip` it is a 404; Should Google give the bad actor the benefit of the doubt, unblock them/ or keep blocking them? Again, I'm not downplaying the shittiness of the situation both you are in right now, but again, this is the default behavior we are all expecting from any antivirus measure.
- antran22 3y ago
  No I agree with your point and was addressing other blind anti-Google sentiment. While middle-finger to Google for their inhumane ad-based business model, we have to admit that they are doing what they are expected to do in this exact scenario.
danpalmer 3y ago
Safe Browsing is used by Chrome, Safari, Firefox, Vivaldi, Brave, and others.

Espionage724 3y ago

Google is correct. The site was hosting malicious content, the site was public-facing, and Google took steps to protect its users trying to visit a site that was hosting malicious content which is more than anyone else would do. What else could you ask for? I can go host malware on my site now, get flagged, take it down, tell Google, get my site un-flagged, and re-host the malware. Google can play cat-and-mouse with me at the expense of its users, or just keep the site flagged until enough time has passed and/or if I make enough noise about it. It's not common for a site to intentionally host malware, and especially uncommon for sites to host malware for non-nefarious purposes.

gunal2 3y ago
Google is doing the same business with VirusTotal.com. We're hosting malware as zipped files, and providing passwords to users. It's not possible to accidentally run the malware as user. And the problem is not about this, we removed all the files and Google said you didnt. They're not saying you're not trustable website, they said you still have the files but we haven't.
- antran22 3y ago
  You have to agree that verifying a website is free from a malware is not possible, while verifying that it has a malware is easy. If I play devil's advocate and say that: 1. A bad actor is publishing a malware at example.com/malware-a.zip; 2. The antivirus measure block them; 3. They move it to example.com/malware-b.zip but tell Google that the site is free from all malware, because if Google hit the old url `example.com/malware-a.zip` it is a 404; Should Google give the bad actor the benefit of the doubt, unblock them/ or keep blocking them? Again, I'm not downplaying the shittiness of the situation both you are in right now, but again, this is the default behavior we are all expecting from any antivirus measure.
antran22 3y ago
No I agree with your point and was addressing other blind anti-Google sentiment. While middle-finger to Google for their inhumane ad-based business model, we have to admit that they are doing what they are expected to do in this exact scenario.

danpalmer 3y ago

Safe Browsing is used by Chrome, Safari, Firefox, Vivaldi, Brave, and others.