3 ms·

I'm shocked no one has pointed this out yet, but it's a really really bad move to host user-submitted content on your primary business domain. There's no such t

by jart 3y ago

I'm shocked no one has pointed this out yet, but it's a really really bad move to host user-submitted content on your primary business domain. There's no such thing as subdomain culpability in the way the Internet is operated.

nstart 3y ago
To clarify here, we did think through this and start.page is not our primary business domain. It's the URL we used to host user generated content. You are 100% correct that it's a bad move to host user-submitted content on our primary business domain and we did intentionally avoid that. Where we, and in this case, I, missed a very important step by the looks of it is in adding ourselves to the public suffix list. I have done research on subomdain content management but for whatever reason, today is the first day I've come across the PSL. Something I definitely take responsibility for and makes me wonder what other stuff I might be missing that is obvious to other folks who've done this at scale.
leephillips 3y ago
Indeed...it seems to me that Google is doing the right thing here. They’re protecting me from a site that anyone can use to link to malware. Working as intended.
- throwuxiytayq 3y ago
  The next step for Google is to start blocking more of these pesky malware linking sites. Some really annoying candidates to start with: google.com (especially drive.google.com and calendar.google.com), gmail.com, blogger.com, youtube.com. I also hear there's an entire app for opening malware links called Chrome. Any Google employees lurking around who could maybe take a look?
baz00 3y ago
Correct. This is a major security fuck up and the consequence is as intended.
0x0000000 3y ago
OK but still, if your primary product is hosting user generated websites, it's a problem even if your "corpsite" marketing page stays up while your entire product is down. How does github pages or neocities, for example, handle this kind of thing? Surely I can't bring down every github page by linking to a malicious Google drive file from my own page?
- deleted 3y ago
  [deleted]
- fragmede 3y ago
  They handle this by serving user content from githubusercontent.com for this exact reason.
  - 0x0000000 3y ago
    I think you may be missing my point. How does one user serving malicious content from githubusercontent.com not result in the takedown/blacklisting of all users' content on githubusercontent.com? Sure, I understand how github.com is protected here, but I'm also unaware of github pages being totally blacklisted by Google even though I'm certain there have been malicious pages hosted there. You can only limit the blast radius so much if the product itself is "hosting user content."

by jart 3y ago

nstart 3y ago

To clarify here, we did think through this and start.page is not our primary business domain. It's the URL we used to host user generated content. You are 100% correct that it's a bad move to host user-submitted content on our primary business domain and we did intentionally avoid that. Where we, and in this case, I, missed a very important step by the looks of it is in adding ourselves to the public suffix list. I have done research on subomdain content management but for whatever reason, today is the first day I've come across the PSL. Something I definitely take responsibility for and makes me wonder what other stuff I might be missing that is obvious to other folks who've done this at scale.

leephillips 3y ago

Indeed...it seems to me that Google is doing the right thing here. They’re protecting me from a site that anyone can use to link to malware. Working as intended.

throwuxiytayq 3y ago
The next step for Google is to start blocking more of these pesky malware linking sites. Some really annoying candidates to start with: google.com (especially drive.google.com and calendar.google.com), gmail.com, blogger.com, youtube.com. I also hear there's an entire app for opening malware links called Chrome. Any Google employees lurking around who could maybe take a look?

baz00 3y ago

Correct. This is a major security fuck up and the consequence is as intended.

0x0000000 3y ago

OK but still, if your primary product is hosting user generated websites, it's a problem even if your "corpsite" marketing page stays up while your entire product is down. How does github pages or neocities, for example, handle this kind of thing? Surely I can't bring down every github page by linking to a malicious Google drive file from my own page?

deleted 3y ago
[deleted]
fragmede 3y ago
They handle this by serving user content from githubusercontent.com for this exact reason.
- 0x0000000 3y ago
  I think you may be missing my point. How does one user serving malicious content from githubusercontent.com not result in the takedown/blacklisting of all users' content on githubusercontent.com? Sure, I understand how github.com is protected here, but I'm also unaware of github pages being totally blacklisted by Google even though I'm certain there have been malicious pages hosted there. You can only limit the blast radius so much if the product itself is "hosting user content."