17 ms·
Facebook incorrectly reports personal blog to DigitalOcean for phishing
- bigyikes 3y agoOn my personal Facebook feed recently, I have seen a few spam posts where the content is hosted on Digital Ocean servers. I actually reported one of these to DO myself and the account was terminated. I wonder if there’s been an uptick in DO-hosted spam, and now some heuristic is being a little too eager with taking down DO content?
- scrps 3y agoYou can report false positives on the abuse report. https://incident.netcraft.com/3ee0db5c9a6a/ https://incident.netcraft.com/3ee0db5c9a6a/ Maybe a little HN kumbaya moment and report this as one?
- gruez 3y agoProbably not needed. Further down the thread, OP replied: >appears to be sorted from netcrafts end but how is this okay as a response? fuck you for threatening me with losing my server with 24 hours.
- sonicanatidae 3y agoIm sure they'll leap to address the problem. Source: I've filed these before and fuck all happened.
- charcircuit 3y agoThey already addressed it. It's not clear when he flagged it as a false positive, but the original tweet was at 8:16 and he said it was fixed by 8:39.
- scrps 3y agoI don't think it was me flagging it, I missed the post saying it was cleared up, I think I just stopped at the post with the abuse report link which is right above it.
- mikae1 3y agoIt's not a one-off incident, it's a structural problem.
- T3RMINATED 3y ago[dead]
- ronnier 3y agoDigitialOcean is a hotbed for hosting spam/abusive domains, spam/abusive email hosting (used to host temp emails for creating fake accounts on other platforms), and hosting abusive VPNs/proxies. The good thing is, this is very easy to detect when things are hosted on DO. The bad news is, companies are harsh on DigitalOcean and will have some level of false positives.
- bombcar 3y agoSometimes I think the bargain-basement hosts like DO exist simply so we have an easy group to block/avoid. Some innocents get caught in that crossfire, however.
- graemep 3y agoSo things like personal sites and blogs should be hosted on expensive hosts? Not reasonable.
- ghaff 3y agoReasonable or not, the company you keep is treated as a thing. As far as I can tell, Google Blogger is still a pretty reasonable site for a blog and some static pages. And it’s free. Of course you may not like that option for various other reasons.
- dylan604 3y agoYes, guilt by association is a thing. I was hit in the crossfire with it as well a long time ago.
- kjs3 3y agoFalse equivalence. There are many free/low price options for 'personal sites and blogs' that aren't sleazy hosting companies if cost is your key differentiator. Now, if it's "I will only accept an option where I can paint my bikeshed the exact color I want, with any brush I choose to use", then yeah, you've painted yourself into a bit of a corner options-wise and may end up as collateral damage. TANSTAAFL.
- is_true 3y agoIt would be nice if FB was as fast when you report ads that are scams.
- SillyUsername 3y agoThey are, they just tell you they don't breach any community standards even when you quote those affected rules verbatim.
- gameshot911 3y agoI recently sought out the results of all the scam accounts I had reported (even though FB says they'll let you know the outcome, they don't) and every single one was resolved as "doesn't break out community guidelines". As a result I've stopped submitting any reports, and question all FB metrics about active users & account numbers.
- dylan604 3y ago> and question all FB metrics about active users & account numbers. any company/person using stats to self promote should always be questioned. of course numbers are going to be rounded and massaged in the direction most rewarding, but the extent of the rounding makes a difference. lots of weasel room available in these types of stats.
- flir 3y agoI saw one that was selling fake driving licenses recently. The picture on the ad was literally a stack of driving licenses. Got a big thumbs up from FB though.
- throwup238 3y agoYou should report that to your State's Attorney General. That's quite a bit more serious than some scummy ad.
- 3y ago
- blindriver 3y agoHow is this not slander? Making false claims to disrupt someone's business seems like the perfect case of slander and should be treated as a legal matter in my opinion.
- gruez 3y agoIt might be, but at least in the US slander is rarely prosecuted criminally. That leaves civil action, but that's limited to how much damage the OP suffered as a result. Given that it's a small personal blog with little traffic/monetization, any legal costs will outweigh any winnings, if any.
- agilob 3y agoFacebook is doing it to protect their community, and disrupting your business is a sacrifice they are willing to make.
- occamrazor 3y agoBecause there is no _intent_ to slander.
- beeboobaa 3y agoSure there is, they're a bigcorp and did what they did. Don't let companies get away with crimes you and I wouldn't just because they're too disorganized.
- dns_snek 3y agoSo if I send an email to your boss saying "occamrazor is a <blank> molester", I'm fine as long as I say that I didn't mean to cause any harm?
- miloignis 3y agoYou're fine if you honestly thought it was true, yes.
- 3y ago
- radicality 3y agoI know the linked the post is from 2018, but afaik you can create a password separately now for Spotify, and then log in via your FB email + pass combination if you used FB login in the past. I remember doing this a few weeks ago.
- hipadev23 3y agoI made the unfortunate mistake of having the backend for my game on Hetzner and on launch day the abrupt spike in traffic made their abuse detection go haywire. No amount of explaining that everything was under control would satisfy their support team, and they null-routed my server. Never again with these discount hosts.
- ben_jones 3y agoReminds me of how US-based twitch streamers now need to call their local police department to inform them that there is a risk of Swatting. I guess we need to give advance notice to traffic spikes if that is an abnormal historical occurrence for our accounts.
- shadowgovt 3y agoThat is actually best practice for cloud-hosted services. Traffic spikes can in general cause auto-threat-detection to panic. The only difference for the big service providers is their thresholds are higher. (The maddening thing is that some of the circuit breakers are undocumented).
- whitepoplar 3y agoThis is my primary concern. I want to use Hetzner so badly for important workloads, but just can't stomach the risk (even if it's a small one) of being null-routed. Which hosting provider would you use today?
- bombcar 3y agoHetzner is so good, but so bad at the same time. Even when it's working their peering to half the world is absolute shite.
- whitepoplar 3y agoCan you recommend a hosting provider that's better than Hetzner but not as pricey as AWS?
- blibble 3y agoI've had this too cloudflare plasted red "DANGER! BAD WEBSITE!!!" banners across my company's website because the morons at netcraft told them it was a "phishing website" edit: looked like this: https://global.discourse-cdn.com/cloudflare/original/3X/e/9/e9b4d1ab86a632014197d0b3c04b9990af9fb407.jpeg https://global.discourse-cdn.com/cloudflare/original/3X/e/9/... thanks cloudflare for altering my website to tell my customers that I'm trying to phish them and to avoid us because some third party told them that was so what was the cause of netcraft to sending this to cloudflare? they found a 20 year old exe that had a link to our website as a string inside the binary not a binary we had produced, just some random innocent third party program that mentioned us in their about box if I had could have proven that I'd lost sales/reputation I'd have gone after netcraft and cloudflare for defamation what use is a DDoS shield if they'll automatically shut down your site if someone sends them an anonymous form saying "they're hosting bad things!!!!" edit: another guy with the same complaint here: https://community.cloudflare.com/t/cloudflare-mistakenly-flagged-my-website-as-phishing-now-shows-a-warning-and-misinforms-my-users/384158 https://community.cloudflare.com/t/cloudflare-mistakenly-fla...
- asylteltine 3y agoWay too much of the internet is on cloudflare. They are and will continue to be the arbiters of speech on the internet. God forbid I browse the web with a vpn!
- midasuni 3y agoYet they are the golden boy on HN. Nobody should have that much power.
- asylteltine 3y agoSometimes I even get into infinite captcha loops without a vpn, even just on my phone. I LITERALLY cannot browse certain sites like wayfair because of cloudflare. I have done nothing wrong.
- 3y ago
- CGamesPlay 3y agoI had my entire domain listed as a phishing domain on Google for having a real, legitimate Google OAuth sign-in flow on one of my (unlisted) subdomains. They didn't even disable the app in question, just delisted my entire domain.
- NathanFlurry 3y agoI've experienced many similar incidents – I've been running multiplayer game servers on these "discount" server providers for a while now. They receive umpteen requests per day about spamming, hosting pirating/other illegal content, botnets, etc with only an associated IP address. Vultr has a nasty habit of forwarding these directly to the current holder of the IP address with a dire warning that your account will be shut down within 24h if no action is taken, regardless of the timestamp of the complaint. Abusers just create & destroy servers frequently frequently to acquire fresh IP addresses to host malicious content on. It became a morning routine of copy+pasta responses to these emails to keep the servers online.
- 1letterunixname 3y agoThis is like arresting someone for the crimes committed by a previous apartment tenant. An IP address can be spoofed and it isn't equal to 1 person for all time. It will take a class-action tort judgement against the flimsy, lazy correlation people to get the message that their actions are causing harm.
- roadwarrior 3y ago[dead]
- deleted 3y ago[deleted]
- jtsiskin 3y agoIt’s pretty easy to guess what features (either manually made or AI based) the phishing detector saw: 1. “Facebook” and “login” in the URL 2. URL redirect 3. “Facebook login”, “password login, “forget password” etc in text body 4. The quoted email from Spotify sounding close (in vector space) to phishing text. 5. A link to Facebook settings, followed by a series of steps; these instructions say to log in to a non-Facebook url using your Facebook email All of these together was probably enough to hit some threshold. From there the issue was just misaligned personal incentives, all along the chain from engineers at Facebook to Netcraft and Digital Ocean, that leads to false positives being an acceptable outcome.
- jrockway 3y agoNetcraft confirms it: Netcraft is dying!
- leiferik 3y agoIt feels really crummy to be accused and convicted of an "offense" by an algorithm, especially without any recourse. I once had my account with a major cloud provider terminated for "violating our terms of service". After contacting support, they then claimed that someone had gained access to my credentials. What evidence did they have? None. I just updated a VM's metadata too frequently (about once a minute). This tripped an ML model, which caused them to automatically terminate my account and send an automated email saying that I had been a bad boy. This took down a key part of my business for about 5 hours (while I navigated my way through layers of customer support and ultimately temporarily moved this functionality to another cloud provider). Customers were not happy. It took about 2 weeks and multiple support tickets for the full story to come out. I got them to refund a few months of charges (amounted to several hundred dollars at the time) and restore my account. There was never any recognition that they made a mistake. I get that companies need to resort to automated means to handle fraud or abuse. But they should also own up to it, add some humility in their automated outreach to customers ("our automated system has detected possible X" instead of "you are guilty"), provide clear escalation paths to talk to a human, and provide a way to "shield" your account (identity verification, upfront deposit of $X, etc) that forces them to contact you before any enforcement action. In my case, I upgraded to a paid support plan ($100+ per month) in the hopes that their system will be a little less trigger happy with my account in the future. I don't use support at all, it's purely a lame form of insurance that may or may not actually protect against anything.
- davely 3y agoWhen these algorithms get it wrong, it completely sucks. And since no tech company has any semblance of customer support, you're completely hosed. With respect to Facebook: I posted a shop vac last April for $50. I got a message that I was banned from using marketplace for "violating community guidelines." However, if you believe this happened in error, you could request a review. So I did! And was denied. I did this process a few more times and each time was denied. Once I requested a review for the third (or fourth?) time, I received a message that said "Unfortunately, your account cannot be reinstated due to violating community guidelines. The review is final." I have no idea what happened. So now, I can't use Facebook Marketplace because of some stupid error in their algorithm that can't be ever appealed. Which is a bummer, because I've legitimately found some good electronic finds on there (and have been able to offload things I don't have use for). Meanwhile, their algorithms for advertising and marketing useless stuff to us are just perfect. A passage from Yuval Noah Harari's book, "Homo Deus: A Brief History of Tomorrow" highlights this: > A recent study commissioned by Google’s nemesis – Facebook – has indicated that already today the Facebook algorithm is a better judge of human personalities and dispositions than even people’s friends, parents and spouses. The study was conducted on 86,220 volunteers who have a Facebook account and who completed a hundred-item personality questionnaire. > The Facebook algorithm predicted the volunteers’ answers based on monitoring their Facebook Likes – which webpages, images and clips they tagged with the Like button. The more Likes, the more accurate the predictions. The algorithm’s predictions were compared with those of work colleagues, friends, family members and spouses. > Amazingly, the algorithm needed a set of only ten Likes in order to outperform the predictions of work colleagues. It needed seventy Likes to outperform friends, 150 Likes to outperform family members and 300 Likes to outperform spouses. In other words, if you happen to have clicked 300 Likes on your Facebook account, the Facebook algorithm can predict your opinions and desires better than your husband or wife!
- rknightuk 3y agoAuthor of the post here. Although Netcraft have said it was a false positive, I’ve yet to hear back from Digital Ocean so as it stands, my droplet is still going to be nuked in 24 hours as far as I know.
- Sephr 3y agoFacebook is primarily at fault, although I would also blame DigitalOcean for having unreasonable minimum enforcement time limits. DigitalOcean should reach out to Netcraft and decide on a more reasonable minimum enforcement time that is based on Netcraft's actual support throughput capabilities. This arbitrary choice of a 24 hour time limit hurts their customers. I plan to switch my hosting provider away from DigitalOcean due to this incident.
- phendrenad2 3y agoSo let me see if I'm understanding this: Facebook pays a company called Netcraft for brand reputation management, and they scan the internet for misuse of the Facebook brand, assume it's "phishing", and send reports to cloud hosts to take them down. Sounds like the mafia.
- GoToRO 3y ago...and when I report a scam ad, the ad goes away a few weeks (just for me I bet) and then it comes back because money