37 ms·

Google flags Immich sites as dangerous

• donmcronald 1y ago
  I tried to submit this, but the direct link here is probably better than the Reddit thread I linked to: https://old.reddit.com/r/immich/comments/1oby8fq/immich_is_a_dangerous_site/ https://old.reddit.com/r/immich/comments/1oby8fq/immich_is_a... I had my personal domain I use for self-hosting flagged. I've had the domain for 25 years and it's never had a hint of spam, phishing, or even unintentional issues like compromised sites / services. It's impossible to know what Google's black box is doing, but, in my case, I suspect my flagging was the result of failing to use a large email provider. I use MXRoute for locally hosted services and network devices because they do a better job of giving me simple, hard limits for sending accounts. That way if anything I have ever gets compromised, the damage in terms of spam will be limited to (ex) 10 messages every 24h. I invited my sister to a shared Immich album a couple days ago, so I'm guessing that GMail scanned the email notifying her, used the contents + some kind of not-google-or-microsoft sender penalty, and flagged the message as potential spam or phishing. From there, I'd assume the linked domain gets pushed into another system that eventually decides they should blacklist the whole domain. The thing that really pisses me off is that I just received an email in reply to my request for review and the whole thing is a gas-lighting extravaganza. Google systems indicate your domain no longer contains harmful links or downloads. Keep yourself safe in the future by blah blah blah blah. Umm. No! It's actually Google's crappy, non-deterministic, careless detection that's flagging my legitimate resources as malicious. Then I have to spend my time running it down and double checking everything before submitting a request to have the false positive mistake on Google's end fixed. Convince me that Google won't abuse this to make self hosting unbearable.
  • foobarian 1y ago
    Wonder if there would be any way to redress this in small claims court.
  • akerl_ 1y ago
    > I suspect my flagging was the result of failing to use a large email provider. This seems like the flagging was a result of the same login page detection that the Immich blog post is referencing? What makes you think it's tied to self-hosted email?
    • donmcronald 1y ago
      I'm not using self hosted email. My theory is that Google treats smaller mail providers as less trustworthy and that increases the odds of having messages flagged for phishing. In my case, the Google Search Console explicitly listed the exact URL for a newly created shared album as the cause. https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xx... I wish I would have taken a screenshot. That URL is not going to be guessed randomly and the URL was only transmitted once to one person via e-mail. The sending was done via MXRoute and the recipient was using GMail (legacy Workspace). The only possible way for Google to have gotten that URL to start the process would have been by scanning the recipient's e-mail. What I was trying to say is that the only way it makes sense to me is if Google via GMail categorized that email as phishing and that kicked off the process to add my domain to the block list. So, if email categorization / filtering is being used as a heuristic for discovering URLs for the block list, it's possible Google's discriminating against domains that use smaller email hosts that Google doesn't trust as much as themselves, Microsoft, etc.. All around it sucks and Google shouldn't be allowed to use non-deterministic guesswork to put domains on a block list that has a significant negative impact. If they want to operate a clown show like that, they should at least be liable for the outcomes IMO.
  • david_van_loon 1y ago
    I'm in a similar boat. Google's false flag is causing issues for my family members who use Chrome, even for internal services that aren't publicly exposed, just because they're on related subdomains. It's scary how much control Google has over which content people can access on the web - or even on their local network!
    • Larrikin 1y ago
      It's a good opportunity to recommend Firefox when you can show a clear abuse of position
      • donmcronald 1y ago
        Firefox uses the same list.
• captnasia 1y ago
  This seems related to another hosting site that got caught out by this recently: https://news.ycombinator.com/item?id=45538760 https://news.ycombinator.com/item?id=45538760
  • o11c 1y ago
    Not quite the same (other than being an abuse of the same monopoly) since this one is explicitly pointing to first-party content, not user content.
• kevinsundar 1y ago
  This may not be a huge issue depending on mitigating controls but are they saying that anyone can submit a PR (containing anything) to Immich, tag the pr with `preview` and have the contents of that PR hosted on https://pr-<num>.preview.internal.immich.cloud? Doesn't that effectively let anyone host anything there?
  • warkdarrior 1y ago
    Excellent idea for cost-free phishing.
  • daemonologist 1y ago
    I think only collaborators can add labels on github, so not quite. Does seem a bit hazardous though (you could submit a legit PR, get the label, and then commit whatever you want?).
    • ajross 1y ago
      Exposure also extends not just to the owner of the PR but anyone with write access to the branch from which it was submitted. GitHub pushes are ssh-authenticated and often automated in many workflows.
  • rixed 1y ago
    So basically like https://docs.google.com/ https://docs.google.com/ ?
    • jeroenhd 1y ago
      Yes, except on Google Docs you can't make the document steal credentials or download malware by simply clicking on the link. It's more like sites.google.com.
  • tgsovlerkhgsel 1y ago
    That was my first thought - have the preview URLs possibly actually been abused through GitHub?
  • 1y ago
• NelsonMinar 1y ago
  Be sure to see the team's whole list of Cursed Knowledge. https://immich.app/cursed-knowledge https://immich.app/cursed-knowledge
  • levkk 1y ago
    The Postgres query parameters one is funny. 65k parameters is not enough for you?!
    • strken 1y ago
      As it says, bulk inserts with large datasets can fail. Inserting a few thousand rows into a table with 30 columns will hit the limit. You might run into this if you were synchronising data between systems or running big batch jobs. Sqlite used to have a limit of 999 query parameters, which was much easier to hit. It's now a roomy 32k.
      • evertedsphere 1y ago
        COPY is often a usable alternative.
      • tym0 1y ago
        Right, for postgres I would use unnest for inserting a non-static amount of rows.
        • strken 1y ago
          In the past I've used batches of data, inserted into a separate table with all the constraints turned off and using UNNEST, and then inserted into the final table once it was done. We ended up both batching the data and using UNNEST because it was faster but it still let us resume midway through. We probably should have been partitioning the data instead of inserting it twice, but I never got around to fixing that. COPY is likely a better option if you have access to the host, or provider-specific extensions like aws_s3 if you have those. I'm sure a data engineer would be able to suggest a better ETL architecture than "shove everything into postgres", too.
• Animats 1y ago
  If you block those internal subdomains from search with robots.txt, does Google still whine?
  • snailmailman 1y ago
    I’ve heard anecdotes of people using an entirely internal domain like “plex.example.com” even if it’s never exposed to the public internet, google might flag it as impersonating plex. Google will sometimes block it based only on name, if they think the name is impersonating another service. Its unclear exactly what conditions cause a site to get blocked by safe browsing. My nextcloud.something.tld domain has never been flagged, but I’ve seen support threads of other people having issues and the domain name is the best guess.
    • donmcronald 1y ago
      I'm almost positive GMail scanning messages is one cause. My domain got put on the list for a URL that would have been unknowable to anyone but GMail and my sister who I invited to a shared Immich album. It was a URL like this that got emailed directly to 1 person: https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx https://photos.example.com/albums/xxxxxxxx-xxxx-xxxx-xxxx-xx... Then suddenly the domain is banned even though there was never a way to discover that URL besides GMail scanning messages. In my case, the server is public so my siblings can access it, but there's nothing stopping Google from banning domains for internal sites that show up in emails they wrongly classify as phishing. Think of how Google and Microsoft destroyed self hosted email with their spam filters. Now imagine that happening to all self hosted services via abuse of the safe browsing block lists.
      • deleted 1y ago
        [deleted]
      • beala 1y ago
        It doesn’t seem like email scanning is necessary to explain this. It appears that simply having a “bad” subdomain can trigger this. Obviously this heuristic isn’t working well, but you can see the naive logic of it: anything with the subdomain “apple” might be trying to impersonate Apple, so let’s flag it. This has happened to me on internal domains on my home network that I've exposed to no one. This also has been reported at the jellyfin project: https://github.com/jellyfin/jellyfin-web/issues/4076 https://github.com/jellyfin/jellyfin-web/issues/4076
• arccy 1y ago
  If you're going to host user content on subdomains, then you should probably have your site on the Public Suffix List https://publicsuffix.org/list/ https://publicsuffix.org/list/ . That should eventually make its way into various services so they know that a tainted subdomain doesn't taint the entire site....
  • o11c 1y ago
    Is that actually relevant when only images are user content? Normally I see the PSL in context of e.g. cookies or user-supplied forms.
    • dspillett 1y ago
      > Is that actually relevant when only images are user content? Yes. For instance in circumstances exactly as described in the thread you are commenting in now and the article it refers to. Services like google's bad site warning system may use it to indicate that it shouldn't consider a whole domain harmful if it considers a small number of its subdomains to be so, where otherwise they would. It is no guarantee, of course.
      • thayne 1y ago
        Well, using the public suffix list _also_ isolates cookies and treats the subdomains as different sites, which may or may not be desirable. For example, if users are supposed to log in on the base account in order to access content on the subdomains, then using the public suffix list would be problematic.
        • dspillett 1y ago
          Cross domain identity management is a little extra work, but it's far from a difficult problem. I understand the objection to needing to do it when a shared cookie is so easy, but if you want subdomains to be protected from each other because they do not have shared responsibility for each other then it makes sense in terms of privacy & security that they don't automatically share identity tokens and other client-side data.
• nautilus12 1y ago
  [flagged]
  • ocdtrekkie 1y ago
    As someone who doesn't like Google and absolutely thinks they need to be broken up, no probably not. Google's algorithms around security are so incompetent and useless that stupidity is far more likely than malice here.
    • o11c 1y ago
      Incompetently or "coincidentally" abusing your monopoly in a way that "happens" to suppress competitors (while whitelisting your own sites) probably won't fly in court. Unless you buy the judge of course. Intent does not always matter to the law ... and if a C&D is sent, doesn't that imply that intent is subsequently present? Defamation laws could also apply independently of monopoly laws.
    • dare944 1y ago
      Callous disregard for the wellbeing of others is not stupidity, especially when demonstrated by a company ostensibly full of very intelligent people. This behavior - in particular, implementing an overly eager mechanism for damaging the reputation of other people - is simply malicious.
• trollbridge 1y ago
  A friend / client of mine used some kind of WordPress type of hosting service with a simple redirect. The host got on the bad sites list. This also polluted their own domain, even when the redirect was removed, and had the odd side effect that Google would no longer accept email from them. We requested a review and passed it, but the email blacklist appears to be permanent. (I already checked and there are no spam problems with the domain.) We registered a new domain. Google’s behaviour here incidentally just incentivises bulk registering throwaway domains, which doesn’t make anything any better.
  • donmcronald 1y ago
    Wow. That scares me. I've been using my own domain that got (wrongly) blacklisted this week for 25 years and can't imagine having email impacted.
    • trollbridge 1y ago
      My general policy now is to confine important email to a very, very basic website that you rigidly control the hosting over and just keep static sites on. And avoid using subdomains.
• 7363288236973 1y ago
  [dead]
• renewiltord 1y ago
  I think the other very interesting thing in the reddit thread[0] for this is that if you do well-known-domain.yourdomain.tld then you're likely to get whacked by this too. It makes sense I guess. Lots of people are probably clicking gmail.shady.info and getting phished. 0: https://old.reddit.com/r/immich/comments/1oby8fq/immich_is_a_dangerous_site/ https://old.reddit.com/r/immich/comments/1oby8fq/immich_is_a...
  • donmcronald 1y ago
    So we can't use photos or immich or images or pics as a sub-domain, but anything nondescript will be considered obfuscated and malicious. Awesome!
• jakub_g 1y ago
  Regarding how Google safe browsing actually works under the hood, here is a good writeup from Chromium team: https://blog.chromium.org/2021/07/m92-faster-and-more-efficient-phishing-detection.html?m=1 https://blog.chromium.org/2021/07/m92-faster-and-more-effici... Not sure if this is exactly the scenario from the discussed article but it's interesting to understand it nonetheless. TL;DR the browser regularly downloads a dump of color profile fingerprints of known bad websites. Then when you load whatever website, it calculates the color profile fingerprint of it as well, and looks for matches. (This could be outdated and there are probably many other signals.)
  • bmandale 1y ago
    I can't imagine that lasted more than 30 seconds after they made a public blog post about how they were doing it.
• akerl_ 1y ago
  Tangential to the flagging issue, but is there any documentation on how Immich is doing the PR site generation feature? That seems pretty cool, and I'd be curious to learn more.
  • TheDong 1y ago
    It's open source, you can find this trivially yourself in less than a minute. https://github.com/immich-app/devtools/tree/a9257b33b5fb2d304cffb090969b80152e50279f/kubernetes/apps/preview/github-previews https://github.com/immich-app/devtools/tree/a9257b33b5fb2d30...
    • akerl_ 1y ago
      Wow. What a rude way to answer.
      • TheDong 1y ago
        I think we might have hit the inflection point where being rude is more polite. It's not that I want people to be rude to me, it's that I don't want to talk to AI when I intend to be talking to a person, and anyone engaging with me via AI is infinitely more disrespectful than any curse word or rudeness. These days, when I get a capitalized, grammatically correct sentence — and proper punctuation to boot, there is an unfortunate chance it was written using an AI and I am not engaging fully with a human. its when my covnersation partner makes human mistakes, like not capitalizing things, or when they tell me i'm a bonehead, that i know i'm talking to a real human not a bot. it makes me feel happier and more respected. i want to interact with humans dammit, and at this point rude people are more likely to be human than polite ones on the internet. i know you can prompt AIs to make releaistic mistakes too, the arms race truly never ends
      • nicce 1y ago
        Sometimes it is also rude to ask without looking the obvious place themselves. It is about signaling that ”my” time is more precious than ”your” time so I let them do that check for me, if I can use someone elses time.
• jstrong 1y ago
  google: we make going to the DMV look delightful by comparison!
  • elphinstone 1y ago
    They are not the government and should not have this vast, unaccountable monopoly power with no accountability and no customer service.
    • stonogo 1y ago
      the government probably shouldn't either?
      • userbinator 1y ago
        At least the government is normally elected.
        • AnthonyMouse 1y ago
          Most of it kind of isn't. When was the last election for FCC commissioners or US Attorney General or federal district court judges?
      • marcosdumay 1y ago
        The government tends to get out of their way to have accountability and customer service.
  • o11c 1y ago
    Honestly, where do people live that the DMV (or equivalent - in some states it is split or otherwise named) is a pain? Every time I've ever been it has been "show up, take a number, wait 5 minutes, get served" - and that's assuming website self-service doesn't suffice.
• ggm 1y ago
  Is there any linkage to the semifactoid that immich Web gui looks very like Google Photos or is that just one of the coincidences?
  • russelg 1y ago
    Not a coincidence, Immich was started as a personal replacement for Google Photos.
    • ggm 1y ago
      The coincidence here would be google flagging it as malware, not the origin story of the look and feel.
      • russelg 1y ago
        Oh my bad, I severely misinterpreted your comment.
• heavyset_go 1y ago
  Insane that one company can dictate what websites you're allowed to visit. Telling you what apps you can run wasn't far enough.
  • liquid_thyme 1y ago
    I really don't know how they got nerds to think scummy advertising is cool. If you think about it, the thing they make money on - no user actually wants ads or wants to see them, ever. Somehow Google has some sort of nerd cult that people think its cool to join such an unethical company.
    • jazzyjackson 1y ago
      Turns out it's cool to make lots of money
    • fHr 1y ago
      Absolutely fuck Google
    • chrneu 1y ago
      unfortunately nobody wants to sacrifice anything nowadays so everyone will keep using google, and microsoft, and tiktok and meta and blah blah
    • jrowen 1y ago
      [flagged]
      • nicce 1y ago
        On this day, only Google Maps does not have real competitor on Android. Otherwise, it is possible to drop Google and even get better services. Brands are difficult to compete.
        • frm88 1y ago
          Try Mapy. Outperforms Google maps any day.
• jdsully 1y ago
  The one thing I never understood about these warnings is how they don't run afoul of libel laws. They are directly calling you a scammer and "attacker". The same for Microsoft with their unknown executables. They used to be more generic saying "We don't know if its safe" but now they are quite assertive at stating you are indeed an attacker.
  • pasteldream 1y ago
    > The one thing I never understood about these warnings is how they don't run afoul of libel laws. I’m not a lawyer, but this hasn’t ever been taken to court, has it? It might qualify as libel.
    • altairprime 1y ago
      I know of no such cases, and would love to know if someone finds one.
      • trenchpilgrim 1y ago
        I worked for a company who had this happen to an internal development domain, not exposed to the public internet. (We were doing security research on our own software, so we had a pentest payload hosted on one of those domains as part of a reproduction case for a vulnerability we were developing a fix for.) Our lawyers spoke to Google's lawyers privately, and our domains got added to a whitelist at Google.
    • modzu 1y ago
      you only sue somebody poorer than you
      • tgsovlerkhgsel 1y ago
        It depends, if it's a clear-cut case, then in jurisdictions with a functioning legal system it can be feasible to sue. Likewise, if it's a fuckup that just needs to be put in front of someone who cares, a lawsuit is actually a surprisingly effective way of doing that. This moves your problem from "annoying customer support interaction that's best dealt with by stonewalling" into "legal says we HAVE to fix this".
• your_challenger 1y ago
  Them maintaining a page of gotchas is a really cool idea - https://immich.app/cursed-knowledge https://immich.app/cursed-knowledge
  • meander_water 1y ago
    > There is a user in the JavaScript community who goes around adding "backwards compatibility" to projects. They do this by adding 50 extra package dependencies to your project, which are maintained by them. This is a spicy one, would love to know more.
    • pasteldream 1y ago
      It links to a commit; the removed deps are by GitHub user ljharb.
• gtirloni 1y ago
  There's a reason GitHub use github.io for user content.
  • slig 1y ago
    They're using a different TLD (.cloud / .app). But IIRC, GH changed to avoid cookies leaking with user created JS running at their main domain.
• david_van_loon 1y ago
  I'm fighting this right now on my own domain. Google marked my family Immich instance as dangerous, essentially blocking access from Chrome to all services hosted on the same domain. I know that I can bypass the warning, but the photo album I sent to my mother-in-law is now effectively inaccessible.
  • david_van_loon 1y ago
    Since other browsers, like Firefox, also use the Google Safe Browsing list, they are affected as well.
  • donmcronald 1y ago
    Just in case you're not sure how to deal with it, you need to request a review via the Google Search Console. You'll need a Google account and you have to verify ownership of the domain via DNS (if you want to appeal the whole domain). After that, you can log into the Google Search Console and you can find "Security Issues" under the "Security & Manual Actions" section. That area will show you the exact URLs that got you put on the block list. You can request a review from there. They'll send you an email after they review the block. Hopefully that'll save you from trying to hunt down non-existent malware on a half dozen self-hosted services like I ended up doing.
    • shaky-carrousel 1y ago
      It's a bit ironic that a user installing immich to escape Google's grip ends up having to create again a Google account to be able to remove their Google account.
      • david_van_loon 1y ago
        Indeed. Thankfully, this isn't the first time Google has caused an issue like this, so I'm familiar with the appeal process.
    • account42 1y ago
      Reviews view Google Search Console are pointless because they won't stop the same automated process from flagging the domain again. Save your time and get your lawyer to draft a friendly letter instead.
• bogzz 1y ago
  The same thing happened to me earlier this year with a self-hosted instance of Umami Analytics. https://news.ycombinator.com/item?id=42779544#42783321 https://news.ycombinator.com/item?id=42779544#42783321 Unironically, including a threat of legal action in my appeal on the Google Search Console was what stopped our instance getting flagged in the end.
  • throwaway-0001 1y ago
    Could you provide your text? Having same issue for years https://news.ycombinator.com/item?id=45678095 https://news.ycombinator.com/item?id=45678095
• akshayKMR 1y ago
  Maybe a dumb question but what constitutes user-hosted-content? Is a notion page, github repo, or google doc that has user submitted content that can be publicly shared also user-hosted? IMO Google should not be able to use definitive language "Dangerous website" if its automated process is not definitive/accurate. A false flag can erode customer trust.
  • lucideer 1y ago
    A website where a user can upload "active code". The definition of "active code" is broad & sometimes debatable - e.g. do old MySpace websites count - but broadly speaking the best way of thinking about it is in terms of threat model, & the main two there are: - credential leakage - phishing The first is fairly narrow & pertains to uploading server side code or client javascript. If Alice hosts a login page on alice.immich.cloud that contains some session handling bugs in her code, Mallory can add some cute to mallory.immich.cloud to read cookies set on *.immich.cloud to compromise Alice's logins. The second is much broader as it's mostly about plausible visual impersonation so will also cases where users can only upload CSS or HTML. Specifically in this case what Immich is doing here is extremely dangerous & this post from them - while I'll give them the benefit of the doubt on being ignorant - is misinformation.
    • aniviacat 1y ago
      It may be dangerous but it is an established pattern. There are many cases (like Cloudflare Pages) of others doing the same, hosting strangers' sites on subdomains of a dedicated domain (pages.dev for Cloudflare, immich.cloud for Immich). By preventing newcomers from using this pattern, Google's system is flawed, severely stifling competition. Of course, this is perfectly fine for Google.
      • lucideer 1y ago
        It is but this established pattern is well standardised & documented by the public suffix list project. There's generally two conventions followed for this pattern: 1. Use a separate dedicated domain (Immich didn't do this - they're now switching to one in response to this) 2. List the separate dedicated domain in the public suffix list. As far as I can tell Immich haven't mentioned this.
• shadowgovt 1y ago
  > The most alarming thing was realizing that a single flagged subdomain would apparently invalidate the entire domain. Correct. It works this way because in general the domain has the rights over routing all the subdomains. Which means if you were a spammer, and doing something untoward on a subdomain only invalidated the subdomain, it would be the easiest game in the world to play. malware1.malicious.com malware2.malicious.com ... Etc.
• stack_framer 1y ago
  This happened to one of our documentation sites. My co-workers all saw it before I did, because Brave (my daily driver) wasn't showing it. I'm not sure if Brave is more relaxed in determining when a site is "dangerous" but I was glad not to be seeing it, because it was a false positive.
• akersten 1y ago
  This is #1 on HN for a while now and I suspect it's because many of us are nervous about it happening to us (or have already had our own homelab domains flagged!). So is there someone from Google around who can send this along to the right team to ensure whatever heuristic has gone wrong here is fixed for good?
  • goda90 1y ago
    I doubt Google the corporation cares one bit, and any individual employees who do care would likely struggle against the system to cause significant change. The best we all can do is to stop using Google products and encourage our friends and family to do likewise. Make sure in our own work that we don't force others to rely on Google either.
• aetherspawn 1y ago
  A good takeaway is to separate different domains for different purposes. I had prior been tossing up the pros/cons of this (such as teaching the user to accept millions of arbitrary TLDs as official), but I think this article (and other considerations) have solidified it for me. For example www.contoso.com (public) www.contoso.blog (public with user comments) contoso.net (internal) staging.contoso.dev (dev/zero trust endpoints) raging-lemur-a012afb4.contoso.build (snapshots)
  • oxhai 1y ago
    Good
  • sureglymop 1y ago
    The biggest con of this is that to a user it will seem much more like phishing. It happened to me a while ago that I suddenly got emails from "githubnext.com". Well, I know Github and I know that it's hosted at "github.com". So, to me, that was quite obviously phishing/spam. Turns out it was real...
    • aetherspawn 1y ago
      This is such a difficult problem. You should be able to buy a “season pass” for $500/year or something that stops anyone from registering adjacent TLDs. And new TLDs are coming out every day which means that I could probably go buy microsoft.anime if I wanted it. This is what trademarks are supposed to do, but it’s reactive and not proactive.
    • jeroenhd 1y ago
      PayPal is a real star when it comes to vague, fake-sounding, official domains. Real users don't care much about phishing as long as you got redirected from the main domain, though. github.io has been accepted for a long time, and githubusercontent.com is invisible 99% of the time. Plus, if your regular users are not developers and still end up on your dev/staging domains, they're bound to be confused regardless.
• tjpnz 1y ago
  "might trick you into installing unsafe software" Something Google actively facilities with the ads they serve.
• zackify 1y ago
  The open internet is done. Monopolies control everything. We have an iOS app in the store for 3 years and out of the blue apple is demanding we provide new licenses that don’t exist and threaten to kick our app out. Nothing changed in 3 years. Getting sick of these companies able to have this level of control over everything, you can’t even self host anymore apparently.
  • srik 1y ago
    > We have an iOS app in the store for 3 years and out of the blue apple is demanding we provide new licenses that don’t exist and threaten to kick our app out. Crazy! If you can elaborate here, please do.
  • 0xedd 1y ago
    [dead]
• stephenlf 1y ago
  I have no idea what immich is or what this post says, but I LOVE that this company has a collection of posts called, “Cursed Knowledge.”
• throwaway-0001 1y ago
  I’m also self hosting gitea and pertainer and I’m trying this issue every few weeks. I appeal, they remove the warning, after a week is back. This is ongoing for at least 4 years. I have more than 20 appeals all successfully removing the warning. Ridiculous. I heard legal action is the best option now, any other ideas?
• dvh 1y ago
  And yet if you start typing 192 in chrome, first suggested url is 192.168.l00.1
• gomox 1y ago
  Story of when it happened to my company: https://news.ycombinator.com/item?id=25802366 https://news.ycombinator.com/item?id=25802366
• deleted 1y ago
  [deleted]
• callc 1y ago
  Us nerds *really* need to come together in creating a publicly owned browser (non chromium) Surely among us devs, as we realize app stores increasingly hostile, that the open web is worth fighting for, and that we have the numbers to build solutions?
  • pkulak 1y ago
    Uh… we are. Servo and Ladybird. It’s a shit tonne of work.
    • Culonavirus 1y ago
      > It’s a shit tonne of work. [Sam didn't like that.]
    • ZenoArrow 1y ago
      Firefox should be on that list. It's clearly a lot closer in functionality to Chrome/Chromium than Servo or Ladybird, so it's easier to switch to it. I like that Servo and Ladybird exist and are developing well, but there's no need to pretend that they're the only available alternatives.
      • einpoklum 1y ago
        If you knew how the Mozilla corporation was governed, then you would not think that Firefox should be on the list.
        • sofixa 1y ago
          How is it governed?
          • dwedge 1y ago
            Funded to the tune of a half billion dollars a year by Google to pretend there's no monopoly, and multiple announcements of them trying to reimagine themselves as an ad-company. They're the best of a bad bunch but they are definitely still part of a bad bunch
• curioussquirrel 1y ago
  Looking forward to Louis Rossmann's reaction. Wouldn't be surprised if this leads to a lawsuit over monopolistic behavior - this is clearly abusing their dominant position in the browser space to eliminate competitors in photos sharing.
  • skrebbel 1y ago
    Who is that and why is his reaction relevant?
    • jeroenhd 1y ago
      He's a right-to-repair activist Youtuber who is quite involved in GrayJay, another app made by this company, which is a video player client for other platforms like YouTube. I'm not sure why his reaction would be relevant, though. It'll just be another rant about how Google has too much control like he's done in the past. He may be right, but there's nothing new to say.
      • archargelod 1y ago
        He wasn't just involved with GrayJay, he's actually a member of FUTO - the company behind Immich and GrayJay. Now read grandparent comment one more time: > Wouldn't be surprised if this leads to a lawsuit over monopolistic behavior His reaction also matters because he's basically the public face for the company on YouTube and has a huge following. You've probably seen a bunch of social media accounts with the "clippy" character as their avatar. That's a movement started by Louis Rossman.
  • TiredOfLife 1y ago
    Seems that Rossmann left FUTO in february and started his own foundation in march
• XiphiasX 1y ago
  I’m launching a web version for an online game. What to do to prevent this from happening?
  • pharrington 1y ago
    Install your non-self generated SSL certificate correctly, and make sure users can't upload arbitrary content to your domain.
• yapyap 1y ago
  I’d say this is a clear slight from Google, using their Chrome browser because something or someone is inconveniencing another part of their business, google cloud / google photos. They did a similar thing with the uBlock Origin extension, flagging it with “this extension might be slowing down your browser” in a big red banner in the last few months of manifest v2 on Chrome. After already having to upload the extension yourself to Chrome cause they took it off the extension store cause it was inhibiting on their ad business. Google is a massive monopolistic company who will pull strings on one side of their business to help another. With only Firefox not being based on Chromium and still having manifest v2 the future (5 to 10 years from now) looks bleak. With only 1 browser like this web devs can phase it out slowly by not taking it into consideration when coding or Firefox could enshittify to such an extent because of their manifest v2 monopoly that even that wont make it worth it anymore. Oh and for the ones not in the know, Manifest is the name of a javascript file manifest.js that decides what browser extensions can and cant modify and the “upgrade” from manifest v2 to v3 has made it near impossible for adblockers to block ads.
• aborsy 1y ago
  Safe Browsing collects a lot of data, such as hashes of URLs (URLs can be easily decoded by comparison) and probably other interactions with web like downloads. But how effective is it in malware detection? The benefits seem to me dubious. It looks like a feature offered to collect browsing data, useful to maybe 1% in special situations.
  • ozgrakkurt 1y ago
    100% agreed. Adblock does this better and doesn’t randomly block image sharing websites
  • Avamander 1y ago
    It's the only thing that has reasonable coverage to effectively block a phishing attack or malware distribution. It can certainly do other things like collecting browsing data, but it does get rid of long-lasting persistent garbage hosted at some bulletproof hosts.
• pharrington 1y ago
  They have to fix their SSL certs. "Kubernetes Ingress Controller Fake Certificate" aint gonna cut it.
  • bo0tzz 1y ago
    Sounds like you're hitting an address that isn't backed by any service, not sure what the issue is.
• jrochkind1 1y ago
  I am confused if the term "self-hosted" means the same thing to them as it means to me, not sure if I'm following.
• Jackson__ 1y ago
  If there are any googlers here, I'd like to report an even more dangerous website. As much as 30-50% of the traffic to it relates to malware or scams, and it has gone unpunished for a very long time. The address appears to be adsense.google.com.
  • mcv 1y ago
    Yes, the irony of Google warning for other sites as malware, is not lost on me.
  • pkulak 1y ago
    sites.google.com
    • theendisney 1y ago
      The same outfit is runimg a domain called blogger. Reminds me of MS blocking a website of mine for dangerous script. The offending thing i did was use document.write to put copyright 2025 (with the current year) at the end of static pages.
      • samplatt 1y ago
        My work's email filter regularly flags links to JIRA and github as dangerous. It stopped being even ironically amusing after a while.
        • typpilol 1y ago
          I feel like the GitHub one might be okay since a lot of malware binaries are hosted there still.
        • close04 1y ago
          Microsoft's own Outlook.com flags Windows Insider emails coming from a .microsoft.com domain as junk even after marking the domain as "no junk". They know themselves well.
• pkulak 1y ago
  Can I use this space to comment on how amazing Immich is? I self host lots of stuff, and there’s this one tier above everything else that’s currently, and exclusively, held by Home Assistant and Immich. It is actually _better_ than Google photos (if you keep your db and thumbs on ssd, and run the top model for image search). You give up nothing, and own all your data.
  • 63stack 1y ago
    I migrated over from google photos 2 years ago. It has been nothing but amazing. No wonder google has it in its crosshairs.
    • oblio 1y ago
      Don't they block NextCloud sync in the Play Store, for similar reasons?
  • alex_duf 1y ago
    yeah same, I'm in the process of migrating so I have both google photo and immich, and honestly immich is just as good. I actually find the semantic search of immich slightly better.
  • shaky-carrousel 1y ago
    What model do you recommend for image search?
    • sireat 1y ago
      Not OP, but CLIP from OpenAi (2021) seems pretty standard and gives great results at least in English (not so good in rarer languages). https://opencv.org/blog/clip/ https://opencv.org/blog/clip/ Essentially CLIP lets to encode both text and images in same vector space. It is really easy and pretty fast too generate embeddings. Took less than hour on Google Colab. I made a quick and dirty Flask app that lets me query my own collection of pictures and provide most relevant ones via cosine similarity. You can query pretty much anything on CLIP (metaphors, lightning, object, time, location etc). From what I understand many photo apps offer CLIP embedding search these days including Immich - https://meichthys.github.io/foss_photo_libraries/ https://meichthys.github.io/foss_photo_libraries/ Alternatives could be something like BLIP.
• ozgrakkurt 1y ago
  Curious if anyone had an instance where this blocking mechanism saved them. I can’t remember a single instance in last 10 years
  • jeroenhd 1y ago
    I've had it work for me several times. Most of the time following links/redirects from search engines, ironically a few times from Google itself. Not that I was going to enter anything (the phishing attempts themselves were quite amateurish) but they do help in some rare cases. When I worked customer service, these phishing blocks worked wonders preventing people from logging in to your-secure-webmail.jobz. People would be filling in phishing forms days after sending out warnings on all official channels. Once Google's algorithm kicked in, the attackers finally needed to switch domains and re-do their phishing attempts.
  • Valodim 1y ago
    Your parents probably have
• n3storm 1y ago
  [flagged]
• nalekberov 1y ago
  First thing I do when I start to use a browser for the first time is making sure 'Google Safe Browsing' feature is disabled. I don't need yet another annoyance while I browse the web, especially when it's from Google.
• bitwize 1y ago
  [flagged]
  • zidnch 1y ago
    I heard the CEO has a Hitler bedspread and Mussolini tattoo on the far-right of his right buttock.
• mads_quist 1y ago
  Never host your test environments as Subdomains of your actual production domain. You'll also run into email reputation as well as cookie hell. You can get a lot of cookies from the production env if not managed well.
  • lucideer 1y ago
    This. I cannot believe the rest of the comments on this are seemingly completely missing the problem here & kneejerk-blaming Google for being an evil corp. This is a real issue & I don't feel like the article from the Immich team acknowledges it. Far too much passing the buck, not enough taking ownership.
    • mads_quist 1y ago
      Yep. Still I feel bad for them.
      • lucideer 1y ago
        I think my comment came across a bit harsh - the Immich team are brilliant. I've hosted it for a long time & couldn't be happier & I think my criticisms of the tone of the article are likely a case of ignorance rather than any kind of laziness or dismissiveness. It's also in general a thankless job maintaining any open-source project, especially one of this scale, so a certain level of kneejerk cynical dismissiveness around stuff like this is expected & very forgivable. Just really hope the ignorance / knowledge-gap can be closed off though, & perhaps some corrections to certain statements published eventually.
    • kevincox 1y ago
      Both things can be problems. 1. You should host dev stuff and separate domains. 2. Google shouldn't be blocking your preview environments.
      • lucideer 1y ago
        A safe browsing service is not a terrible idea (which is why both Safari & Firefox use Google for this) & while I hate that Google has a monopoly here, I do think a safe browsing service should absolutely block your preview environments if those environments have potential dangers for visitors to them & are accessible to the public.
• dizlexic 1y ago
  Ran a clickbait site, and got flagged for using a bunch of 302 redirects instead of 301s. Went from almost 500k uniques a month to 1k. During the appeal it was reviewed from India, and I had been using geoblocking. This caused my appeal to be denied. I ended up deploying to a new domain and starting over. Never caught back up.
  • poisonborz 1y ago
    Congrats on this great choice of business endeavor
    • dizlexic 1y ago
      I hear this a lot. I'm self-taught and had just been let go from my first dev job ever. I was broke and desperate so I built something. I have been ashamed of it at multiple times in my career, but tbh I built something that fed, sheltered, and clothed me. It was worth. I also learned a lot.
• a10c 1y ago
  Google often marks my homelab domains as dangerous which all point to an A record that is in the private IP space, completely inaccessible to the internet. Makes precisely zero sense.
  • deleted 1y ago
    [deleted]
• teekert 1y ago
  Given the scale of Google, and the nerdiness required to run Immich, I bet it's just an accident. Nevertheless, I'm very curious as to how senior Google staff looks at Immich, are they actually registering signals that people use immich-go to empty their Google Photos accounts? Do they see this as something potentially dangrous to their business in the long term? The nerdsphere has been buzzing with Immich for some time now (I started using it a month back and it lives up to its reputation!), and I assume a lot of Googlers are in that sphere (but not neccessarily pro-Google/anti-Immich of course). So I bet they at least know of it. But do they talk about it?
  • bspammer 1y ago
    I love Immich but the entire design and interface is so clearly straight up copied from Google photos. It makes me a bit nervous about their exposure, legally.
• lucideer 1y ago
  I've rarely seen a HN comment section this overwhelmingly wrong on a technical topic. This community is usually better than this. Google is an evil company I want the web to be free of, I resent that even Firefox & Safari use this safe browsing service. Immich is a phenomenal piece of software - I've hosted it myself & sung its praises on HN in the past. Put putting aside David vs Goliath biases here, Google is 100% correct here & what Immich are doing is extremely dangerous. The fact they don't acknowledge that in the blog post shows a security knowledge gap that I'm really hoping is closed over the course of remediating this. I don't think the Immich team mean any harm but as it currently stands the OP constitutes misinformation.
  • dvdkon 1y ago
    > what Immich are doing is extremely dangerous I've read the article and don't see anything dangerous, much less extremely so. Care to explain?
    • lucideer 1y ago
      They're auto-deploying PRs to a subdomain of a domain that they also use for production traffic. This allows any member of the public with a GitHub account to deploy any arbitrary code to that subdomain without any review or approval from the Immich team. That's bad for two reasons: 1. PR deploys on public repos are inherently tricky as code gains access to the server environment, so you need to be diligent about segregating secrets for pr deployments from production secret management. That diligence is a complex & continuous undertaking, especially for an open source project. 2. Anyone with a GitHub account can use your domain for phishing scams or impersonation. The second issue is why they're flagged by Google (he first issue may be higher risk to the Immich project but it's out of scope for Google's safe browsing service). To be clear: this isn't about people running their own immich instance. This is about members of the public having the ability to deploy arbitrary code without review. --- The article from the Immich team does mention they're switching to using a non-production domain (immich.build) for their PR builds which does indicate to me they somewhat understand the issue (though they've explained it badly in the article), but they don't seem to understand the significance or scope.
• shevy-java 1y ago
  I don't want Google to abuse the world wide web. It is time for real change - a world without Google. A world with less Evil.
• dmoreno 1y ago
  Happened to me last week. One morning we wake up and the whole company website does not work. Not advice with some time to fix any possible problem, just blocked. We gave very bad image to our clients and users, and had to give explanations of a false positive from google detection. The culprit, according to google search console, was a double redirect on our web email domain (/ -> inbox -> login). After just moving the webmail to another domain, removing one of the redirections just in case, and asking politely 4 times to be unblocked.. took about 12 hours. And no real recourse, feedback or anything about when its gonna be solved. And no responsibility. The worse is the feeling of not in control of your own business, and depending on a third party which is not related at all with us, which made a huge mistake, to let out clients use our platform.
  • kossTKR 1y ago
    I'm beginning to seriously think we need a new internet, another protocol, other browsers just to break up the insane monopolies that has been formed, because the way things are going soon all discourse will be censored, and competitors will be blocked soon. We need something that's good for small and medium businesses again, local news and get an actual marketplace going - you know what the internet actually promised. Anyone working on something like this?
    • simultsop 1y ago
      It will take the same or less amount of time, to get where we are with current Web. What we have is the best sim env to see how stuff shape up. So fixing it should be the aim, avoiding will get us on similar spirals. We'll just go on circles.
      • botverse 1y ago
        Having a decade of fresh air is also a good incentive regardless of how it ends
        • simultsop 1y ago
• maltris 1y ago
  This is crazy, it happened to the SoGO webmailer, standalone or bundled with the mailcow: dockerized stack as well. They implemented a slight workaround where URLs are being encrypted to avoid pattern detection to flag it as "deceiving". There is no responses from Google about this. I had my instance flagged 3 times on 2 different domains including all subdomains, displaying a nice red banner on a representative business website. Cool stuff!
• petepete 1y ago
  I write a couple of libraries for creating GOV.UK services and Google has flagged one of them as dangerous. I've appealed the decision several times but it's like screaming into a void. https://govuk-components.netlify.app/ https://govuk-components.netlify.app/ I use Google Workspace for my company email, so that's the only way for me to get in contact with a human, but they refuse to go off script and won't help me contact the actual department responsible in any way. It's now on a proper domain, https://govuk-components.x-govuk.org/ https://govuk-components.x-govuk.org/ - but other than moving, there's still not much anyone can do if they're incorrectly targeted.
  • Avamander 1y ago
    Google is not the only one marking subdomains under netlify.app dangerous. For a good reason though, there's a lot of garbage hosted there. Netlify also doesn't do a good enough job of taking down garbage.
• p0w3n3d 1y ago
  When the power is concentrated in one hands, those hands will always become the hands of a dictator
• asimpleusecase 1y ago
  I see a lot of comments here about using some browser that will allow ME to see sites I want to see, but I did not see a lot about how do I protect my site or sites of clients from being subjected to this. Is there anything proactive that can be done? A set of checks almost like regression testing? I understand it can be a bit like virus builders using anti virus to test their next virus. But is there a set of best practices that could give you higher probability of not being blocked?
  • lucideer 1y ago
    > how do I protect my site or sites of clients from being subjected to this. Is there anything proactive that can be done? Some steps to prevent this happening to you: 1. Host only code you own & control on your own domain. Unless... 2. If you have a use-case for allowing arbitrary users to publish & host arbitrary code on a domain you own (or subdomains of), then ensure that domain is a separate dedicated one to the ones you use for your own owned code, that can't be confused with your own owned hosted content. 3. If you're allowing arbitrary members of the public to publish arbitrary code for preview/testing purposes on a domain you own - have the same separation in place for that domain as mentioned above. 4. If you have either of the above two use-cases, publish that separated domain on the Mozilla Public Suffix list https://publicsuffix.org/ https://publicsuffix.org/
    • vintagedave 1y ago
      That would protect your domains from being poisoned by arbitrary publishing, but wouldn't it risk all your users being affected by one user publishing?
      • lucideer 1y ago
        Allowing user publishing is an inherent risk - these are good mitigations but nothing will ever be bulletproof. The main issue is protecting innocent users from themselves - that's a hard one to generalise solutions to & really depends on your publishing workflows. Beyond that, the last item (Public Suffix list) comes with some decent additional mitigations as an upside - the main one being that Firefox & Chrome both enable more restrictive cookie settings while browsing any domains listed in the public suffix list. --- All that said - the question asked in the comment at the top of the thread wasn't about protecting users from security risk, but protecting the domain from being flagged by Google. The above steps should at least do that pretty reliably, barring an actual legitimate hack occurring.
• scottydelta 1y ago
  This is a known thing since quite some time and the only solution is to use separate domain. This problem has existed for so long that at this point we as users adapt to it rather than still expecting Google to fix this. From their perspective, a few false positives over the total number of actual malicious websites blocked is fractional.
• stemc43 1y ago
  какие же они все таки гандоны
• amelius 1y ago
  There is no reason why a browser should __be__ a contentfilter. Instead, you should be able to install a preferred contentfilter into your browser.
• boobsbr 1y ago
  > YAML whitespace is cursed YAML itself is cursed: https://ruudvanasseldonk.com/2023/01/11/the-yaml-document-from-hell https://ruudvanasseldonk.com/2023/01/11/the-yaml-document-fr...
• timnetworks 1y ago
  I don't think I ever saw a legitimate warning, EVER. I push past SSL warnings EVERY DAY to manage infra.
• 31337Logic 1y ago
  F you, Google! Thank goodness I severed that relationship years ago. With so many other great (and ethically superior) products out there to choose from, you'd have to be a true masochist to intentionally throw yourself into their pool of shit.
• sinuhe69 1y ago
  >> Unfortunately, Google seems to have the ability to arbitrarily flag any domain and make it immediately unaccessible to users. I'm not sure what, if anything, can be done when this happens, except constantly request another review from the all mighty Google. Perhaps a complaint to the ETC for abusing the monopoly and lack of due process to harm legitimate business? Or DG COMP (in the EU). Gather evidence of harm and seek alliances with other open-source projects could build a momentum.
• sneak 1y ago
  This happened to amazon.de last week. It was resolved quickly. Google shouldn’t be a single chokepoint for web censorship.
• shoelessone 1y ago
  I don't see how this is an issue. To me, this does seem at least confusing, but possibly dangerous. If you have internal auth testing domains at the same place as user generated content, what's to stop somebody thinking a user-generated page isn't a legit page when it asked you to login or something? To me this seems like a reasonable flag.
  • bo0tzz 1y ago
    There is no user generated content involved here.
• yabones 1y ago
  This is another case where it's highly important to "plant your flag" [1] and set up all those services like Search Console, even if you don't plan to use them. Not only can this sort of thing happen, but bad-guys can find crafty ways of hijacking your search console account if you're not super vigilant. Google Postmaster Console [2] is another one everybody should set up on every domain, even if you don't use gmail. And Google Ads, even if you don't run ads. I also recommend that people set up Bing search console [3] and some service to monitor DMARC reports. It's unfortunate that so much of the internet has coalesced around a few private companies, but it's undeniably important to "keep them happy" to make sure your domain's reputation isn't randomly ruined. [1] https://krebsonsecurity.com/2020/08/why-where-you-should-you-plant-your-flag/ https://krebsonsecurity.com/2020/08/why-where-you-should-you... [2] https://postmaster.google.com/ https://postmaster.google.com/ [3] https://www.bing.com/webmasters/ https://www.bing.com/webmasters/
  • jmuguy 1y ago
    It does seem kind of stupid to (apparently) not have google search console, or even a google account according to them, for your business. I don't like Google being in control of so much of the internet - but they are, and it won't do us any good to shout into the void about it when our domain and livelihood is on the line.
• nucleative 1y ago
  We really need an internet Bill of Rights. Google has too much power to delete your company from existence with no due process or recourse. If any company controls some (high) percentage of a particular market, say web browsers, search, or e-commerce, or social media, the public's equal access should start to look more like a right and less like an at-will contract. 30 years ago, if a shop had a falling out with the landlord, it could move to the next building over and resume business. Now if you annoy eBay, Amazon or Walmart, you're locked out nationwide. If you're an Uber, Lyft, or Doordash (etc) gig worker and their bots decide they don't like you anymore, then sayonara sucker! Your account has been disabled, have a nice day and don't reapply. Our regulatory structure and economies of scale encourage consolidation and scale and grant access to this market to these businesses, but we aren't protecting the now powerless individuals and small businesses who are randomly and needlessly tossed out with nobody to answer their pleas of desperation, no explanation of rules broken, and no opportunity to appeal with transparency. It's a sorry state of affairs at the moment.
  • immibis 1y ago
    FWIW in some jurisdictions you might be able to sue them for tortious interference, which basically means they went out of their way to hurt your business.
  • 0_____0 1y ago
    Force interoperability. In 2009 I could run Pidgin and load messages from AIM, FB Messages, Yahoo... Where did that go? I suspect the EU will be the first region to push the big tech companies on this.
    • RajT88 1y ago
      Or enforce antitrust. As firearm enthusiasts like to say, "Enforce the laws we already have".
      • TheCoelacanth 1y ago
        We need to fix the jurisprudence around anti-trust. > No person engaged in commerce or in any activity affecting commerce shall acquire, directly or indirectly, the whole or any part of the stock or other share capital and no person subject to the jurisdiction of the Federal Trade Commission shall acquire the whole or any part of the assets of another person engaged also in commerce or in any activity affecting commerce, where in any line of commerce or in any activity affecting commerce in any section of the country, the effect of such acquisition may be substantially to lessen competition, or to tend to create a monopoly. Taken at face value, that would forbid companies from buying any large competitors unless the competitor is already failing. Somehow that got watered down into almost nothing.
• TechSquidTV 1y ago
  My local SABNZBD instance (not even accessible from the internet) was marked as a malicious site too.
• inflames123 1y ago
  [dead]
• KuSpa 1y ago
  I wonder when google.com will be flagged with all the phishing happening on sites.google.com.
  • account42 1y ago
    Not to mention the phishing in the sponsored results on google.com proper.
• awill 1y ago
  I'm sure it was a simple mistake. The fact that Immich competes with Google Photos has nothing to do with it.
• zerof1l 1y ago
  I believe that Jellyfin, Immish, and NextCloud login pages are automatically flagged as dangerous by Google. What's more, I suspect that Google is somehow collecting data from its browser - Chrome. Google flagged my domain as dangerous once. I do host Jellyfin, Immish, and NextCloud. I run an IP whitelist on the router. All packets from IPs that are not whitelisted are dropped. There are no links to my domain on the internet. At any time, there are 2-3 IPs belonging to me and my family that can load the website. I never whitelisted Google IPs. How on earth did Google manage to determine that my domain is dangerous?
• _cenw 1y ago
  This can happen to everyone. It happened to Amazon.de's Cloudfront endpoint a week ago. Most people didn't notice because Chrome doesn't look at the intermediate bits in the resolver chain, but DNS providers using Safe Browsing blocked it. https://github.com/nextdns/metadata/issues/1425 https://github.com/nextdns/metadata/issues/1425
• lbrito 1y ago
  This just makes me feel more loyalty towards Immich and disgust towards Google Photos. At this point I would rather use an analog camera with photo albums than Google Photos.
• dpifke 1y ago
  I had this same problem with my self-hosted Home Assistant deployment, where Google marked the entire domain as phishing because it contains a login page that looks like other self-hosted Home Assistant deployments. Fortunately, I expose it to the internet on its own domain despite running through the same reverse proxy as other projects. It would have sucked if this had happened to a domain used for anything else, since the appeal process is completely opaque.
• almosthere 1y ago
  This happened to me, I hosted a Wordpress site and it got 0'day'd (this was probably 8 years ago). Google spotted the list of insane pornographic URLs and banned it. You might want to verify nothing is compromised.
• kazinator 1y ago
  Simply opening a case saying that this is our website not impersonating anyone else is unlikely to get anything resolved. Just because it's your website, and you're not a bad agent doesn't prove that no part of the site is under the control of a bad agent, and that your site isn't accidentally hosting something malicious somewhere, or have some UI that is exploitable for cross-site scripting or whatever.
  • jrasm91 1y ago
    Sure, but why does Google approve our review over and over again without us making any changes or modifications to the flagged sites/urls? It's a vanilla Immich deployment with docker containers from GitHub pushed there by the core team.
• kazinator 1y ago
  The .internal.immich.cloud sites do not have matching certs! Navigating to https://main.preview.internal.immich.cloud https://main.preview.internal.immich.cloud, I'm right away informed by the browser that the connection is not secure due to an issue with the certificate. The problem is that it has the following CN (common name): main.preview.internal.immich.build. The list of alternative names also contains that same domain name. It does not match the site: the certificate's TLD .build is different from the site's .cloud! I don't see the same problem on external sites like tiles.immich.cloud. That has a CN=immich.cloud with tiles.immich.cloud as an alternative.
  • jrasm91 1y ago
    We've already moved them to immich.build
• archon810 1y ago
  A similar issue happened to us at APKMirror last week. https://x.com/ArtemR/status/1979428936267501626 https://x.com/ArtemR/status/1979428936267501626. We still don't know what caused it because it happened to the Cloudflare R2 subdomain, and none of the Search Console verification methods work with R2. It also means it's impossible to request verification.
• account42 1y ago
  Yes, this is not a new problem: Web browsers has taken on the role as internet police but they only care about their judgement and don't afford websites operators any due process or recourse. And by web browsers I mean Google because of course everyone just defers to them. "File a complaint with /dev/null" might be how Google operates their own properties but this should not be acceptable for the web as a whole. Google and those integrating their "solutions" need to be held accountable for the damage they cause.
• wordule 1y ago
  Either they have an open redirect being misused, or their domains are being used to host phish content. This is the way of things.
• antonvs 1y ago
  A class action lawsuit, charging anticompetitive behavior, on behalf of all Immich site operators could be a good idea here. Of course Google will claim it's just a mistake, but large tech companies - including e.g. Microsoft - have indulged in such behavior before. A lawsuit will allow for discovery which can help settle the matter, and may also encourage Google to behave like a good citizen.
• timnetworks 1y ago
  I realize now that Gigglebet is purposely fucking up Internet for everyone, and is paying unsuspecting chumps princely sums to do so. To kill the thing they say they love. Chrome is to Web what Teams is to Chat. Bad job guys.