5 ms·

I think it's somewhat tribal webdev knowledge that if you host user generated content you need to be on the PSL otherwise you'll eventually end up where Immich

I think it's somewhat tribal webdev knowledge that if you host user generated content you need to be on the PSL otherwise you'll eventually end up where Immich is now. I'm not sure how people not already having hit this very issue before is supposed to know about it beforehand though, one of those things that you don't really come across until you're hit by it.

hu3 1y ago
This is the first time I hear about https://publicsuffix.org https://publicsuffix.org
- btown 1y ago
  You're in good company! From 12 days ago: https://news.ycombinator.com/item?id=45538760 https://news.ycombinator.com/item?id=45538760
no_wizard 1y ago
I’ve been doing this for at least 15 years and it’s the first I heard of this. Fun learning new things so often but I never once heard of the public suffix list. That said, I do know the other best practices mentioned elsewhere
- foobarian 1y ago
  First rule of the public suffix list...
  - no_wizard 1y ago
    I think what gets me more is I don't see an easy way to add suffixes to the list. I'm sure if I dig I can figure it out but you'd think given how its used they'd have an obvious step by step guide on the website
    - CaptainOfCoit 1y ago
      Last link the menu header: https://publicsuffix.org/submit/ https://publicsuffix.org/submit/ Which then links to: https://github.com/publicsuffix/list/wiki/Guidelines#submitting-amendments https://github.com/publicsuffix/list/wiki/Guidelines#submitt... Fairly obvious and typical webpage > documentation flow I think, doesn't seem too hard to find.
      - account42 1y ago
        Ok so we need a GitHub (Microsoft) account to avoid needing a Google account to in case some undocumented system decides to shut down a website we host. Great.
        CaptainOfCoit 1y ago
        I agree, that's pretty dumb. But I wouldn't say "no easy way to add suffixes to the list" at the very least.
tonyhart7 1y ago
so its skill issue ??? or just google being bad????
- yndoendo 1y ago
  I will go with Google being bad / evil for 500. Google 90s to 2010 is nothings like Google 2025. There is a reason they removed "Don't be evil" ... being evil and authoritarian makes more money. Looking at you Manifest V2 ... pour one out for your homies.
  - shadowgovt 1y ago
    Sympathy for the devil, people keep using Google's browser because the safe search guards catch more bad actors than they false positive good actors.
    - hulitu 1y ago
      > people keep using Google's browser because the safe search guards catch more bad actors than they false positive good actors. This is the first thing i disable in Chrome, Firefox and Edge. The only safe thing they do is safely sending all my browsing history to Google or Microsoft.
      - shadowgovt 1y ago
        That's a reasonable thing for you to do (especially if you have some other signal source you use for malware protection), but HN readers are rarely representative of average users. This feature is there for my mother-in-law, who never saw a popup ad she didn't like. You might think I'm kidding; I am not. I periodically had to go into her Android device and dump twenty apps she had manually installed from the Play Store because they were in a ring of promoting each other.
    - bigbadfeline 1y ago
      > the safe search guards catch more bad actors than they false positive good actors. Well, if the legal system used the same "Guilty until proven innocent" model, we would definitely "catch more bad actors than false positive good actors". That's a tricky one, isn't it.
fn-mote 1y ago
Clearly they are not reading HN enough. It hasn’t even been two weeks since this issue last hit the front page. I wish this comment were top ranked so it would be clear immediately from the comments what the root issue was.
bo0tzz 1y ago
The Immich domains that are hit by this issue are -not- user generated content.
- CaptainOfCoit 1y ago
  They clearly are? It seems like GitHub users submitting a PR could/can add a `preview` label, and that would lead to the application + their changes to be deployed to a public URL under "*.immich.cloud". So they're hosted content generated by users (built application based on user patches) on domains under their control.
  - bo0tzz 1y ago
    I'm the guy that built the system, lol. Labels can only be added by maintainers, and the whole system only works for PRs from internal branches.
    - CaptainOfCoit 1y ago
      Ah, then that's a different situation then, sorry for misunderstanding the context and thanks for clearing that up! I was under the impression that Immich accepted outside contributions, and those would also have those preview sites created for their pending contributions.
cyberes 1y ago
[flagged]
nickjj 1y ago
Besides user uploaded content it's pretty easy to accidentally destroy the reputation of your main domain with subdomains. For example: 1. Add a subdomain to test something out 2. Complete your test and remove the subdomain from your site 3. Forget to remove the DNS entry and now your A record points to an IP address At this point if someone else on that hosting provider gets that IP address assigned, your subdomain is now hosting their content. I had this happen to me once with PDF books being served through a subdomain on my site. Of course it's my mistake for not removing the A record (I forgot) but I'll never make that mistake again. 10 years of my domain having a good history may have gotten tainted in an unrepairable way. I don't get warnings visiting my site but traffic has slowly gotten worse over time since around that time, despite me posting more and more content. The correlation isn't guaranteed, especially with AI taking away so much traffic but it's something I do think about.

hu3 1y ago

This is the first time I hear about https://publicsuffix.org https://publicsuffix.org

btown 1y ago
You're in good company! From 12 days ago: https://news.ycombinator.com/item?id=45538760 https://news.ycombinator.com/item?id=45538760

no_wizard 1y ago

I’ve been doing this for at least 15 years and it’s the first I heard of this. Fun learning new things so often but I never once heard of the public suffix list. That said, I do know the other best practices mentioned elsewhere

foobarian 1y ago
First rule of the public suffix list...
- no_wizard 1y ago
  I think what gets me more is I don't see an easy way to add suffixes to the list. I'm sure if I dig I can figure it out but you'd think given how its used they'd have an obvious step by step guide on the website
  - CaptainOfCoit 1y ago
    Last link the menu header: https://publicsuffix.org/submit/ https://publicsuffix.org/submit/ Which then links to: https://github.com/publicsuffix/list/wiki/Guidelines#submitting-amendments https://github.com/publicsuffix/list/wiki/Guidelines#submitt... Fairly obvious and typical webpage > documentation flow I think, doesn't seem too hard to find.
    - account42 1y ago
      Ok so we need a GitHub (Microsoft) account to avoid needing a Google account to in case some undocumented system decides to shut down a website we host. Great.
      - CaptainOfCoit 1y ago
        I agree, that's pretty dumb. But I wouldn't say "no easy way to add suffixes to the list" at the very least.

tonyhart7 1y ago

so its skill issue ??? or just google being bad????

yndoendo 1y ago
I will go with Google being bad / evil for 500. Google 90s to 2010 is nothings like Google 2025. There is a reason they removed "Don't be evil" ... being evil and authoritarian makes more money. Looking at you Manifest V2 ... pour one out for your homies.
- shadowgovt 1y ago
  Sympathy for the devil, people keep using Google's browser because the safe search guards catch more bad actors than they false positive good actors.
  - hulitu 1y ago
    > people keep using Google's browser because the safe search guards catch more bad actors than they false positive good actors. This is the first thing i disable in Chrome, Firefox and Edge. The only safe thing they do is safely sending all my browsing history to Google or Microsoft.
    - shadowgovt 1y ago
      That's a reasonable thing for you to do (especially if you have some other signal source you use for malware protection), but HN readers are rarely representative of average users. This feature is there for my mother-in-law, who never saw a popup ad she didn't like. You might think I'm kidding; I am not. I periodically had to go into her Android device and dump twenty apps she had manually installed from the Play Store because they were in a ring of promoting each other.
  - bigbadfeline 1y ago
    > the safe search guards catch more bad actors than they false positive good actors. Well, if the legal system used the same "Guilty until proven innocent" model, we would definitely "catch more bad actors than false positive good actors". That's a tricky one, isn't it.

fn-mote 1y ago

Clearly they are not reading HN enough. It hasn’t even been two weeks since this issue last hit the front page. I wish this comment were top ranked so it would be clear immediately from the comments what the root issue was.

bo0tzz 1y ago

The Immich domains that are hit by this issue are -not- user generated content.

CaptainOfCoit 1y ago
They clearly are? It seems like GitHub users submitting a PR could/can add a `preview` label, and that would lead to the application + their changes to be deployed to a public URL under "*.immich.cloud". So they're hosted content generated by users (built application based on user patches) on domains under their control.
- bo0tzz 1y ago
  I'm the guy that built the system, lol. Labels can only be added by maintainers, and the whole system only works for PRs from internal branches.
  - CaptainOfCoit 1y ago
    Ah, then that's a different situation then, sorry for misunderstanding the context and thanks for clearing that up! I was under the impression that Immich accepted outside contributions, and those would also have those preview sites created for their pending contributions.

cyberes 1y ago

[flagged]

nickjj 1y ago

Besides user uploaded content it's pretty easy to accidentally destroy the reputation of your main domain with subdomains. For example: 1. Add a subdomain to test something out 2. Complete your test and remove the subdomain from your site 3. Forget to remove the DNS entry and now your A record points to an IP address At this point if someone else on that hosting provider gets that IP address assigned, your subdomain is now hosting their content. I had this happen to me once with PDF books being served through a subdomain on my site. Of course it's my mistake for not removing the A record (I forgot) but I'll never make that mistake again. 10 years of my domain having a good history may have gotten tainted in an unrepairable way. I don't get warnings visiting my site but traffic has slowly gotten worse over time since around that time, despite me posting more and more content. The correlation isn't guaranteed, especially with AI taking away so much traffic but it's something I do think about.