They don&#x27;t even validate that blacklist entries actually contain an offending URL in the report. That&#x27;s how much they care.

Reviews would have to be done by humans and humans doing things themselves is bad for the bottom line.

Google doesn’t need to do it, so they won’t spend the effort to do it.

“We don’t care, we don’t have to.”

I have no extra knowledge on the subject, but if the flagged website was indeed serving malicious content, the brakes would have to come down pretty hard. If you have a review period you can end up serving malware to hundreds&#x2F;thousands of people. Don&#x27;t know how often this happens, though, and what the false positive rate is, it&#x27;d be interesting to see.

That would probably cut a lot into their profits. Automating these tasks even if some people get cancelled wrongly is way cheaper than hiring people for reviews. Hey are so big that losing a few customers doesn’t mean much to them.I am waiting for the day when this happens to a large company. My company has more and more stuff on AWS. If Amazon cuts us off by accident the damage will quickly go into the billions.

1) Google doesn&#x27;t want any humans in the loop. Humans are expensive. Would sending a warning first result in more humans involved or less? More. So not gonna happen.2) Google claims any information given to exploiters of its rules and systems aids the next attempt. So they don&#x27;t like to give out any information about what AI rule you tripped to get banned.

It&#x27;s absurd. This thing happens on the play store. I&#x27;ve seen it happen multiple times due to pure mistakes. It takes an appeal and time to resolve the issue, in the meantime you are stuck.Their appeals form only lets you submit 1,000 characters, no images or attachments. So in many cases, it&#x27;s hard to even provide proof of the mistake. For example, if they falsely takedown your app for trademark infringement, but you have priority rights in a country or a registered mark, how are you supposed to effectively prove that in 1,000 characters with no images? In one case, we had a decision from the trademark office in our favor, but we were unable to attach it in any way and had to try and summarize it in like 300 characters.There is no reason in most cases to not provide a warning period and the opportunity to provide evidence and exhibits.They act so much like a monopoly in this case that they are stupidly making things harder for themselves. Sundar and Google&#x27;s legal team should take all the PMs aside and tell them they are going to start losing antitrust cases left and right if they can&#x27;t provide more due process for decisions.

Because malware sites are practically ephemeral, pop up and disappear on short time frames. A review period wouldn’t do much except let them game the system even better.

Why can&#x27;t companies like google just have a warning and review period before taking actions like this?

That’s not a bad idea. In general I am believing more and more that businesses that exceed a certain size are harmful for the overall economy. They may be more efficient and generate lower customer prices but they also harm innovation and prevent smaller companies from succeeding.

Ideally, we would be able to choose the best company, such as the one that does answer their phones. In this case we can&#x27;t, which is the real problem.

Maybe there should be a law that any business that has over ten billion dollars in annual revenues has to answer the phone when you call them and have a reasonable resolution process for complaints.If that ruins your business model, cool. Just spin off parts of the business until each one is back under ten billion in revenue and do whatever you want.

As a person why suffers from myopia, I find this analogy offensive.

Yes,  but an inverted magoo.  Mr. Magoo assumed the best intentions of everything he bumped into (and misunderstood).

I’ve being increasingly wary of Google’s offerings altogether. Their ban hammer seems to be driven by Mr Magoo, who looks at everything and sees threats, and makes judgements.

But, left with fewer resources, Google&#x27;s security might become like the security of smaller companies, and the crowd will be crying.

Eventually, Google will get to the point when regulators will come to gut it and the crowd will be cheering

So what would they use instead? It&#x27;s not like there are any other free, real-time and mostly accurate malicious-URL databases around for people to plug into their browsers and products.

What other browsers? Almost all users of SB are using Chrome.

I would agree, but &quot;apparently maliciously&quot; is too subjective.According to US conservatives this is what Twitter, Facebook, Amazon, Google, Apple, Twilio, Snapchat, etc all did to Parler for political reasons.According to US progressives&#x2F;liberals it was absolutely not malicious, but rather the polar opposite: protecting people.These days there is no common agreement on that stuff, and given the recent events I see no reason to believe that they wouldn&#x27;t do as GP asked.

Author here. I think it&#x27;s too late in the cycle for that. This list is too widespread and anyone that is banned from it needs to immediately work around the issue somehow, therefore reducing the visibility of the problems.

No, I don&#x27;t think that&#x27;s how it would play out.1. Google bans parler.com on Jan. 8th by adding it as an &quot;unsafe URL&quot; to their blacklist.2. Mozilla issues statement: &quot;While we don&#x27;t believe it was prudent to use the Safe Browsing blacklist for this purpose, given recent events, we will not be unblocking parler.com, and do not currently deem it necessary to maintain a separate safe browsing list.&quot;3. Something similar happens a few months from now, and this time there&#x27;s no statement from Mozilla or Microsoft. It has now become accepted that blacklisting less-moderated social media, which can cause real-world harm, is a normal use for the Safe Browsing list.The problem is, if a mainstream browser goes against the flow, it becomes &quot;The Nazi Browser.&quot; Its market share was already less than Chrome&#x27;s, and now it&#x27;s getting all these new users who are outcasts. This is a Hard Problem of moderation in a small market. You can&#x27;t be the one out of three players who moderates less, lest you be overwhelmed by undesirables and less-desirables.

There&#x27;s a very obvious reason not to do that: if you apparently maliciously cry wolf a few times, people won&#x27;t trust your cries any more, and, for example, other browsers might choose to stop using the Google Safe Browsing list.

Users would start to ignore the warnings and proceed anyway, or even turn safe browsing off.

Is there any reason that Google couldn&#x27;t, or wouldn&#x27;t, repurpose Google Safe Browsing to blacklist sites that are &quot;unsafe&quot; due to under- or poorly moderated content? E.g. doing this to Parler after they find hosting again? I can&#x27;t think of a reliable one.

Author here.That is definitely a good idea, and I recommend it. But that should not be the main takeaway.In our particular case, that was not found to be the problem (we think it was some sort of false positive), and there are valid reasons for users to do that anyway (upload a phishing email attachment onto an IT support ticket, for example).

Pretty sure the main point was a private company can effectively delist you from the internet without any rhyme or reason. Most of us have heard Google horror stories when you use their products the fact you can be free of them and have any new customers bounce from your sight in terror is uh, terrifying.I would like to emphasize of course they have good stated reasons for warning users before accessing websites. The issue is that they are a private company whose behavior affects all major browsers and (for kicks) they have an extremely opaque review process.If you ran a &quot;divest from Big Tech&quot; website which started gaining steam they could delist like this and the only real force stopping them is public backlash. If you think you can effectively sue Google to stop them I have a bridge to sell you.

Sorry, but you don&#x27;t get to tell me I am obligated to browse your site without being notified if you have malware.

&gt; I think another take away from this article is “don’t allow users to upload malicious files to your domain”I disagree, at which point did we all accept Google&#x27;s role as defacto regulator and arbiter of the Internet? Why should we tacitly accept the constraints they deem as appropriate and modify the way we build the web?In other words, those are our domains, our apps, our systems and we&#x27;ll do as we please; that includes worrying about content moderation, or not.When and why did we accept google as the Internet&#x27;s babysitter?Apologies if this sounds aggressive, but your takeaway reflects an appalling and quite fatalistic mindset; one which I sadly believe is increasingly common: big corporations knows best, big corporations say and we do, big corporations lead the way.On the other hand, probably I&#x27;m just biased and tired considering how tiresome it&#x27;s been to explain to my friends and family why Signal is the better alternative after the WhatsApp&#x2F;Facebook fiasco.&#x2F;EndRant

&gt; Getting a real business added to this blocklist by a bot though is not cool.Real businesses can (and often do) host malware too. There was a notable event where php.net was hacked and hosting malware, which Google flagged. The owner of php.net was pretty mad at first and claimed it was a false positive. It wasn&#x27;t.

I think the author highlights the main issue at the end of the article. This is where pressure needs to be applied. I get it, Google’s process probably protects a lot of end users from malicious sites. Getting a real business added to this blocklist by a bot though is not cool. Perhaps a process to whitelist your own domains if this power can’t be wrangled from Google.&gt; Google literally controls who can access your website, no matter where and how you operate it. With Chrome having around 70% market share, and both Firefox and Safari using the GSB database to some extent, Google can with a flick of a bit singlehandedly make any site virtually inaccessible on the Internet.&gt; This is an extraordinary amount of power, and one that is not suitable for Google&#x27;s &quot;an AI will review your problem when and if it finds it convenient to do so&quot; approach.

Easier?What&#x27;s the easy way to distinguish between &quot;malicious&quot; and &quot;non-malicious&quot; files?

I think another take away from this article is “don’t allow users to upload malicious files that you then host from your domain”This seems easier to do than jumping domains.

The section about ants and Google shifting on its planetary chair is perhaps the best part of this article. A sobering way to look at it.

Author here. That was exactly our situation with the impacted systems. We got lucky with the fast &quot;review&quot; and it happened late enough in the day that only PST customers were impacted meaningully.But still, quite frightening, hence the post. It&#x27;s not a failure mode we had in mind when we established the SLAs.

Are there any no win, no fee law firms that specialize in these cases? What if for every hour offline, your SAAS loses X money? For this particular case, what if due to the service disruption, some customers decide to move their business elsewhere? Enforce an SLA?

We seriously need to break up Google. This is a chokepoint for innovation, should not be controlled by one company, and has serious downstream consequences on economic growth as a nation.

Imagine a future where multiple big tech companies share “blacklists” of individuals and applications that should be banned across their networks. Your entire business and digital life could be snuffed out in an instant. Already seen it happen, now it just has to scale.

Yes I agree with you (and thank you for your medium post by the way. Our only chance of ever improving the situation is to call attention to it. I fully believe Google leadership has to be aware of it at this point, but it clearly won&#x27;t be a priority to them to fix until the public backlash&#x2F;pressure is great enough that they have to).Just to avoid any misreading, I didn&#x27;t say I thought it was malice on Google&#x27;s part. My opinion (as mentioned above, is):&gt; I still don&#x27;t think it&#x27;s outright malice, but the doubling down on these horrific practices (algorithmically and opaquely destroying people) is so egregious that it doesn&#x27;t really matter.So they are not (at least in my opinion without seeing evidence to the contrary) outright malicious. But from the perspective of a site owner, I think they should be considered as such and therefore mitigations and defense should be a part of your planning (disaster recovery, etc).

Great article. It’s not malice, it’s indifference.Googles execs and veeps don’t care about small businesses, because most are career ladder climbers who went straight from elite colleges to big companies. Conformists who won’t ever know what it’s like to be a startup. As a group, empathy isn’t a thing for them.

Agree, we can only vote with our clicks.Sadly gmail and google docs are top notch products :(

They have the option of not wielding the hammer. I for one never appointed them the guardian of the walled internet.

IMHO, it sounds like it worked. The things you changed sound like it&#x27;s made your site more secure. In the future, Googles hammer can be a bit more precise since you&#x27;ve segregated data.And you don&#x27;t know what triggered it. It&#x27;s possible that one of your clients was compromised or one of their customers was trying to use the system to distribute malware.

Is this list only maintained by Google? Do Firefox and Bing use the same list, is their process better&#x2F;different? Is there any sharing happening?

That is malice.Accidentally unleashing a process that harms people is negligence. Not caring that you are being negligent is malice.

Have you considered not using a 3rd party for hosting your JavaScript?  There is always going to be some risk if the code isn’t under your control.

Author here. I don&#x27;t think it&#x27;s malice on their part, but their hammer is too big to be wielded so carelessly.

Thanks, I totally agree. Just to be clear I&#x27;m not saying it&#x27;s malice as I don&#x27;t believe that. I&#x27;m just saying the end result is the same so one should consider them a hostile actor for purposes of threat modeling.Given you&#x27;re the second person who I think took away that I was accusing them of malice, I probably need to reword my post a bit to reduce confusion.Accusing them of malice is irresponsible without evidence, and if I were doing that it would undermine my credibility (which is why I&#x27;m pointing this out).

They probably aren&#x27;t malicious, but they are definitely antagonists.

&gt;”never attribute to malice that which is adequately explained by stupidity&quot;I keep reading this on the internet as if it’s some sort of truism, but every situation in life is not a court where a prosecutor is trying to prove intent.There is insufficient time and resources to evaluate each and every circumstance to determine each and every causative factor, so we have to use heuristics to get by and make the best guesses. And sometimes, even many times, people do act with malice to get what they want. But they’re obviously not going to leave a paper trail for you to be able to prove it.

Well, I think the stupidity and laziness is exacerbated by their ill will towards customers and users. This is also what prevents them from reforming. The general good will and sense of common purpose was necessary in Google&#x27;s early days when they portrayed themselves as shepherds of the growth of the web. Now they are more like feudal tax collectors and census takers. Sure they are mostly interested in extracting their click-tolls, but sometimes they just do sadistic stuff because it feels good to hurt people and to be powerful. Any pseudo-religious sense of moral obligation to encourage &#x27;virtuous&#x27; web practices has ossified, decayed, been forgotten, or been discarded.

I&#x27;d add to this that willfully refusing to remedy stupid can be an act of malice.

I would argue that a consistent behave defeats the benefit of the doubt or involuntary stupidity. Also I believe most of good sounding quotes may be easy to remember but not backed by many truths.

I think mistakes just happen and are possibly just as helpful as they are harmful to Google. If they find something they particularly hate or damaging they can just &quot;oops&quot; their way to the problem being gone. Take Firefox[1], each time a service went &quot;oops&quot; on Firefox they gained marketshare on Chrome.I have no doubt they&#x27;d use similar &quot;oops&quot; for crushing a new competitor in the ad space. Or perhaps quashing a nascent unionizing effort. It&#x27;s all tinfoil of course because we don&#x27;t have any public oversight bodies with enough power to look into it.[1] <a href="https:&#x2F;&#x2F;www.techspot.com&#x2F;news&#x2F;79672-google-accused-sabotaging-firefox-again.html" rel="nofollow">https:&#x2F;&#x2F;www.techspot.com&#x2F;news&#x2F;79672-google-accused-sabotagin...</a>

&quot;Consciously malicious&quot; is not a good rule of thumb standard to measure threats to yourself or your business; it only accounts for a tiny bit of all possible threats. GP isn&#x27;t claiming that Google is consciously malicious, they are claiming that you should prepare as if they were. These are not the same thing.A lion may not be malicious when it&#x27;s hunting you, it&#x27;s just hungry; look out for it anyway. A drunk driver is unlikely targeting you specifically; drive carefully anyways. Nobody at Google is specifically thinking &quot;hehehe now this will ruin jdsalareo&#x27;s business!&quot; but their decisions are arbitrary, generally impossible to appeal, and may ruin you regardless; prepare accordingly.

I personally find Hanlon&#x27;s Razor to be gratuitously misapplied. Corporate strategy is often better described as weaponized willful ignorance. You set up a list of problems that shall not be solved or worked on, and that sets the tone of interaction with the world.Plus financial incentive creates oh so many opportunities for things to go wrong or be outright miscommunicated it is not even funny.

Your comment made me think that they have the same attitude with support as they do with hiring, they are ok with a non fine-tuned model as long as the false positives &#x2F; negatives impact individuals rather than Google’s corporate goals.

Employees and managers at Google get promoted by launching features and products. They&#x27;re constitutionally incapable of fixing problems caused by over-active features for the same reason they&#x27;ve launched seven different chat apps.

&quot;never attribute to malice that which is adequately explained by stupidity&quot; and all that, but after the events and the almost perfectly orchestrated behavior we&#x27;ve seen in the past and last couple of weeks it&#x27;s becoming increasingly difficult, at least to me, to not attribute this to malice. Probably deliberate negligence is a better term. They know their systems can make mistakes, of course they do, and yet they build many of their ban-hammers and enforce them as if hat wasn&#x27;t the case.This approach to system&#x27;s engineering is the technological equivalent of the personality trait I most abhor: the tendency to jump quickly to conclusions and not be skeptical of one&#x27;s own world-view.[1] <a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Hanlon%27s_razor#cite_note-murphytwo-1" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Hanlon%27s_razor#cite_note-m...</a>

They&#x27;re never gonna care. They aren&#x27;t incentivized to care.  The only thing that can change the situation is the power of the American federal government, which needs to break Alphabet into 20-50 different companies.

&gt; nobody in power at Google caresMy assessment might be “nobody in power has time to prevent the myriad of problems happening all of the time, even though they handle the majority, with help from businesses, government agencies, etc., and given the huge impact of some problems to society as a whole, they may feel as though they’re rising in the front seat of a roller coaster, unaware of your single voice among billions from the ground down below.”

Yeah that&#x27;s a fair question. I had a bad personal experience with them, but I&#x27;ve also seen plenty of issues too. There was a big one a little while ago about how Digital Ocean destroyed somebody&#x27;s entire company by banning them with AI: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=20064169" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=20064169</a> Original Twitter thread: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;w3Nicolas&#x2F;status&#x2F;1134529316904153089" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;w3Nicolas&#x2F;status&#x2F;1134529316904153089</a>In their defense they acknowledged it and some changes. I can&#x27;t find the blog post now so going from memory. But that only happened because he got lucky and it blew up on HN&#x2F;twitter and got the attention of leadership at DO. How many people have beenh destroyed in silence?In my case, Digital Ocean only allows one payment card at a time and my customer (for whom the services were running) provided me with a card that was charged directly.A couple months later my customer forgot that he had provided the card. He didn&#x27;t recognizer &quot;Digital Ocean&quot; and thought he had been hacked (which has happened to him before) and called the bank and placed a chargeback.When DO got the charge back they emailed me and also completely locked my account so I was totally unable to access the UI or API. I didn&#x27;t find out about the locked account until the next day. I responded to the email immediately, and called my customer, who apologized and called the bank to reverse the chargeback. I was as responsive as they could have asked for.The next day I needed to open a port in the firewall for a developer to do some work. I was greeted with the dreaded &quot;account logged&quot; screen. I emailed them begging and pleading with them to unblock my account. They responded that they would not unlock the account until the chargeback reversal had cleared. Research showed that it can take weeks for that to happen.I emailed again explaining that this was totally unacceptable. It is not ok to have to tell your client &quot;yeah sorry I can&#x27;t open that firewall port for your developer because my account is locked. Might be a couple of weeks.&quot;
After a day or so, they finally responded and unlocked my account. Fortunately they didn&#x27;t terminate my droplets, but I wonder what would have happened if I had already started using object storage as I had been planning. This was all over about $30 by the way.After that terrifying experience, I decided staying on DO was just too risky. Linode&#x27;s pricing is nearly identical and they have mostly the same features. Prior to launching my new infrastructure I emailed their support asking about their policy. They do not lock accounts unless the person is long-term unresponsive or has a history of abuse.I&#x27;ve talked with Linode support several times and they&#x27;ve always been great. They&#x27;re my go to now.

I&#x27;m with you on the rest, but what has DO done to not have the benefit of doubt?Also, to your point, an organization becomes something else than the sum of its parts, especially the bigger it gets.Google can be a malicious actor without necessarily having individuals make act maliciously.

&gt; Google&#x27;s desire for scale, scale, scale, meant that interactions must be handled through The AlgorithmsThat&#x27;s fine when you&#x27;re a plucky growth startup. Less fine when you run half the internet.If Google doesn&#x27;t want to admit it&#x27;s a mature business and pivot into margin-eating, but risk-reducing support staffing, then okay: break it back up into enough startup-sized chunks that the response failure of one isn&#x27;t an existential threat to everyone.

&gt; It simply lumbers forward, doing its thing. It is to be modeled as a threat not because it is malign, but because it doesn&#x27;t notice you exist as it takes another step forward.This is a concept that I think deserves more popular currency. Every so often, you step on a snail. People actually hate doing this, because it&#x27;s gross, and they will actively seek to avoid it. But that doesn&#x27;t always work, and the fact that the human (1) would have preferred not to step on it; and (2) could, hypothetically, easily have avoided doing so, doesn&#x27;t make things any better for the snail.This is also what bothers me about people who swim with whales. Whales are very big. They are so big that just being near them can easily kill you, even though the whales generally harbor no ill intent.

Your making another perfect case of why Google should be broken up. It’s important that we can choose again.

Modern large corporations are just an more inefficient, less effective paperclip maximizer, with humans gumming up the works.Google is striving hard to remove the &quot;human&quot; part of the problem.

&gt; “You will have killed us,” Gram said, “destroyed the culture that we have built for thousands of years, and you won’t even give it any thought. Your species doesn’t think about what it does any more. It just acts, like a single-celled animal, engulfing everything it can reach. You say that you are a conscious species, but that isn’t true. Your every action is... instinct. Or reflex.Good story. I can imagine what the specialized humans did to the generalist humans eons ago.

Except in our case, Google&#x27;s terraforming ships couldn&#x27;t care less. It&#x27;s just not part of their programming that there might be some intelligent life out there worth caring about that might be hurt by their actions, so there&#x27;s no way for them to receive this information. It&#x27;s not that it&#x27;s hard to explain, there&#x27;s nobody to explain it to.

Thanks for mentioning this story; I just finished it and it&#x27;s a great read.

Jon Williams, circa 1987, wrote a story of a far-flung humanity&#x27;s future in &quot;Dinosaurs,&quot; in which humans had been engineered into a variety of specialized forms to better serve humanity. After nine million years of tweaking, most of them are not too bright but they are perfect at what they do. Ambassador Drill is trying to prevent a newly discovered species, the Shar, from treading on the toes of humanity, because if the Shar do have even a slight accidental conflict as the result of human terraforming ships wiping out Shar colonies because they just didn&#x27;t notice them, the rather terrifyingly adapted military subspecies branches of humanity will utterly wipe out the Shar, as they have efficiently done with so many others, just as a reflex. Ambassador Drill fears that negotations, despite his desire for peace, may not go well, because the terraforming ships will take a long time to receive information that the Shar are in fact sentient and billions of them ought not to be wiped out ...Google, somehow, strikes me as this vision of humanity, but without an Ambassador Drill. It simply lumbers forward, doing its thing. It is to be modeled as a threat not because it is malign, but because it doesn&#x27;t notice you exist as it takes another step forward. Threat modeling Lovecraft-style: entities that are alien and unlikely to single you out in particular, it&#x27;s just what they do is a problem.Google&#x27;s desire for scale, scale, scale, meant that interactions must be handled through The Algorithms. I can imagine it still muttering &quot;The algorithms said ...&quot; as anti-trust measures reverse-Frankenstein it into hopefully more manageable pieces.

Of course they care. They&#x27;ve taken over everything they&#x27;ve been able to take over and they&#x27;re still going strong. This is not by mistake. They just care about different things than you do. This is why Google needs to be broken up.

Your clients will hate you for this as you are creating false positives. Sure, Google is sometimes unethical, but calling them a malicious actor? Really?

Massive bureaucratic nightmares never act with malice, but the people get crushed all the same.

&gt; I am not saying Google is acting with malice (I don&#x27;t believe they are personally)I&#x27;d agree. The problem is there is no financial or regulatory incentive to do the right thing here.It has zero immediate impact on their bottom line to have things work in the current fashion, and the longer term damage to their reputation etc. is much harder to quantify.There&#x27;s no incentive for them to fix this, so why would they?

&quot;Consider as&quot; does not mean &quot;is&quot;. Your lack of reading comprehension is not the fault of the poster.

Following &quot;Consider Google as a malicious actor&#x2F;threat&quot; with &quot;I am not saying Google is acting with malice&quot; is probably a strong indicator that you should have thought it through before posting it.

Nah-- I think you&#x27;ve got it all wrong. The problem isn&#x27;t the false positive&#x2F;false negative ratio chosen.The problem is that there&#x27;s false positives with substantial harm caused to others and with little path left open to them by Google to fix them &#x2F; add exceptions-- in the name of minimizing overhead.Google gets all of the benefit of the feature in their product, and the cost of the negatives is an externality borne by someone else that they shrug off and do nothing to mitigate.

They care, but the dominant policy in Google&#x27;s calculus about what features should be released is &quot;Don&#x27;t let the exceptional case drown the average case.&quot; A legitimate SaaS providing business to customers might get caught by this. But the average case is it&#x27;s catching intentional bad actors (or even unintentional bad actors that could harm the Chrome user), and Google isn&#x27;t going to refrain from releasing the entire product because some businesses could get hit by false positives. They&#x27;d much rather release the service and then tune to minimize the false positives.To my mind, one of the big questions about mega corporations in the internet service space is whether this criterion for determining what can be launched is sufficient. It&#x27;s certainly not the only criterion possible---contrast the standard for us criminal trial, which attempts to evaluate &quot;beyond a reasonable doubt&quot; (i.e. tuned to be tolerant of false negatives in the hope of minimizing false positives). But Google&#x27;s criterion is unlikely to change without outside influence, because on average, companies that use this criterion will get product to market faster than companies that play more conservatively.

&gt; they probably don&#x27;t realize what&#x27;s happening and will fix it“If only the czar knew!”

Isn’t it possible your service was hosting malware and you just didn’t know? This same problem killed Firefox Send:
<a href="https:&#x2F;&#x2F;support.mozilla.org&#x2F;en-US&#x2F;kb&#x2F;what-happened-firefox-send" rel="nofollow">https:&#x2F;&#x2F;support.mozilla.org&#x2F;en-US&#x2F;kb&#x2F;what-happened-firefox-s...</a>

Google Safe Search is only half the story. Another huge problem is Google&#x27;s opaque and rash decisions about what sites throw up warnings in Chrome.I once created a location-based file-transfer service called quack.space [0] very similar to Snapdrop, except several years before they existed. Unfortunately the idiot algorithms at Chrome blocked it, throwing up a big message that the site might contain malware. That was the end of it.I had several thousand users at one point, thought that one day I might be able to monetize it with e.g. location based ads or some other such, but Google wiped that out in a heartbeat with a goddamn Chrome update.People worry about AI getting smart enough to take over humans. I worry about the opposite. AI is too stupid today and is being put in charge of things that humans should be in charge of.[0] <a href="https:&#x2F;&#x2F;www.producthunt.com&#x2F;posts&#x2F;quack-space" rel="nofollow">https:&#x2F;&#x2F;www.producthunt.com&#x2F;posts&#x2F;quack-space</a>[1] <a href="https:&#x2F;&#x2F;snapdrop.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;snapdrop.net&#x2F;</a>

I&#x27;d go a step further and claim that most tech companies are ultimately a threat to people&#x27;s freedom and happiness. Not the tech itself, but the people that wield and profit from it.

Your comment reminds me of the first 30 seconds of this scene from The Third Man <a href="https:&#x2F;&#x2F;youtu.be&#x2F;vSc-91F5Wiw" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;vSc-91F5Wiw</a>

It&#x27;s probably &quot;scale thinking&quot; that makes google seem like they don&#x27;t care: Everything is huge when you&#x27;re &quot;at scale&quot;; the impact of a small blunder can take down companies or black out nation states. It&#x27;s part of the game of being &quot;at scale&quot;. They probably believe that it&#x27;s untenable to build the necessary infrastructure to where everything (website, startup, person, etc.) matters.This will sound crass, but it reminds me of Soviets cutting off the food supply to millions of people over the winter, due to industrial restructuring, and they brushed it off as &quot;collateral damage&quot;.

Google has a lot of control of the Web.Much less control of the Internet.One lesson is use IP and not the Web.

2*) Do you believe that it is possible to have a human review every FALSE POSITIVE result from automated malware detection on the internet, when reported by those adverse affected by the false positive result?Yes, yes I do. Banks do it for their customers today at scale.

Author here - I don&#x27;t underestimate the complexity of the task that Google Safe Browsing tries to accomplish.But: Do you believe there is no room for improvement in an automated, opaque system with clear evidence of malfunction, that quite succinctly decides if hundreds of people go unemployed when their company tanks for nothing other than an incorrectly set threshold on some algorithm?That is the real question to ask. Google is nowhere near its limits in terms of capability, as is made abundantly clear by its extremely comfortable financial position.

(Googler)You are only focusing on the negatives while completely ignoring the positives here.Here are a few questions to consider that may give you better perspective:1) Do you know the magnitude of financial and psychological damage caused by malware, phishing, etc on the web?2) Do you believe that it is possible to have a human review every piece of automation generated malware on the internet?3) Do you believe it is possible to build an automated system that provides value with zero false positives?4) Do you think an open standards body or government bureau would perform any better at implementing protections from the threats described here?

&gt; I use Linode now as their support is great and they don&#x27;t just drop ban hammers and leave you scrambling to figure out what happened.Linode once gave me 48 hours to respond (with threats to take down the site) because a URL was falsely flagged by netcraft based on what looked like an automated security scan of software I was hosting. Granted, they did not take any action and dropped the report once I pointed out that it was bullshit, but I do not consider this great service. If there is no real evidence of wrongdoing I should not be receiving ultimatums.

After years of seeing developments like this, getting worse and worse, it fills me with rage to think about how clearly nobody in power at Google cares.I naively used to think, &quot;they probably don&#x27;t realize what&#x27;s happening and will fix it.&quot; I always try to give benefit of the doubt, especially having been on the other side so many times and seeing how 9 times out of 10 it&#x27;s not malice, just incompetence, apathy, or hard priority choices based on economic constraints (the latter not likely a problem Google has though).At this point however, I still don&#x27;t think it&#x27;s outright malice, but the doubling down on these horrific practices (algorithmically and opaquely destroying people) is so egregious that it doesn&#x27;t really matter. As far as I&#x27;m concerned, Google is to be considered a hostile actor. It&#x27;s not possible to do business on the internet in any way without running into them, so &quot;de-Googling&quot; isn&#x27;t an option. Instead, I am going to personally (and advise my clients as well) to:Consider Google as a malicious actor&#x2F;threat in the InfoSec threat modeling that you do. Actively have a mitigation strategy in place to minimize damage to your company should you become the target of their attack.As with most security planning&#x2F;analyzing&#x2F;mitigation, you have to balance the concerns of the CIA Triad. You can&#x27;t just refuse Google altogether these days, but do NOT treat them as a friend or ally of your business, because they are most assuredly NOT.I&#x27;m also considering AWS and Digital Ocean more in the same vein, although that&#x27;s off topic on this thread. (I use Linode now as their support is great and they don&#x27;t just drop ban hammers and leave you scrambling to figure out what happened).Edit: Just to clarify (based on confusion in comments below), I am not saying Google is acting with malice (I don&#x27;t believe they are personally). I am just suggesting you treat it as such for purposes of threat modeling your business&#x2F;application.

Some derisking solution may be wrapping your web app as native client. E.g. Electron app is Chrome technically but you get more control over its settings. I know Microsoft (SmartScreen) and Apple may block apps for many reasons too but at least you get more baskets for your eggs.

Author here. The scary bit is that the blacklist is enforced client side in Chrome and other programs. Our servers and systems were running just fine when this happened, but if Google Chrome refuses to open your website, you&#x27;re still down.The closest parallel I can think of are expired SSL certificates, but the level of transparency and decentralization of that system vs. this opaque blacklist is not really on the same league.

You will save so, so much money switching away from clouds too.No, you don&#x27;t need to use a hundred different AWS&#x2F;GCP&#x2F;whatever services, and yes, managing your own infrastructure is a lot easier than you think (and sometimes easier&#x2F;faster than AWS).The Stack Exchange network, at least around 2018 or so, was hosted on 12 servers they own!

Yeah i read stories that Yahoo in 1990s called itself a media company and it&#x27;s product managers &quot;producers&quot; out of fear that once you call yourself a software company - Microsoft will crush you...As for using clouds - there is absolutely no point in the world to use them for anything above staging level, or very very low level launches. People should switch away from cloud as soon as they see even tentative signs of a product-market fit.

&gt; this is probably just collateral damage from some bot or ruleThe point is, collateral damage and&#x2F;or false positives are not acceptable for a service with an impact like this. In the real world, we consider them war crimes, etc. Bots and rules are implementations of policies and policies come with responsibility.

&gt; I do not think Google is doing it consciously -- this is probably just collateral damage from some bot or rule.&quot;Collateral damage&quot; from some bot or rule just means that Google doesn&#x27;t care enough about the edge cases (which, at Google scale, are particularly harmful): Google consciously decided this when implementing their algorithms.

This is not new; such things happened many times in the past (25 years ago Microsoft was the behemoth trampling small companies) and will happen again. I do not think Google is doing it consciously -- this is probably just collateral damage from some bot or rule.The way to handle it is to reduce dependencies on the cloud. This does not mean cutting cloud services altogether, but once the company is big enough (and the author talks about 1000s SMEs and millions of users), plan for graceful degradation with a fallback to a different provider and another fallback to owned servers.This takes work and reduces capability during the crunch, but it is often a lot easier and cheaper than people think if planned properly and not in a shotgun style of crisis engineering. My 2c.

What are you talking about? The article said that they didn&#x27;t change anything, because they found nothing wrong with the site. The ban from google was totally random without any explanation. And it went away without any changes or explanations about what was wrong.

Being completely blacklisted is very bad, but u know at least that something needs fixing. Imagine if google partially punishes u and downrank you in the search for no reason. This is harder to figure out. 
It took us several months to discover such a problem until finally we registered to google websmaster tool.

I think GSB is great because there is no other product like it, it is very fast to respond to most threats and it can be used for free. The only thing about it that&#x27;s not great is, in typical fashion, the lack of transparency about some of the processes. Not about how phishing verdicts are created, this should remain a closely guarded secret, but about what actually happens when you send a report or send a review request.

Updated my post to make it more clear I was referring to HN and not your post specifically.

Author here. It&#x27;s not really rhetoric, I wrote the post because it&#x27;s downright scary that your business of over 10 years can vanish in a puff of smoke because Google didn&#x27;t bother to require an offending URL field in an internet-wide blacklist. At the level they operate, there needs to be a semblance of due process.

It&#x27;s needed to make sure you can not claim bias. For example Google blocking competitors, or unfavourable information.

What about false positives?From the fine article: one Google system was detecting emails coming from another Google system as phishing. This is ridiculous.

&gt; an internet business, on the other hand, would prefer a false negative to a true positive, let alone a false positive.[Emphasis mine]This is crucial and it&#x27;s why the sub-threads imagining suing Google aren&#x27;t going anywhere. Google will very easily convince a judge that what they&#x27;re doing is beneficial to the general public, because it is, even though some HN contributors hate it because they&#x27;d prefer to meet a much lower standard.What I&#x27;m seeing a lot of in this thread is people saying OK, maybe a burger we sold did have rat droppings in it, but I feel like our kitchen ought to be allowed to stay open unless they buy at least a few hundred burgers and find rat droppings in a statistically significant sample and even then shouldn&#x27;t I get a few weeks to hire an exterminator? Isn&#x27;t that fairer to me?

The problem, from HN&#x27;s perspective, is that false positives on GSB hurt businesses a lot more than they hurt users or the internet at large.If I&#x27;m a random person browsing the internet at large, and a website I try to visit gets flagged as &quot;possibly malicious&quot;, well, I probably didn&#x27;t need the information or services on that particular website that badly anyway. I can find another website that offers the same information and services easily enough. Meanwhile, if my computer or browser is infected with malware, that&#x27;s pretty bad for me personally. I could lose money, time and personal data and security. The potential consequences are bad enough that I really shouldn&#x27;t risk it.On the other hand, if my business is blocked by GSB, that is very bad for my business. The customers I don&#x27;t lose are going to lose confidence in me. Meanwhile, the cost to me if I am accidentally hosting malware is pretty minimal. Even if a large number of my users are harmed by the malware, they&#x27;re unlikely to be so harmed they stop paying me, and it&#x27;s pretty hard for to know where you picked up malware, so it&#x27;s unlikely to be traced back to me. I&#x27;ve never actually heard of a lawsuit from an end-user against the website they downloaded malware from.A false negative from GSB is a lot worse for internet users than a false positive; an internet business, on the other hand, would prefer a false negative to a true positive, let alone a false positive.Add in that internet business owners (or people highly invested in internet businesses through their jobs) are over-represented on HN, and it&#x27;s no surprise that HN is not a fan of Google Safe Browsing.

It seems similar to the move from client side spam filters to the server side.Spam filtering really didn’t get better with the change (for me), but now it’s orders of magnitude harder to run an email server.Taking the article at face value, GSB makes it much harder to run a reliable web site. Has centralization of email into surveillance organizations hurt more than the benefit from saving bandwidth to download spams, and automatically deleting them at the client?How much damage will (further) centralization of web hosting onto social network sites (Facebook, Twitter, GitHub, Stack Exchange, etc, etc.) hurt the internet?It’s arguably already done more harm than good. I can’t even find a decent recipe that a high end laptop can efficiently display. I used to be able to download cookbooks worth of recipes, and my 386 could load them instantly.

It&#x27;s hard to argue against &quot;safe&quot;. If they would name it &quot;filtered browsing&quot; it might be something arguable, but &quot;safe browsing&quot; who wouldn&#x27;t want that?

If Safe Browsing were offered by some neutral internet organization (e.g., similar to IANA) I wouldn&#x27;t mind. But it&#x27;s offered by a private company: so it&#x27;s naive to think that GSB benefits anyone other than Google itself.

I&#x27;d guess a large net positive among the general population but maybe neutral for the tech literate like HN readers. Most tech-literate people are careful enough to recognize tactics used by phishing sites and won&#x27;t click on phishing links, or would click and immediately figure out it&#x27;s phishing. That cannot be said for the general population.

Can anyone &quot;in the know&quot; objectively comment if Google Safe Browsing (GSB) has had a net positive result or outcome for the Internet, at large?Has GSB helped users, more than it has hurt them?The anti-Google rhetoric [on HN] is becoming more tiresome as of late. Personally, I welcome the notifications in my browsers that a domain is unsafe. I can&#x27;t possibly be the only one.

My plans to trickle out details of my conversation with the Google employee were put on hold due to a massive change in my life responsibilities due to the novel coronavirus, but it’s my intention to resume soon.As I say on the website, this will culminate in my releasing the MBOX formatted file of the conversation, with full headers.

You may want to read these posts:<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=9977372" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=9977372</a><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=5419890" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=5419890</a>And this too:<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24109168" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24109168</a>

The story he links to, about the &quot;Online Slang Dictionary&quot; being removed from google search because the founder of Urban Dictionary was friends with googlers (true) and (allegedly) used his influence is fascinating:<a href="http:&#x2F;&#x2F;onlineslangdictionary.com&#x2F;pages&#x2F;google-panda-penalty&#x2F;" rel="nofollow">http:&#x2F;&#x2F;onlineslangdictionary.com&#x2F;pages&#x2F;google-panda-penalty&#x2F;</a>

Yes, the power of something like Google Safe Browsing is scary, especially if you consider the many many downstream consumers who might have an even worse update &#x2F; response time. Responsiveness by Google is not great, as expected, we recently contacted Google to get access to the paid WebRisk API and haven&#x27;t heard anything in a few months...However, phishing detection and blocking is not a fun game to be in. You can&#x27;t work with warning periods or anything like that, phishing websites are stood up and immediately active, so you have to act within minutes to block them for your users. Legitimate websites are often compromised to serve phishing &#x2F; malicious content in subdirectories, including very high-level domains like governments. Reliable phishing detection is hard, automatically detecting when something has been cleaned up is even harder.Having said all that, a company like Google with all of its user telemetry should have a better chance at semi-automatically preventing high-profile false positives by creating an internal review feed of things that were recently blocked but warrant a second look (like in this case). It should be possible while still allowing the automated blocking verdicts to be propagated immediately. Google Safe Browsing is an opaque product &#x2F; team, and its importance to Google was perhaps represented by the fact that Safe Browsing was inactive on Android for more than a year and nobody at Google noticed: <a href="https:&#x2F;&#x2F;www.zdnet.com&#x2F;article&#x2F;mobile-chrome-safari-and-firefox-failed-to-show-phishing-warnings-for-more-than-a-year&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.zdnet.com&#x2F;article&#x2F;mobile-chrome-safari-and-firef...</a>Lastly, as a business owner, it comes down to this: Always have a plan B and C. Register as many domains of your brandname as you can (for web, email, whatever other purpose), split things up to limit blast radius (e.g. employee emails not on your corporate domain maybe, API on subdomain, user-generated content on a completely separate domain) and don&#x27;t use external services (CDN) so you can stay in control.

Thank you for posting all the info here. And I’m glad that you managed to fix the problem. I think it must have caused you a lot of stress.

Author here. The second time around, the review confirmation email took around 12 hours to get to us.

&gt; I received an automated email confirming that the review had been successful around 2 hours after that fact. No clarification was given about what caused the problem in the first place. ... We never properly established the cause of the issue, but we chalked it up to some AI tripping on acid at Google&#x27;s HQ.I expect more of this Kafkaesque experience to come in the future.This is no longer a technical problem, but a social one. It can only be solved through legislation.

Great, so legitimate businesses need to implement tactics commonly used by c2c and malware to operate successfully

I wonder if a blockchain&#x2F;bittorrent decentralized option could exist to replace google.most people don&#x27;t have billions lying around to compete, but you could reward people who rented out space for the indexing data, and have advertisements baked in that could maybe still use some retargeting but without tracking any personally identifiable data about a person.Nodes could double as ai&#x2F;cpu processing for algorithms related to search and storage. Computation and storage amounts could have their own payout per action, or per time on storage.Most people have their computers on all the time anyways, so if they&#x27;re working in the background for them to earn some side income, while helping create a better internet.Would need some centralization I&#x27;d imagine though, I think the problem with de-centralization is the goal is ALL or nothing.Like one or two big servers that maybe tie everything to the rest, and push &#x27;updates&#x27; on algorithms, contracts,etc... to end users. Maybe a segregation index, knowing all airplane related searches are indexed on cluster c which has nodes 1-8, so you know where to go to get the info being searched.I&#x27;m a mainly full-stack but &#x27;dumb&#x27; developer, not an algorithms wiz, mostly focused on crud apps. But this would be fun to build.

Wait until this is also applied to a list of domains from the SPLC and other groups to further censor “hate speech” on the internet.

If your systems have any number of nines in their SLA, drafting a letter to Google&#x27;s legal department is not a viable strategy.

To any lawyers or even well-read armchair legal analysts, could this be a case of libel?

So de-google first, then sue.Otherwise you might as well give up and conclude that google not just controls the internet but is also above the law.

Once you enter litigation with Google, good luck accessing your Android.You may believe this is extreme, but many people have had their Gmail account suspended without known reason. So if they also have a reason...

Yeah my thought behind this was you are a large enough or wealthy enough company that you can afford lawyers. If you are an individual or mom and pop business whose blog or small e-commerce shop are blocked then you are probably SOL.

If you are a big enough company your lawyers could have a stern but relatively friendly chat with Google’s lawyers.I can neither confirm or deny this myself...

I wonder if it would be faster to deal with this through legal. I’m not a lawyer, but I wonder if you could send a C&amp;D to Google legal or something because this seems like an actual case of slander and reputation damage.

Author here. I&#x27;m not sure exactly how they actually decide to flag. Alternatively, Amazon might somehow be reporting files in S3 onto the Google blacklist.It would seem surprising, but it&#x27;s the other possibility.

The hashes of all things that match a &quot;probably evil&quot; bloom filter, yes.Hosting a virus on a domain and then downloading it a few times with different chrome installations sounds like a good way to get the whole domain blacklisted...

Sounds rather too resource-intensive? I&#x27;ve just tried with current Chrome on Windows and a 32MB zip on my personal domain, Wireshark says the file has not been sent anywhere.

&gt; Doesn&#x27;t Chrome upload everything downloaded to VirusTotal (a Google product)?It doesn&#x27;t, unless you opt for SafeSearch &quot;Enhanced Protection&quot; or enable &quot;Help improve security on the web for everyone&quot; in &quot;Standard Protection&quot;. Both are off by default, IIRC. Without it, it periodically downloads what amounts to bloom filter of &quot;potentially unsafe&quot; URLs&#x2F;domains.On the other hand, GMail and GDrive do run the checks via VirusTotal, as far as we know - which means that OP case may have been caused by having some of the recipients having their incoming mail automatically scanned. It&#x27;s similar for Microsoft version (FOPE users provide input for Defender Smart Screen), at least last time I checked.

&gt; What&#x27;s most interesting is that the bucket is private, so the only way they could identify that there is something malicious at a URL is if someone downloads it using Chrome. I&#x27;m assuming they make this decision based on some database of checksums.Doesn&#x27;t Chrome upload everything downloaded to VirusTotal (a Google product)?

We do, but it&#x27;s not good enough for Google.

Or you could screen your attachments for malware?

Our company [0] was also hit by this too.We receive email for our customers and a portion of that is spam (given the nature of email). Google decided out of the blue to mark our attachment S3 bucket as dangerous, because of one malicious file.What&#x27;s most interesting is that the bucket is private, so the only way they could identify that there is something malicious at a URL is if someone downloads it using Chrome. I&#x27;m assuming they make this decision based on some database of checksums.To mitigate, we now operate a number of proxies in front of the bucket, so we can quickly replace any that get marked as dangerous. We also now programmatically monitor presence of our domains in Google&#x27;s &quot;dangerous site&quot; database (they have APIs for this).0: <a href="https:&#x2F;&#x2F;www.enchant.com" rel="nofollow">https:&#x2F;&#x2F;www.enchant.com</a> - software for better customer service

Said NPO will be captured and subverted when the need arises and it is cost effective to do so.

&gt;Is there anything in particular that makes you believe that it&#x27;ll eventually happen?Humans have demonstrated the ability to eventually improve social systems to make them account for the needs and demands of the majority of stakeholders. In the offline world it has evolved into what is known as democracy. It started several centuries ago and eventually evolved into modern governments as we know it - publicly elected management boards.Recently, there was an excellent article [1] on HN. It rightfully compared the current state of internet to the feudal times and warlords common in the offline world many centuries ago. From that point through a long and painful process we&#x27;ve come to elected governments as the most sustainable form of governing a large number of humans. All other forms of government turned out to be unsustainable (no matter how attractive they were to certain individuals or organizations) and inevitably led to all kinds of social catastrophes.I believe, the same will eventually happen to the internet, our new brave world we used to love, but now seem to become increasingly disenchanted with.[1] <a href="https:&#x2F;&#x2F;locusmag.com&#x2F;2021&#x2F;01&#x2F;cory-doctorow-neofeudalism-and-the-digital-manor&#x2F;" rel="nofollow">https:&#x2F;&#x2F;locusmag.com&#x2F;2021&#x2F;01&#x2F;cory-doctorow-neofeudalism-and-...</a>

&gt; We will get to that point sooner or later.Is there anything in particular that makes you believe that it&#x27;ll eventually happen?Because personally my outlook on things is a bit more pessimistic - oftentimes the main concerns of individuals and organizations alike are financially-oriented and few share the enthusiasm for transparency and openness like Richard Stallman does.The trend of SaaSS ( <a href="https:&#x2F;&#x2F;www.gnu.org&#x2F;philosophy&#x2F;who-does-that-server-really-serve.html" rel="nofollow">https:&#x2F;&#x2F;www.gnu.org&#x2F;philosophy&#x2F;who-does-that-server-really-s...</a> ) because of companies not wanting to invest time in engineering their own solutions or even using FOSS, alongside with how many of them are handling GDPR and even cookie compliance, with the use of UX &quot;dark paths&quot; (e.g. it being easier to accept advertising cookies rather than deny them) doesn&#x27;t let me keep a positive outlook on things.It feels like we&#x27;ll all be reliant on the &quot;tech giants&quot; for a variety of things for the decades to come, even &quot;de-Googling&quot; oneself not always being feasible.

One corporation must not have so much power over billions of citizens of many countries. A power like that must only come from a transparent non-profit organization with a publicly elected management board.We will get to that point sooner or later. But the road there will be long and painful.

In this case they do not provide a service to the OP. There is no agreement between OP and Google.This is happening on browsers of their customers. And I&#x27;m quite sure that if Google hits a company that competes with Google services there must be a law that they will be breaking.There was a big case in Poland where Google blocked a SaaS web shop provider using the same exact mechanism [0]. Polish courts decided that Google claims displayed on block page were untrue. Unfortunately, the suing company did not receive compensation, because Google Poland does not operate Chrome browser. The court indicated that the right party to sue is Google incorporated in USA...[0] <a href="https:&#x2F;&#x2F;www.silesiasem.pl&#x2F;iai-przegralo-proces-sadowy-z-google-poland" rel="nofollow">https:&#x2F;&#x2F;www.silesiasem.pl&#x2F;iai-przegralo-proces-sadowy-z-goog...</a>

As of today there are no legal protection framework for digital services.Banking is heavily regulated , you are protected by hundreds if not thousands of laws.For digital services ? Twitter and Google can legitimately suspend ALL your accounts because you liked a Trump video on YouTube or Tweeted something « Hateful » to Biden.You can try to go court. You will loose 100% of the time. They are private businesses operating within their own terms, there is not « false » flag or wrong « ban »They’re private businesses offering a free service, they can cease to offer that at any moment that they want.

There may be a number of civil causes of action available...But litigate against a multi-billion dollar tech company? good luck.These companies are borderline immune to prosecution by the government, much less a small business.

I&#x27;m unsure whether it would be ruled libel, but I lean towards yes it would. There are two ways of seeing it:1) It is a false statement by google themselves (so no §230 protection) that caused material damage and is thus libelous
2) It is an opinion protected under free speech, and the free behavior of a private company, and the words like &quot;may have&quot; show it is not a statement of fact, and &quot;deceptive&quot; is just an opinion.Yet it feels very wrong and definately Google&#x27;s fault, and Google should be responsible for the damages, morally speaking.It&#x27;s more than just a false statement, the pop-up is keeping users from visiting the website. However, Google doesn&#x27;t intend to harm these companies in order to gain competitive advantage, it just harms them accidently, so the monopoly argument also has problems.It seems to me that we need a new law, or that current jurisprudence has let this one slip through and perhaps there will (in America) never be a proper crime for this situation due to divergent jurisprudence in this space that left open this gap.I would like to know whether it has been tested in court, or if anyone is in process of doing so.

This seems like something the FTC should be looking into, abuse of market position.

If their claim is false, then is it, in any jurisdiction, libelous?Maybe, legislation to bring consequences for false claims will help ensure algorithms, and the support teams that monitor them, do a better job. In an internet focused world, especially one with lock downs, wiping sites off of the internet with false claims is a heinously bad act.

Author here. Yes, &quot;serve&quot; is the correct interpretation. It is not clear how Google gets ahold of offending URLs within blacklisted domains (like the article says, there were no offending URLs provided to us).Theories:* Obtained from users of Google Chrome that load specific URLs in their browsers* Obtained from scanning GMail emails that contain links to URLs* Obtained from third parties that report these URLs

How would you even “store” data on a domain?

We’re pretty sure they get reports from Chrome. A security researcher at my workplace was running an exploit against a dev instance as part of their  secops role and got the domain flagged, despite the site being an isolated and firewalled instance not accessible to the internet.

We use a fair number of google products, and you can turn on a lot of enhanced protection, and many businesses do. This means even password protected &#x2F; private URLs may generate scans from what I&#x27;ve seen. I&#x27;m not sure how they actually fingerprint files (maybe locally) but it seems pretty broadThis seems to work across a lot of google products (gmail, drive, chome etc) so it scoops up a ton.More here:<a href="https:&#x2F;&#x2F;security.googleblog.com&#x2F;2020&#x2F;05&#x2F;enhanced-safe-browsing-protection-now.html" rel="nofollow">https:&#x2F;&#x2F;security.googleblog.com&#x2F;2020&#x2F;05&#x2F;enhanced-safe-browsi...</a>Not sure if this is related to safe browsing. We also can turn on more scanning and other features of all email users.The key though, if you allow users to PUT files onto your S3 (even private &#x2F; signed in) then google may scan them. That means if your user uploads a suspicious file to a trouble ticket system, if there IS a virus in there and google sees it, wham. Obviously most folks will segregate those uploads off into their own s3 bucket by user&#x2F;account to avoid contamination, but you really have to be careful not to hose viruses AT ALL on your key domains.

Pardon my ignorance as I have few years of web dev experience. What exactly does it mean to store data on a domain? Does he mean serve data via a domain URL? And if so, how does Google have discovery of that data?

I imagine your service still won&#x27;t have a great time when Google blacklists companyusercontent.comA proper mitigation would be to serve user data from one domain per user, no?

Of particular note:&quot;Don&#x27;t host any customer generated data in your main domains. A lot of the cases of blacklisting that I found while researching this issue were caused by SaaS customers unknowingly uploading malicious files onto servers. Those files are harmless to the systems themselves, but their very existence can cause the whole domain to be blacklisted. Anything that your users upload onto your apps should be hosted outside your main domains. For example: use companyusercontent.com to store files uploaded by customers.&quot;

Author here. The impacted domain was a Cloudfront CDN subdomain with random characters in it, not company.com (thankfully!). I doubt anyone signs up for Search Console on that type of domain that they don&#x27;t even really own.

This is sad. When you open a business in the real world, sure you have to tell the authorities about it (because it&#x27;s the law!).
When you open a digital business, you have to tell Google (via Google Search Console) about it... But Google is not the law, not even an authority; it just happens that Google owns google.com and Chrome and that makes Google the de facto Godfather of the internet: if you don&#x27;t comply, your business is practically dead.
Again, sad.

&gt; Proactively claim ownership of all your production domains in Google Search Console.That&#x27;s one of the first things you should do, when registering a domain and setting up a website. It takes about 2 minutes. So I wonder a bit why a business of this size would learn doing this through such a crisis.

You upload action is hosted on a different domain from the domain that serves the content.

Avoids the issue until your ugcweb.com is blacklisted and users who uploaded clean ugc are blocked from the portal.

For example, if someone manages to upload HTML and trick your system into serving it with a content type that browsers will interpret as HTML, then they can modify or exfiltrate your user&#x27;s cookies. This could allow impersonation attacks, XSS, etc.(Disclosure: I work for Google, speaking only for myself)

You don&#x27;t necessarily need to authenticate users on that domain with a cookie. An HMAC token would be ideal, because you don&#x27;t have to maintain state.Don&#x27;t hardcore the content domain. In case the content domain gets flagged, it should be easy to change to a new domain.The assets themselves (such as images, scripts, etc) can have any browser cache expiration time. HTML documents cache duration will matter, and once that has elapsed, browsers should start to use the new content domain.

How do you do this in practice though? Let&#x27;s say my marketing site is at turtlepics.com and then the pics, captions, feeds, etc are served off of turtlepicscontent.com.So I can serve my app off of turtlepics.com, that&#x27;s fine. But it can&#x27;t load any content directly. I&#x27;d have to have a separate &lt;script src=&quot;<a href="https:&#x2F;&#x2F;turtlepicscontent.com&#x2F;feeds&#x2F;erik" rel="nofollow">https:&#x2F;&#x2F;turtlepicscontent.com&#x2F;feeds&#x2F;erik</a>&quot;&gt; or whatever that loads a user&#x27;s feed. But that needs to be authenticated too, so I have to then authenticate the user on that domain (<a href="https:&#x2F;&#x2F;turtlepicscontent.com&#x2F;feeds&#x2F;erik?onetimekey=a9e79c5829" rel="nofollow">https:&#x2F;&#x2F;turtlepicscontent.com&#x2F;feeds&#x2F;erik?onetimekey=a9e79c58...</a>) as well, at which point the credentials are present in the unsafe domain&#x27;s cookies as well, and the jig is up.Or do you continually generate fresh one time keys in the safe app, so that you don&#x27;t need cookies on the content domain?Even then, someone can still bring down the entire turtlepicscontent.com domain with malicious content. Which... well, at least your marketing site and your login still works. But the site is still fully down at that point. I guess that&#x27;s better than nothing, but still pretty annoying.Or is the idea just to wall off uploads specifically, but continue serving text off the main domain, presuming you&#x27;re sanitizing text correctly?I guess you could have some fallback to a safe-ish domain with an older read-only backup of the content database? Still not ideal. I guess sharding your users onto multiple domains based on account age might help a bit too.

“Don&#x27;t host any customer generated data in your main domains. ”This is extremely important for multiple reasons. One reason is the blacklisting as mentioned in the article, the other reason is security: browser typically implement security policies around domains as well, such as cookie scoping and whatnot. Putting all user generated content under a completely separate domain avoids a whole category of potential issues.

This is an area where regulatory action should be taken against Google. Google needs to implement a process with manual review in a reasonable timeframe, or they should be broken up for having monopolistic power over which sites are on the internet.

Author here - I haven&#x27;t signed up for Medium&#x27;s &quot;pay the author&quot; thing, which I think should make my content free to read and paywall free, is that not the case for you?

posted on medium which decided to paywall after years of being publicly available.

If the business wants to argue that, they can sue Google for defamation&#x2F;libel.

Can Google be held legally accountable for this behavior? Seems like they are hurting businesses by spreading false information. With their market power there need to be some incentive for them to react quicker and with human oversight.

Chrome automatically reports URLs and some page content to Google if &quot;Help improve security on the web for everyone&quot; is enabled. This is not enabled by default, even if &#x27;help make Chrome better&#x27; is checked before install.<a href="https:&#x2F;&#x2F;i.judge.sh&#x2F;discrete&#x2F;Rumble&#x2F;WindowsSandboxClient_w4Ta4Dz4kv.png" rel="nofollow">https:&#x2F;&#x2F;i.judge.sh&#x2F;discrete&#x2F;Rumble&#x2F;WindowsSandboxClient_w4Ta...</a>

There is the expected privacy-surrendering API in which you send all your URLs to Google, and a more defensible one in which you download some sort of database to then query locally:
<a href="https:&#x2F;&#x2F;developers.google.com&#x2F;safe-browsing&#x2F;v4" rel="nofollow">https:&#x2F;&#x2F;developers.google.com&#x2F;safe-browsing&#x2F;v4</a>

I don&#x27;t know what the implementation actually looks like in chrome, but it could work on a blacklist that&#x27;s stored locally and updated on a regular basis.

No, it does local checks first, then only checks the full URL if there&#x27;s a high probability of a match: <a href="https:&#x2F;&#x2F;www.chromium.org&#x2F;developers&#x2F;design-documents&#x2F;safebrowsing" rel="nofollow">https:&#x2F;&#x2F;www.chromium.org&#x2F;developers&#x2F;design-documents&#x2F;safebro...</a>

why would it?chrome can just load $black_list from time to time and just perform local check

Doesn&#x27;t Safe Browsing require every URL you visit to be sent to G$$gle first? I know Chrome users &quot;have nothing to hide&quot;, but this looks like complete surrender.

This happens when the ticket for braking anti-monopoly laws is magnitudes cheaper than the profit you rake in breaking it.

one of my apps my company makes is a chat app, when someone clicks a link in chat, we bounce them to a URL redirect page (&quot;Warning, you&#x27;re leaving $app, don&#x27;t enter your account password&#x2F;information phishing warning&quot; type page) with a button &quot;Continue to $url&quot; - We also have a domain blocklist to block known phishing sites for our app. Because of this, Google blocked our entire domain due to malicious urls (the &quot;This link was blocked&quot; page) It took us weeks to get it unblocked. Just an utter pain in the butt. We&#x27;re an established business, but having our entire website blocked by Chrome for weeks nearly killed the entire app.

Yep this happened to me too and I came to exactly the same conclusions.We have a list of completely separate “API domains” that our scripts talk to and which also host the cloudfront CDN.We also cohort our customers by Sift score and keep trusted enterprise customers away from endpoints given to new signups. This way if someone new does something sketchy to get you flagged it won’t affect your core paying customers.

From the Geocities archive? Yeah actually, send me an email let&#x27;s talk about it.

Hi Kyle,I still have the reocities.com domain, would you like to have it? If so I&#x27;ll be happy to donate it free of charge.

Of course they care. They&#x27;ve taken over everything they&#x27;ve been able to take over and they&#x27;re still going strong. This is not by mistake. This is why Google needs to be broken up.

Sad nerd seeks third to join 24&#x2F;7 D&#x2F;s relationship with my internet daddy(just lightening the mood a bit, but it&#x27;s a true story. I wasn&#x27;t asking for google support)

&gt; If things ever got extremely horrible, I used to have a friend that worked at google but she no longer works there. The other person I knew that works at google stopped responding to my tinder messages, so I&#x27;m pretty much doomed the next time they do something ultra crazy and I need emergency support.Doing good for the sake of the web, even while dating, that&#x27;s some next level dedication. :)

Thanks!Yeah I don&#x27;t think Safe Browsing shouldn&#x27;t exist, but it definitely needs some improvements and feedback that&#x27;s appropriate for how incredibly powerful&#x2F;dangerous it is.

Just want to add that neocities is a cultural treasure and I appreciate the work you put into it! I&#x27;m sad to hear that Google &quot;Safe&quot; Browsing once again rears it&#x27;s ugly head blocking legitimate websites, yet I still see scams and phishing show up on ad sponsored links for Google search results.I could foresee in the future all of us having to pay the toll so our hosted websites are considered &quot;safe&quot; too...

&gt; How does this stop bad actors from exploiting bugs in e.g. V8 with malicious JavaScript?You&#x27;re correct: it doesn&#x27;t. Blocking executable files aren&#x27;t enough. Javascript files, zips containing executables, malicious Word files...all of these are vectors.

&gt; because we block uploads of executable files, it is _literally impossible for users to host malware on our servers_How does this stop bad actors from exploiting bugs in e.g. V8 with malicious JavaScript?

I&#x27;m sure he could get a lawyer better than Google&#x27;s.

I honestly wonder if you could take them to small claims court...

I mean we could certainly use the money obviously, but it&#x27;s not really my goal to sue Google (I probably can&#x27;t afford it anyways). I just want them to improve. I see them as a partner and only ask that they see us as the same. They certainly have the resources for it.

If Google is falsely claiming your malicious and its harming your business it seems like a pretty clear case of slander&#x2F;tortuous interference.

&gt; The other person I knew that works at google stopped responding to my tinder messages.This has to be the best anecdote for Google&#x27;s broken tech support that I&#x27;ve ever heard. :)

Since you are putting different users on different subdomains, have you considered asking to have neocities.org added to the public suffix list? See my response to the person who runs freemyip.com and has the same problem: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25804371" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25804371</a>

I run <a href="https:&#x2F;&#x2F;neocities.org" rel="nofollow">https:&#x2F;&#x2F;neocities.org</a>, and safe browsing has been my nightmare overlord for a long time.No way to manage reports via an API, no way to contact support. I haven&#x27;t even been able to find a suggestions box, even that would be an upgrade here. Digging to find &quot;the wizard&quot; gets you into some official google &quot;community support&quot; forum where you learn the forum is actually run by a non-employee lawful neutral that was brainwashed somehow into doing free work for one of the wealthiest companies in the world. A lot of the reports are false and I have no idea how they are added (this would be an excellent way to attack a web site btw).Google will sometimes randomly decide that every link to our over 350,000 neocities sites is &quot;malicious&quot; and tell every gmail user in a pop-up that it is dangerous to go to a neocities site. Users are partitioned to a subdomain but occasionally google will put the warning on the entire domain. It&#x27;s not clear if it&#x27;s even the same thing as safe browsing or something completely different, and this one doesn&#x27;t have a &quot;console&quot; at all so I have no idea how to even begin to deal with it. When users complain, I tell them I can&#x27;t do anything and to &quot;contact google&quot;, which I&#x27;m sure just leads them to the same community support volunteer.We actively run anti spam and phishing mechanisms, have a cleaner track record on this than google themselves with their (pretty neglected) site hosting, and because we block uploads of executable files, it is literally impossible for users to host malware on our servers. It is also impossible to POST form data on our servers because it&#x27;s just static html.None of that matters. Occasionally we also just get randomly, completely soft-blacklisted by safe browsing for no reason (they call this a &quot;manual action&quot;, there&#x27;s never any useful information provided, I have no idea what they imply and I live in fear of them).If things ever got extremely horrible, I used to have a friend that worked at google but she no longer works there (I hated using her for this). The other person I knew that works at google stopped responding to my tinder messages, so I&#x27;m pretty much doomed the next time they do something ultra crazy and I need emergency support.It&#x27;s extremely frustrating and I&#x27;m hoping for the day when something gets better here, or they at least provide some way to actually communicate with them on improving things. In the meanwhile, if anyone happens upon the wizard at a ski resort or something, please have them contact me, I have a lot of improvement ideas.edit: Just to add here from a conversation I had a year ago (<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21907911" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21907911</a>), Google still hasn&#x27;t figured out that the web is their content providers and they need to support them, and treating their producers with contempt and neglect is a glorious example of how shortsighted the entire company is right now about their long term strategy (how many ads will you sell when the web is a mobile Facebook app?). They should as soon as possible, as a bare minimum, start providing representatives and support for the content providers that make people actually use the web and help them to be successful, similar to how Twitch has a partnership program.

Could this be the basis for a class action lawsuit?

Not really, we own the entire Cloudfront subdomain, and Google is wise enough to not ban cloudfront.net entirely (now that would be an interesting day on the internet!).Having a CNAME in front wouldn&#x27;t have made any difference.

isn&#x27;t the problem here keeping the cloudfront hostname, vs. setting up a CNAME from your own domain to point at the distribution?

&quot;...And that&#x27;s reason number 3955430, ladies and gentlemen, why monopolies are bad and MUST be dismantled.&quot;

Wow. I wonder how lng it will be before the Big Tech oligarchy will start blocking websites for “misinformation”.Insane world we’re heading towards.

Just sue them for damages. It&#x27;s libel.

We spend a nice buck on Google Ads but the impact of getting your SLA-sensitive SaaS app blocked from the Internet is not compatible with reaching out to &quot;someone who might know someone&quot; at a 100K employee company.

Well, as long as you are spending 6 or 7 figures a year on advertising with Google, you&#x27;ll have a account rep at Google that you can always reach out to. Your ad spending level works as Google&#x27;s filter for which websites on the internet that they actually give any care about not killing.

Google Safe Browsing can kill a startup