Top
Best
New

Posted by ssiddharth 9 hours ago

Never buy a .online domain(www.0xsid.com)
630 points | 387 comments
NikolaNovak 8 hours ago|
Oh man. The infinite loops of impossible verification by large companies that should know better are massive pain peeve of mine.

This goes right to the top for me, along the ubiquitous "please verify your account" emails with NO OPTION to click "that's NOT me, somebody misused my email". Either people who do this for a living have no clue how to do their job, or, depressingly more likely, their goals are just completely misaligned to mine as a consumer and it's all about "removing friction" (for them).

duxup 4 hours ago||
Oh man we had a person leave unexpectedly who controls our Apple organization for our dev accounts. I'm several months into me making requests, getting responses at least a week later for each email where the responder ... didn't really read my message. Then they ask for documents ... but they forgot to send me the secure link ... another week+ for them to do what they said they were going to do. Now one of my documents didn't include a sentence they needed ...

One of the requests was for a business card ... I haven't had a business card made with my name on it in 20 years.

The amazing thing is that I bet scammers working this system can get through this faster than I can.

At this point they should just give me control because no way would some scammer fail this much at this ungodly process.

praestigiare 18 minutes ago||
Scammers can definitely get through it faster than you can. Whenever you attempt to address abuse in a system by increasing the complexity of that system, you implicitly bias it towards those with the time and inclination to study it, which always includes those with intent to abuse it, and generally does not include your users.
MereInterest 4 hours ago|||
> Oh man. The infinite loops of impossible verification by large companies that should know better are massive pain peeve of mine.

I got hit by this from google.

1. Gmail added requirement for 2FA on my primary email address. Since I had no phone number on file, it instead used my recovery email address. Thankfully, I still had the password for my recovery email address, and could continue to (2).

2. Gmail added requirement for 2FA on my recovery email address. Since I had no phone number on file, it instead used by recovery's recovery email address. Thankfully, I still had the password for my recovery's recovery email address, and could continue to (3).

3. SBC Communications no longer exists, as it merged with AT&T in 2005. Email addresses at `sbcglobal.net` were maintained up until around 2021-ish, when they started purging any mailboxes that had been idle for more than 12 months.

Fundamentally, this was google's fault for misusing a recovery email for 2FA. Unfortunately, the only way to fix it would be to contact AT&T, asking them to pretty please update the email settings for somebody who hadn't been a paying customer for two decades.

fencepost 34 minutes ago|||
Google made it very clear years ago that they shouldn't be trusted with anything irreplaceable/that would cause major problems if you lost access.

Once it became clear that they'd shifted from "crappy customer service" to (IMNSHO) "we fetishize the complete absence of customer service" it became dangerous to depend on them. Really, what's the worst that could happen? Maybe someone spams emojis in live chat on a game livestream at the request of the streamer on a personal account, it gets banned for abuse, Google recognizes that it's linked to other services and locks down everything? But that's so unrealistic I'm sure it could never happen.

It's not like they also have the ability to identify links between multiple accounts accessed by the same person and have automated processes that might stomp the associated accounts as well. Why, that would probably require something like allowing poorly-understood automated agents to take actions on their own!

deepsun 3 hours ago|||
> Fundamentally, this was google's fault

Or yours, for not caring about 2FA. It's been a common practice for many years, and strongly recommended by most identity services, as well as OWASP and NIST recommendations.

What would you do in Google's place?

wl 3 hours ago|||
I have the same issue. At the time I created the account that I'm locked out of, Google said nothing about these "recovery" email addresses as 2FA. Years passed without any notice that maybe they were going to lock me out of an account I have the password for. No notice that I had better have access to that "recovery" email address that I hadn't bothered to keep up to date because I never thought I'd need to "recover" the account from Google. (In my case, it's an old .edu email address that I was promised "for life".)

If Google wanted to lock me out of my account for my own good until I enabled 2FA, fine. But as GP stated, they abused the recovery email addresses to force 2FA on people and ended up locking some people out of their accounts.

Telaneo 3 hours ago||||
Not add 2fa automatically, but instead prompt with options to add it.

This probably doesn't comply with the relevant recommendations, but cutting a user of from their email is worse in my opinion.

deepsun 1 hour ago||
I'm sure Google prompted author for years begging to turn the 2FA on, as well as warning that they will enforce it on day X. Author ignored them all.
mulmen 6 minutes ago|||
[delayed]
Telaneo 1 hour ago|||
That doesn't make forcing it any less wrong.
saidnooneever 2 hours ago||||
nonsense. any feature should have acceptable failure modes. blaming the customer for a fault they have no control over is not acceptable. many people know nothing about 2FA. it is not their responsibility. 2FA is a symptom of shitty designed systems which are inherently insecure and companies who dont give a shit about that and let their customers shoulder the burden by shoving complexity down their throats.

if you make an app it is not your customers responsibility to secure it with additional actions from their side..if it is, you need to make it mandatory and guide them step by step.

you cant after a while enable some toggle.and tell people to fuck off and its the fault of their ignorance to not know some technical details.

most consumers of these services dont know shit about IT and they should not be burdened with it..any product that demands it is either only meant for tech savy people or more likely lazily and badly engineered by money hungry people who see opportunity to make more money in user's issues.

deepsun 1 hour ago||
> many people know nothing about 2FA

That's why Google sent them multiple emails explaining what it is and recommending to turn it on. What else could Google do?

YeahThisIsMe 1 hour ago||
Not just turn it on without their approval.
mindslight 3 hours ago|||
Not force nonconsensual authentication methods onto users.

Google is one of the rare places I actually see positive value to 2FA. Compare with say banks, where it being demanded actually decreases my security. But regardless, it should not be forced.

deepsun 1 hour ago|||
As for the banks I doubt it decreases security. Even SMS 2FA actually reduces fraud by 90%+ percent.

Yes, some banks implement it silly, like SVB requiring biometric login in order to scan one-time QR 2FA code from their app (biometric login is less secure), but you don't have to use the QR code, can use regular 2FA without biometrics.

But even then having 2FA is 42 times better than not having it.

deepsun 1 hour ago|||
But then millions of users would stay unprotected from password sealing (see https://haveibeenpwned.com/).

They certainly did a proper thing forcing people to use 2FA AFTER multiple emails over the years recommending to turn it on, and warning that they will enforce it, which they did.

rationalist 8 hours ago|||
Someone constantly adds my Gmail address as their Gmail account's backup address.

I constantly remove it whenever Gmail sends me the notification.

I can't help but think there is some method for the other person to steal my Gmail account if I never remove my email as their backup.

ChrisMarshallNY 1 hour ago|||
I have an "OG" mac.com account (got it about five minutes after Steve announced it). My wife actually has her first name.

We both get hit with "OG Hell," where people are constantly entering our emails. I think most time, it is accidental (maybe they meant "XXX1234", and forgot the number).

What makes it worse, is that Apple aliases mac.com, icloud.com, and me.com together, and there's no way to turn off one of the aliases.

mac.com is really in retirement. No one sets up new ones, but the miscreants typo icloud.com, which gets routed to me.

I have a rule, where I shitcan every mail to icloud.com, but I wish I could simply turn off the forwarder.

Romario77 7 hours ago||||
I logged in several times to other people's accounts and reset their passwords. But it's too tiring, people keep adding my email.

I hope it's because I have small simple email and not because they want to steal it.

delecti 7 hours ago|||
Have you tried sending them emails asking/telling them to stop?
kstrauser 7 hours ago|||
I’m a different person, but this happens to me, too. I have the kstrauser@yahoo.com email address because I signed up for it like 25 years ago. I log in every 6 months to see what the few other kstrausers in the world have signed me up for.

Not jsmith, but kstrauser. Not Gmail, but Yahoo. And I still get banking docs, and HOA meeting minutes, and birthday party invitations, and Facebook logins, and other bizarre random stuff.

I have so many questions. I’ve typoed my address before and had to correct it. That’s understandable. But to wholly invent one and say, yep, that looks good even though I’ve never used it before, I’m sure it’ll be fine! I just don’t get it.

josephg 1 hour ago|||
Yeah I have josephg@gmail. The amount of spam that account gets is wild - about 50-100 emails hit the inbox per day. I got soft-locked out of google docs a few months ago because my google account's 25gb quota was exhausted.

Some of the emails are really unfortunate stuff. "Your account was added as a backup address." - Then inevitably, a few weeks later, dozens of password reset emails. Sorry bud. I've received pay stubs. Orders and invoices. I get phone bills every month for someone in India. Its chaos.

Early on I'd sometimes reply to these random emails telling people they've got the wrong address. The most astonishing reply I ever got was from HSBC bank telling me I needed to come into the branch to change my email address. Over the course of a week, I explained about 3 times that that was impossible. That I live in Australia. That I'm not their customer, and its not my account. Eventually they told me they were disabling online banking on my account. Now I've given up replying at all.

Send emails into that pit of PII misery if you want. I don't read them.

Izkata 5 hours ago|||
I had one that person seemed to think their @twitter name was the same thing as my gmail address. Haven't seen it in a while, maybe they figured it out after I told their kid's teacher they had the wrong person...
lawrencejgd 5 hours ago||||
>You write an email that says "Hey, can you please stop using my email address?"

>You send it to johnsmith@gmail.com

>You receive a new message, it says "Hey, can you please stop using my email address?"

>You're johnsmith@gmail.com, you only know that's the address that's being used

PD: I know that if he resets the password he can get the other address, but this scenario was funny in my head.

Mordisquitos 6 hours ago||||
That may be what they're hoping for, using a similar modus operandi as those WhatsApp/IM messages from strangers who text you with things in the vein of ‘Hey, it was great meeting you at the conference’ or ‘Did Martha like your flowers?’ etc.

They may well be looking for targets.

tracker1 4 hours ago|||
There are times where you just can't... someone uses my email address in person at tractor supply co. and I'm getting a ton of marketing email I can't usnsub to.

I've had this happen several times... There's a lawyer I used for a dispute a few years ago, and they now have another "First Last" name that matches mine, and he keeps emailing me... my reply, "Wrong Michael, again..."

It's kind of annoying all around... I need to get off my butt and get a few things shifted, then just start relying on my own MTA again, instead of forwarding *@mydomain to my gmail to. I'll still wildcard the domain, but to a single mailbox on my own mta.

I'm not sure how bad the spam might get though... I've had a test account on my mta for a couple years and it hasn't really recived any... my wildcard accounts either... I use the wildcard so I can do things like walmart@mydomain, to see if/where an email address is sold/leaked from regarding spam.

rationalist 3 hours ago||
Contact the Bar Association for that lawyer's state. He will definitely stop making that mistake then.
nativeit 7 hours ago|||
You’re confessing to several actual felonies here, may want to change strategies.
NikolaNovak 3 hours ago|||
Right. Techies are always quick to suggest I do something naughty or funny with this "great power" I've unwittingly gained, but in reality it's just a liability. If I ignore it and they do something nasty and implicate me, it's a pain. If I touch it with a 10 ft pole, now I'm even more actively involved.

Just include "not me!" In the verification email, dam it

kstrauser 7 hours ago||||
“…and so I made him the owner of my account, and he used that to remove himself from it!”

“We’ll be right over.”

thatguy0900 4 hours ago||
You forgot the part where he reset their email he didn't own and change their passwords so they couldn't get back into it
kstrauser 4 hours ago||
I think you’re misreading this. OP has an email account. Someone else signed up for some website that doesn’t verify that you own the address before allowing you to log in and use the service. If the site did verify it, the user wouldn’t have been able to log in because OP would have been getting the verification emails, and not the user.

Later, after OP told the user and they failed to change their address, OP logged into the site and changed their password, putting an end to the spam they were receiving from the user’s actions.

I don’t have an ethical qualm with this. He didn’t want to sign up for the service. Someone else signed his email address up for it. Legally, I can’t imagine that being prosecutable.

NikolaNovak 3 hours ago||
One thing I've found, occasionally the hard way, is that helpful bystanders are always offering advice based on "ethical", "intuitive", "logical" and "common sense", usually without any aspect of "legal".

I got divorced a decade ago, and every well-wishing person in my life was strongly urging me to do things which were shockingly counter-productive / dangerous / wrong, based on their confident understanding (assumption, really) of the law which was completely and dangerously inaccurate.

Hacker News audience is global. People start accounts for various purposes. Yet people still freely share the notion that logging in to some unknown website run by an unknown company from a hard to spell country and then touching things is universally safe.

I miss the old "IANAL" tag which at least provided basic warning and self-awareness :-).

kstrauser 2 hours ago|||
While true, I think that's implicit in all online conversations. I'm certain my thinking is 100% wrong in some jurisdictions elsewhere. Anything I say is wrong somewhere.

"It's OK: you can curse on the Internet." "Not when you're typing from Iran!" "Well, OK, if you're in Iran, don't take this American's advice for dealing with a government."

Part of our obligation as a reader is to consider what others are saying in the context of our own circumstances and experiences before trying to apply it. If you don't, and things end badly, that's on you.

But I stand on my words: I think it's ethically OK. You may not. That's alright. We're not required to have the same ethics or morals. And I don't think that's prosecutable. That's my opinion, based on my circumstances, not a statement of fact that applies in all jurisdictions around the world.

Above all else, I got tired of giving disclaimers about every single thing I say lest someone jump in with a "gotcha! scenario" I hadn't considered because it's not relevant to the context of the discussion.

altairprime 3 hours ago|||
IANYL, though! Offering legal advice with the disclaimer “I am not a lawyer” could be prosecuted as practicing law if a reasonably party could still infer a potential lawyer-client relationship from your message and/or intent. Instead, “I am not your lawyer” explicitly denies the lawyer-client relationship, which closes the door on both being accused of practicing law illegally and on being found as party to a lawyer-client relationship whether or not you have the appropriate certifications.
technothrasher 1 hour ago||
> closes the door on [...] being accused of practicing law illegally

Does it? So I can say, "I'm not your lawyer, but I'm happy to go ahead and give you specific legal advice on your case." and I can't be accused of illegally practicing law? I was under the impression that this could still get you into hot water. But not being your lawyer, due to the fact that I am not a lawyer at all, I don't know if it is true or not.

kstrauser 1 hour ago||
IANAL, so take this with a grain of salt, but:

As with all things, who are you going to get in trouble with? And what's so magical about legal practice as opposed to, say, giving shitty medical advice or telling someone how to build porch? Asking genuinely. No one falls all over themselves to say "I am not a doctor, but...", even though their next words could kill someone. The implication is that they don't have formal training but they saw something on Facebook that you should try. What happens next is on you, not on them.

tracker1 4 hours ago||||
You give someone ownership of something and they used that ownership...
krickelkrackel 4 hours ago||
It's like leaving your bike in the street, with no lock. Still theft, but you'd be up for a part of the responsibility.
tracker1 4 hours ago|||
No, it's like giving someone a set of keys to your car, and they take it for a drive.
kstrauser 3 hours ago||
I think it’s more like you registered the car in their name. Now they’re allowed to use it, and also responsible for the thing which they didn’t want.

Consider that the “imposter” starts uploading child porn or something, and it’s on an account registered to your address. I think it’s perfectly A-OK to tell the service that it’s not me using the thing and I want them to close the account someone created in my name.

c22 4 hours ago|||
It's more like leaving your bike in someone else's garage.
ntoskrnl_exe 5 hours ago||||
I'm curious if this would really be considered unlawful access, since only pure idiocy and no hacking/scamming/etc were involved.
volkercraig 5 hours ago||
It would be in Canada, but our "misuse of computer" charge is overly broad and never been well tested.
charlieyu1 4 hours ago||
On the other hand, in Hong Kong it would be straight to jail. Someone was sent a link by the airlines, he changed a couple of characters and it ended up showing another person’s data. The guy voluntarily reported the vulnerability and all he got was a criminal charge and found guilty
jama211 4 hours ago||||
No harm done no one is gonna prosecute this
cft 4 hours ago|||
In what jurisdiction? He's in Russia
tecleandor 4 hours ago||||
My Gmail account is a funny word in Spanish that I got when there was still plenty of names available.

I get TONS of emails of people trying to join services that use my address as a "fake email".

pocksuppet 35 minutes ago||||
You could try stealing theirs. Surely, one of the forgot-password flows must use the recovery email.
parable 2 hours ago||||
This happens to me several times a month. I'm more concerned about account termination, in that if their Gmail account is terminated for some reason, mine would be as well due to it being the backup email address.
-Fu 3 hours ago|||
[dead]
jacekm 2 hours ago|||
A couple of years ago someone associated my email with their bank account in Santander UK. I tried to get in touch with Santander but turned out that the only way to do so is to either make an international call (I don't live in UK) or send them a paper letter. I gave up and just routed these emails to separate folder.
subscribed 2 hours ago||
I meticulously report every single of emails like this as spam. Every single one. If it _could_ be read as a phishing attempt, I report them as phishing.

Etc.

oooyay 38 minutes ago|||
It's entirely on us as citizens to leaving them as pet peeves instead of crafting them into strategic law that makes them not only illegal but shunned. A little bit of structure goes a long way here.
Arrowmaster 3 hours ago|||
I'm currently in the endless email loop because someone named Raymond used one of my Gmail names to register with State Farm. One of their agents even emails me directly when he gets really behind on his payments but won't do anything when I tell them it's the wrong email.

In the past when this happens I usually reset the password and change the email to some anon throwaway but I can't do that without Raymonds DOB (don't quote me on that, been a while since I tried).

integralid 8 hours ago|||
No need to look for malicious intentions, this is just a feature that costs money so it's very low (or zero) priority for profit driven organisations.

I wonder if finding people responsible and spamming then with their own service emails would make the team care enough to fix this. But of course that's mostly dubious, probably illegal, and shouldn't be a responsibility of some vigilante hacker

justinclift 8 hours ago|||
> No need to look for malicious intentions, this is just a feature that costs money so it's very low (or zero) priority for profit driven organisations.

Malicious in-attention then, by the profit driven org? :)

b112 8 hours ago||||
If bartenders are legally (including criminally!) liable in some jurisdictions for their customers, then certainly a chain of legal liability can exist in other industries.
CydeWeys 4 hours ago|||
What are you envisioning exactly?
b112 4 hours ago||
Am I supposed to envision something?

When pointing out that legal parallels exist, to enact a solution, must I envision that solution?

Pxtl 5 hours ago|||
Yes but bartenders overserving is a crime done by a working-class person and not a wealthy business.
wat10000 8 hours ago||||
What is the word for harming other people in order to make more money for yourself, if not "malicious"?
loloquwowndueo 8 hours ago|||
With AI these days it’d cost almost zero money. /s
duped 5 hours ago|||
A chronic problem is the idea that if something can't be automated with a human in the loop then it simply can't be done at scale. Technologists will do anything except employ humans to solve social problems.
jagged-chisel 4 hours ago||
s/technologists/venture capitalists/
plagiarist 7 hours ago|||
I prefer "please verify your account" to "thanks for joining" by a lot. The former presumably does not verify when I ignore it. The latter should be illegal but somehow isn't.

I do wish there was a requirement for some sort of "no" button that would stop sending sign up requests entirely.

Aachen 6 hours ago|||
Any idea what the incentive is for them to put in an email address they can't access?

I run a few websites that accept an email address (all noncommercial, I have no interest in spamming anyone). One of them is the "contact me" feature on my personal website. To prevent spam, I had people just put in their email address and it'll automatically email them my email address. This works perfectly to this day, haven't got a single spam email on any of the addresses I've handed out, but the ratio of emails sent out to received is probably 50 to 1. Why would anyone put an email address in there if not to contact me? I've been wondering if it's used by mail bombing services, idk if that's a thing but I know of the concept of annoying someone by signing them up for a hundred newsletters. My site doesn't send recurring emails, though, and it doesn't allow putting more than two email addresses per month in, per /24 IPv4 block (and even more strict on v6). It's useless for mail bombing services but the (presumed) bots keep submitting a steady rate of maybe 2 new email addresses per day, each time from a new ISP in a random country. No email addresses is ever submitted twice. No rhyme or reason to it. If anyone can make sense of this, that might help me in stopping the abuse

prmoustache 4 hours ago|||
> The former presumably does not verify when I ignore it.

That doesn't prevent a huge majority of them from sending you notification emails all the time even if you never verify.

Pxtl 5 hours ago|||
Ah the old "reverse identity theft".

Relevant xkcd:

https://xkcd.com/1279/

Yeah, I get the same regularly.

thesuitonym 3 hours ago||
Smartly, I got firstnamemiddleinitiallastname@gmail.com. I never get anybody else' details.

On the other hand... Occasionally someone gets my info because some careless person entered my email address into their system incorrectly. You'd think this problem would be solved by moving to a custom domain, but I still once in a while find someone completely ignore what I put into the form and sign me up as firstnamelastname@gmail.com.

AtreidesTyrant 4 hours ago|||
happens with apple products all the time
cucumber3732842 7 hours ago|||
The point of the system is what it does.

They can't just say "we don't want to deal with small timers who will not pay us big bucks doing nonstandard things" without pushback but they can write the policy so that a huge fraction of those use cases fall into some crack that can only be got out of by incurring the kind of expense that's a non-starter for those users. Your municipal code is rife with examples of this.

db48x 2 hours ago||
This is a catchy aphorism, but not really true. Things can be badly implemented so that they fail to achieve their purpose.
squeefers 6 hours ago||
> Either people who do this for a living have no clue how to do their job,

how naive. most of the world work to survive, not because its their dream vocation. they probably dont care as much as you do

iamnothere 8 hours ago||
The registrar relying on Google Safe Browsing as a “trigger” for suspension is the most horrifying thing I’ve seen in a while. This basically makes the entire TLD unviable for serious use.
TLDRisk 30 seconds ago||
It's the registry, not the registrar. I made a website that tries to help explain some of the lesser known nuances and risks relating to domains. The section about domain reclassification is based on first hand experience and is especially interesting IMO:

https://tldrisk.com/beyond-basics/reclassification/

> This basically makes the entire TLD unviable for serious use.

It doesn't just make the TLD in question unusable. I think it makes most of the new gTLDs unusable. Registries can enact policies and systems like this, regardless of the detriment to registrants, due to a lack of oversight and registrant consideration by ICANN. That creates uncertainty and makes it pragmatic for registrants to simply choose the gTLDs with lots of history and precedence; .com, .org, etc..

The only two TLDs I'd personally rely on are .com (gTLD) and .ca (ccTLD).

mzajc 6 hours ago|||
.online is one of the many TLDs that charge a dollar for registration but bump the price to $30-$35 for renewal. So far, this seems like a good signal to tell apart serious TLDs and ones just preying on customers who sort by cheapest (or capitalizing on one-off phishing domains).
volkercraig 4 hours ago||
I had a .fun domain that I was using to host a small project and they pulled that on me, I just let it expire and killed the project.
RHSeeger 8 hours ago|||
The followup from that would appear to be don't use any domain that Radix controls.
fc417fc802 2 hours ago|||
More generally, I think it's advisable to prefer the ccTLDs of places that are politically stable. And (IMO) to view com/net/org as defacto US ccTLDs (technically they aren't but for all practical purposes they might as well be).
holysoles 7 hours ago|||
Yeah this doesnt seem like a unique or new issue:

https://news.ycombinator.com/item?id=40195410

mcoliver 6 hours ago|||
This is the real story. This is 100% a problem with Radix. Safe browsing targets the website not the domain. No reason a registrar should be suspending an entire account over something a company reports. Black-holing the A and CNAMEs on a subdomain? Maybe..... But even then I don't think it's the registrars place to do that. Freezing the entire account? Absolutely not.
NewJazz 5 hours ago||
Blackholing the a and cnames would prevent getting off the safe browsing list, as mentioned in the blog post.
WmWsjA6B29B4nfk 8 hours ago|||
Who said serious use is their business model though.
NewJazz 5 hours ago||
Registry, not registrar
iamnothere 4 hours ago||
Thanks, yes, even worse! The registry should act on only legal orders IMHO.
merek 8 hours ago||
The TLD owner in this case was Radix, which also owns

.store .online .tech .site .fun .pw .host .press .space .uno .website

https://radix.website/

g947o 8 hours ago||
They seem to be almost always associated with scam sites.

So, might as well to block entire TLDs and never buy a domain under those TLDs

jeroenhd 7 hours ago|||
These alternative domains are quite popular with the fediverse and other hobbyist-run groups. Affordable domains with somewhat recognisable names still available.

Scam websites will use any TLD in my experience. Based on the ones that made it to my Google search results, .it and .info are the TLDs I should be blocking. When I search for "free roblox cash", most websites are .com. "Free robux" also brings forth a few .ca websites. "Free steam gift card" leads to .org and .com.

prmoustache 4 hours ago|||
> Affordable domains with somewhat recognisable names still available.

Aren't they only affordable for the first year though?

erinnh 4 hours ago||
I don’t know about most of them, but I’ve used .pw for many years for most of my domains as pw is really cheap even on renewal.
kstrauser 7 hours ago|||
My all time favorite Fediverse domain is jorts.horse. That’s the most delightfully random thing.
b65e8bee43c2ed0 4 hours ago||
this looks exactly like every mastodon instance I ever saw.
xnorswap 8 hours ago||||
The only .fun site I know is neal.fun, which regularly features on the front page here: https://news.ycombinator.com/from?site=neal.fun
ivanjermakov 4 hours ago||
I can also name https://beamng.tech/
eli 1 hour ago||||
That's just because they're relatively inexpensive
mghackerlady 5 hours ago||||
funnily enough, good.store which sounds like a made up example of a scam is actually a nonprofit ran by john green and his brother hank green
Yizahi 7 hours ago||||
Only .info is missing for the bingo :)
dist-epoch 7 hours ago|||
Because they are very cheap. If you are a scammer, why pay $5 for a domain when you can buy one of these for $1.

I use them when I need a random domain.

esseph 6 hours ago||
> Because they are very cheap.

When I first bought an .online, it was not cheap

jdfellow 3 hours ago|||
Well, dang. I've used a .tech as my personal domain and email for some years now, and didn't know this was owned by an obnoxious registry.
ectospheno 6 hours ago||
Despite blocking 66 TLDs and all IDN ccTLDs on my home dns I didn’t have these blocked. Guess I’ll consider it. Once you have the hagezi rpz files including threat information feed though you really have blocked most silliness.
AshamedCaptain 8 hours ago||
> The domain ... has been suspended due to its blacklisting on Google Safe Browsing

Et voilà ... ! this is precisely the slippery slope I warned about a decade ago. The indirect censorship becomes direct censorship, defeating all the arguments about the morality of such a list. And:

> Not adding the domain to Google Search Console immediately. I don't need their analytics and wasn't really planning on having any content on the domain, so I thought, why bother? Big, big mistake.

Yet more monopolistic power to Google.

jeroenhd 7 hours ago||
This is 100% on Radix, not on Google. Google and Microsoft can (and probably should) have a registry of known-abusive websites. False positives are inevitable, so these should be taken with a grain of salt, but in most cases they're correct. Their lists are a lot more reliable than those from the "traditional" antivirus/anti-scam vendors that will list anything remotely strange to pump up their numbers.

The external people treating these lists as absolute truths and automatically taking domains down are the ones at fault here. Google didn't grab power, Radix gave it to them without asking.

AshamedCaptain 5 hours ago|||
Exactly what we predicted would happen (someone would eventually put "too much faith" on this list) has literally happened, and your defense is still "well it's not Google's fault, it's a 3rd party's!". Obviously the point is not that Google was going to do it, but that others would , analogue to the process known as "self-censorship".
flaminHotSpeedo 4 hours ago||
Self censorship requires a threat or risk of detriment if the party doesn't self censor, right? Where is that here?

What Radix does has no impact on Google, and I don't see how Google would be incentivized to pressure Radix. So I don't see how to make the leap blaming Google for Radix's incompetence. Yes, Google should recognize the risk of this happening, but they'd have to balance that against the rewards (or at least what they consider rewards)

donmcronald 2 hours ago||
Google is making false statements about the safety of a domain and it has significant collateral damage. Google is the cause. They should be liable for losses.

I had my main family domain put on Google's safe browsing block list and it has a massive impact. No one can visit the site. I think apps using system browser runtimes (ie: mobile) may stop working. I've seen reports that it can impact email deliver-ability. And, now, we see that it can get your domain put on serverHold so the problem becomes impossible to rectify.

Google should have to pay for the damage. In my case, it was about 4h of work to figure out what was going on and how to fix it, so not much, but I've seen small businesses that rely on their primary domain to drive most of their sales via web and email. In those cases, having your domain placed on server hold because of Google's false statements can have a serious, detrimental financial effect.

flaminHotSpeedo 1 hour ago||
That's fair, if your domain is erroneously put on the block list, Google should be liable for the consequences.

But my point is that any knock on effects like domain suspension, email deliver-ability, etc. stem from 3rd parties misusing the safe browsing list outside the scope of safe browsing.

I don't see how Google can be blamed for other companies erroneously treating the safe browsing list as a source of truth for generally malicious domains

pocksuppet 30 minutes ago||
A lot of laws use the phrase "known, or should have known"

Google should not have known that someone would misuse their block list to block domains. But now that someone is misusing their block list to block domains, if someone brings it to their attention, the next time this happens, they will have known it.

I am not a lawyer, I am not your lawyer, and this is not legal advice.

axus 5 hours ago||||
I read your comment as agreeing with the article: "Never buy a .online domain".

And Google has the right to publish a list, there should be more lists not less. But Google was at fault for not correcting their blacklist. Until the article appeared on Hacker News, this was not 0% on Google. A small, correctable mistake, but they deserved a tiny bit of blame.

overfeed 4 hours ago||
> But Google was at fault for not correcting their blacklist.

If all it takes to be taken from the blacklist was to temporarily delete the NS record - the list would be useless against malware.

kelvinjps10 5 hours ago||||
Wym mean external people aren't these lists integrated to the browsers? I'm sure if you try to open a website from this list your browser won't let you and I'll put a big warning sign
lazide 7 hours ago|||
What is to stop Google et. al. from also adding a lot of excess domains to pump up there numbers?

What is to stop everyone from doing this blacklisting?

jeroenhd 6 hours ago|||
Google doesn't sell their list to you. They give it to you for free. Using their list costs them money. Pumping up numbers gains them nothing but the headache of PR issues when they get a false positive.

Spyware filters used to boast about how many domains they filter out because they wanted you to buy their filters instead of someone else's. By the time they hit a false positive, they've already sold a year's subscription to that customer.

The incentives are different.

crote 6 hours ago|||
Step 1: Get everyone to use your free internet filter

Step 2: Alter filters to mark newly-registered domains and low-traffic websites as "potentially harmful".

Step 3: Charge a lot of money for "business verification" - which gives them a fancy badge somewhere and incidentally makes their website trustworthy in the eyes of your filter.

Step 4: Profit!

The Big Tech cartel has been doing this pretty successfully with email (see the weekly "Don't self-host your email" posts), why should we assume they are doing anything different with browser-based website blocking?

encom 6 hours ago||
>pretty successfully with email

Indeed. I was going to register an account somewhere the other day, and the signup form had a list of acceptable email domains. Gmail, Protonmail, Outlook, Yahoo, Icloud... a few others. It's not the first time that's happened to me. Sad.

EDIT: Didn't even include Fastmail, who's pretty big after all. They host MX for my domain, so I could have "circumvented" it that way with their disposable address feature, but nope.

hedora 5 hours ago||||
I've found that, whenever considering Google's actions and incentives, you need to remember two things:

- They make almost all their money on advertising

- They have deep ties to the US intelligence agencies (To the point that a Google employee managed the appointment calendar for our Secretary of State a few years ago!)

So, how would these incentives apply to their Internet blacklist?

- If you are parking lots of Google ad spam, they are taking a cut of your revenue, so they have an incentive to take you off the list (evidence and testimony from the antitrust trial documented ongoing fraud in every layer of Google's vertical ad monopoly)

- If you are hosting something the intelligence agencies dislike / are neutral to / like, that'll impact your presence on the list.

Macha 6 hours ago||||
Not true. Commercial or large scale use requires you to use their Web Risk API instead which is a paid service
cortesoft 6 hours ago|||
> Pumping up numbers gains them nothing but the headache of PR issues when they get a false positive

There is also the headache of PR issues when they get a false NEGATIVE. “Google didn’t protect grandma from this scam website!”

phoric 7 hours ago||||
Google wants you to use it. If it blacklists excess domains that hold legitimate sites, their product gets worse. If they blacklist illegitimate sites, their product gets better.
cwnyth 6 hours ago|||
This argument would hold more weight if Google didn't have a history of making their own products worse and then getting rid of them.
zenapollo 6 hours ago||||
Cute. That is the commenter’s whole point about monopolies. Google is on record making their product worse to squeeze revenue. We’ve been living in the enshitification economy.
simsla 6 hours ago|||
There is a financial incentive to make the search results worse. (More searches, more ads, more money.)

There is no incentive for adding false positives to lists of malicious websites.

crote 6 hours ago||
Sure, until their "smart filters" start considering GCP-hosted websites as pre-verified and small self-hosted websites as malicious. You know, like they have been doing with email?

Chrome is big enough that a website owner can't afford a false positive on their malware list, just like they can't afford to have all their email end up in spam for all Gmail users.

Due to their near-monopoly Google also has no incentive to avoid adding false positives to their blocklist - provided they don't accidentally block high-profile targets. And if a CxO is screaming over your shoulder that your website has been blocked, arguments about "false positives" aren't very compelling: they'll just demand you move off the "shitty basement provider" and switch to "proper hosting, like the Google Cloud"...

squeefers 6 hours ago|||
> We’ve been living in the enshitification economy.

that whiny bullshit about somebody elses website? you dont have to rely on a website or app. either you need their monopoly because you cant do it yourself, or you have options.... in both cases the whining is not needed

lazide 7 hours ago|||
Same as for those antiviruses.
bonestamp2 5 hours ago||||
Nobody sees Google's numbers except Google... in other words, the numbers are not a sales tool for Google like they are for anti-virus/blocking companies. So, there's no reason for Google to pump up their numbers, it would just be extra work to make their product worse which wouldn't make sense.
thesuitonym 6 hours ago|||
Nothing, but they haven't done it so far, and they don't really have any incentive to do so.

It doesn't really matter that it's Google. It could have been Microsoft, or PAN, or McAfee or some fly-by-night vendor. The problem was Radix taking the list as iron-clad truth and disabling the domain without any notification or way to resolve the issue.

otterley 8 hours ago|||
Google’s allowed to have an opinion. But that doesn’t mean that the registrar should be suspending the domain immediately in response. These two mechanisms should be decoupled.
account42 8 hours ago||
Google should not be allowed to make libelous statements without consequences.
acoustics 6 hours ago|||
How is any kind of antivirus or threat detection software supposed to operate on this standard?

Libel suits can be financially catastrophic, so even a tiny false positive rate could present risk that disincentivizes producing such software at all.

And a threat detection mechanism that has a 0.0% false positive rate is conservative to the point of being nearly useless.

rtsam 6 hours ago|||
I think that is the idea. They shouldn't exist without a prompt mitigation path.

In other words, if you can't deal with the false positives in a timely manner. You SHOULD be liable for the damages.

I can't build a budget car put together in an unsafe manner. Then complain I can't compete due to all the peoples cars crashing and blowing up and suing me.

kevin_thibedeau 6 hours ago|||
You document your claims with concrete evidence of fraud. That will be your libel defense. No evidence means you bear the full responsibility of a fuckup.
acoustics 5 hours ago||
At internet scale, this would roughly be equivalent to not doing any warning or detection at all.

Scalable systems need to use heuristics to catch threats. Needing concrete evidence in every case means that an enormously higher amount of malicious resources will not be flagged.

There is a policy argument as to the right balance of concerns here. But there is a clear trade-off to make.

pocksuppet 28 minutes ago|||
Then that heuristic is your evidence in court. If it's a good heuristic, you win the case. If it's a bad heuristic, you lose the case.

"Your Honor, we banned this person's website because his web page contained the word 'bitcoin' more than 5 times" will not hold up.

"Your Honor, we banned this person's website because it contains a bitcoin miner script. See, here is the script, and it matches the hash value found in these other attacks" hopefully holds up.

donmcronald 2 hours ago|||
> Needing concrete evidence in every case means that an enormously higher amount of malicious resources will not be flagged.

Giving everyone a fair trial just doesn't scale. It costs too much.

otterley 8 hours ago||||
(IAAL but this is not legal advice.)

It’s not libel. Defamation requires a false statement of fact. Marking a website as “unsafe” is an opinion.

grayhatter 7 hours ago|||
> Marking a website as “unsafe” is an opinion.

No, it's not.

You're welcome to cite case law if you want to insist. Otherwise, unsafe (in the context of infosec) has a definition of likely or able to cause harm or malfunction. Something that is provable or falsifiable with evidence.

otterley 2 hours ago|||
I'm curious as to how you would prove that it would be impossible for any resource accessible under a given DNS domain to ever cause harm to anyone else.
pocksuppet 27 minutes ago||
You don't. Google has to prove that something on that domain can cause harm.
jcalvinowens 6 hours ago||||
Isn't "oops we made a mistake" actually a valid defense to libel in most US states? I thought you had to prove it was intentional to some extent? Or reckless/negligent IANAL
horsawlarway 5 hours ago|||
Google takes no action to review the reports that their warnings are false until you sign up for Google products (namely - registering the site in their search console).

I reported a falsely flagged site repeatedly for weeks with absolutely no action from them.

Mozilla and Microsoft both did actually remove the warnings after the reports (Edge and Firefox stopped displaying the warning). Google did not. Google strong armed me into registering for google products, like a fucking bastard of a company.

This was the moment I went from "I don't love google anymore" to "Google can get fucked".

I wish them bankruptcy and every damn legal consequence that is possible to enforce.

jcalvinowens 5 hours ago||
I'm not defending google, I'm just wondering if claiming libel is barking up the wrong legal tree.
rtsam 5 hours ago||||
"I believed it to be true" is a defense. But negligence isn't. In fact, that is usually what you want to prove, that they acted on things that a reasonable person (or a person that is supposed to be skilled in that field) can see is not true.
otterley 3 hours ago|||
Negligence is an element of the tort of defamation.
ifh-hn 6 hours ago|||
Whether that's true or not is irrelevant if it's defined by law differently. Even without case law and precedent you'd still have to test it in court, which for libel can be prohibitively expensive.

For clarity I'm not agreeing or disagreeing, but what means sense to the layperson (including experts in a particular field) is sometimes at odds with what the law says.

ThunderSizzle 7 hours ago||||
Google is stating in a position of authority. It's therefore being stated as at least a professional opinion with the equivalent weight of fact, or representing facts.

If the opinion is meant to be just another opinion, then it shouldn't cause any blacklisting of any sorts anywhere.

account42 7 hours ago|||
Not to mention that the whole point of the list is for blocking in e.g. web browsers. Claiming it is just an opinion would be like a mobster claiming they didn't actually order a hit.
otterley 7 hours ago|||
> If the opinion is meant to be just another opinion, then it shouldn't cause any blacklisting of any sorts anywhere.

I agree with this! The registrar should not have triggered a suspension because of this. They're not obligated to, and the two processes should be decoupled.

MadameMinty 7 hours ago||
The registrar should ignore reports of abuse, especially if coming from an authoritative source with vast resources that's been collecting reports on its own?

No.

The source should be more careful. It's the equivalent of a renowned newspaper printing warning a restaurant being unsafe to visit. Should the customers' willingness to visit be magically decoupled from this opinion?

ryandrake 6 hours ago|||
It's like a renowned newspaper saying the restaurant is unsafe, and then also the restaurant's landlord taking it at face value and locking the doors without further investigation. Both can be wrong.
otterley 3 hours ago|||
> The registrar should ignore reports of abuse, especially if coming from an authoritative source with vast resources that's been collecting reports on its own?

I'm not saying they should "ignore" reports of abuse but treat them as they are -- reports. They can then perform their own independent investigation.

That may well have happened here. I suspect the author isn't telling us something.

RobotToaster 6 hours ago||||
Depends on jurisdiction. In the UK it's not an absolute defence, you still have to prove it's an opinion a "reasonable person" could come to based on facts.
hackerman_fi 7 hours ago||||
How is it any more of an opinion to "mark" a website as "unsafe" than say, "contains CSAM"?
dspillett 7 hours ago|||
“contains CSAM” is likely an unarguable fact.

“unsafe” is a term that is both broader and more vague, so I would consider it opinion unless backed up by appropriate facts (like “contains CSAM”, “contains malware”, and so forth).

kmoser 5 hours ago||
> “contains CSAM” is likely an unarguable fact.

Except when it isn't. CSAM may be easier to define and identify than pornography, but there still exists material that treads a moral grey area.

otterley 7 hours ago|||
One is disprovable, the other is not.
ses1984 7 hours ago||||
Maybe libel is the wrong term, but erroneously marking a website as unsafe can lead to damages.
otterley 4 hours ago||
Only if it’s intentional (or maybe grossly negligent).
pocksuppet 26 minutes ago||
Google is grossly negligent
horsawlarway 5 hours ago||||
As someone who has also been bit by this, and with the only possible resolution being that I sign up for google services and register my site with them in the google search dashboard...

Fuck Google.

This is absolutely libel. They put a big fucking red banner on top of my site, telling the world that it's unsafe, using all the authority they have as one of the largest tech companies in the world.

In my case - it was a jellyfin instance I'd stood up to host family videos of my kids for my parents.

It was not compromised, and showed only a login page. I reported it as a false flag repeatedly, for weeks, with Google doing jack fucking shit.

Only after signing up in their search console and registering the site did the warning disappear.

They are abusively forcing people into their products. Fuck Google.

In case it wasn't entirely clear - Google can get fucked. Fuck Google.

otterley 4 hours ago||
There’s nothing wrong with your dislike of Google. No matter how much you dislike them, though, the word “libel” has a meaning that should be respected. To opine that a site is unsafe is simply not libelous.
pocksuppet 26 minutes ago||
It's libelous in Germany unless you can prove it's true. In fact people regularly get punished in Germany for things like calling politicians idiots, because they can't prove they are idiots. https://www.ft.com/content/27626fa8-3379-4b69-891d-379401675...
master-lincoln 6 hours ago||||
That depends on jurisdiction. E.g. in South Korea true statements can constitute defamation too
tshaddox 6 hours ago||||
That sounds like a spurious distinction. Pretty sure you can’t say “Person X is a murderer” and then say “well I’m only expressing my opinion, and in my opinion if you do something that annoys me that qualifies as murder.”
habinero 5 hours ago||
Nope, not in the US. It is perfectly legal to say, for example, "Kyle Rittenhouse is a murderer" despite him being acquitted. You're entirely free to disagree with the result, that is an opinion. Any opinion based on public knowledge is ok. It doesn't even have to be reasonable or rational.

What you can't do is imply non-public knowledge, aka "I heard from my cousin who works in law enforcement that Kyle murdered a hobo when he was 12 but the records were sealed", or state specific facts that can be proven true or false: "Kyle murdered a hobo on September 11, 2018 out back of the 7-11 in Gainesville, FL"

The standard for libel/slander is much, much higher than people think. It's extremely difficult to meet them, and for public figures, it's almost impossible.

otterley 3 hours ago|||
> It is perfectly legal to say, for example, "Kyle Rittenhouse is a murderer" despite him being acquitted.

That's ... not quite true. I wouldn't go that far.

habinero 1 hour ago||
Sure it is, that's how the 1A works. Saying he was convicted of murder is not true, but calling him a murderer is an opinion. Your opinion doesn't even have to be reasonable. It just has to be based on facts that both you and I have.

1A rights are construed really broadly. The courts don't do the 'he wasn't legally convicted therefore it's illegal to call him one' thing.

otterley 46 minutes ago||
If that were true, news organizations wouldn't be as careful as they are to preface the word "alleged" before the behavior -- before or after a trial. I don't think you'll find any reputable commercial newsgathering organization that makes a plain statement that Kyle Rittenhouse is a murderer.

The First Amendment doesn't protect the speaker against all forms of defamation (though it does put some barriers up that make it harder to win in some circumstances). If it did, defamation as a cause of action wouldn't exist at all.

As a practical matter, though, this is largely theoretical. Once you've been through the rigamarole of arrest, prosecution, and trial, even if you're found not guilty of the crimes committed, the reputational damage is just too widespread. You're not going to go after the defamers: there are just too many, and if you tried, there would be a fair question as to whether you have any positive reputation left to injure. Your life is pretty much ruined. It's a pretty terrible situation for the wrongly accused.

roger110 7 hours ago|||
In my opinion, a .online domain is unsafe. 99% of people only visit ".com"s unless they clicked a scam link. Completely blocking the site is overkill, but the browser should warn you about it like it does with non-SSL sites.
master-lincoln 6 hours ago|||
thanks for the laugh. Even if you only meant people from the US this is likely not true. What about government websites at .gov? 99% never visit them?

In other countries local TLDs are of course normal (e.g. .it for Italy, .za for South Africa, .cn for China...) and not only used for scam links.

LoganDark 7 hours ago|||
What? I find myself on .net-s and .org-s all the time. For example... Wikipedia is .org. Do 99% of people not visit Wikipedia?
mystraline 7 hours ago|||
They should be held legally culpable for libellous claims they make.

I dont care if their pre-LLM ai says "thingy bad". They are responsible for the scripts or black boxes they control. I dont care if they dont give a reason.

Claiming bad/malicious/etc site is 100% libel. And doubly so, anybody who has been forced to agree to a ToS with binding arbitration should have it removed for libel.

otterley 7 hours ago||
> Claiming bad/malicious/etc site is 100% libel.

No it isn't. https://www.law.cornell.edu/wex/defamation

Please, use words correctly.

hamdingers 7 hours ago||
The words in your link do not support the words in your comment. Don't be snarky unless you are certain you're correct.

> a plaintiff must show four things: 1) a false statement purporting to be fact; 2) publication or communication of that statement to a third person; 3) fault amounting to at least negligence; and 4) damages, or some harm caused to the reputation of the person or entity who is the subject of the statement.

They falsely marked the site unsafe[1] on a published list[2], the results weren't checked and couldn't be appealed[3] and OPs site was taken down[4].

MadameMinty 7 hours ago|||
Sounds textbook to me.
habinero 4 hours ago|||
It does. "Unsafe" is not a fact, it's an opinion.
rtsam 4 hours ago||
"When Google marks a site as "unsafe" or "dangerous" in Chrome or search results, it is a factual finding based on automated detection of specific, technical security threats, rather than a subjective opinion. These warnings are triggered by Google’s Safe Browsing technology, which scans billions of URLs daily to protect users from malicious content"

Opinions and facts in a legal context usually comes down to who is saying what. Someone personally says "this soup is bad" on a review site = opinion. A news site plastering it on their front page = fact.

A person saying something as an individual is usually considered an opinion. A company doesn't have that same protection.

otterley 3 hours ago|||
> "When Google marks a site as "unsafe" or "dangerous" in Chrome or search results, it is a factual finding based on automated detection of specific, technical security threats, rather than a subjective opinion. These warnings are triggered by Google’s Safe Browsing technology, which scans billions of URLs daily to protect users from malicious content"

Whom are you quoting here? A court opinion?

habinero 4 hours ago|||
Nope. Not correct. Companies have the same 1A rights, too.

In the US, it really doesn't matter who says it, the only thing that matters is who it's being said about.

If you are a "public figure" -- which is a much broader category in 1A law than you think -- then in order to prove defamation, you have to prove the thing was false _and_ that the person saying it knew it was false at the time. Not that they were mistaken, not that they were careless, not that they knew later, they deliberately lied and knew they lied as they said it.

If your next question is "how do you prove what someone was thinking", then yes. That is the reason it's nearly impossible.

rtsam 3 hours ago||
Not talking about 1A rights or public figures. We are talking about

Opinions (Protected) vs Facts (Not Protected)

Defamation cases where individuals say something are usually considered opinions and companies are usually considered facts in the eyes of the courts. I say "Usually"

Defamation also DOES NOT require intent, but it requires a minimum level of fault (negligence)

Google saying something is unsafe in the web search or browser would not be considered an opinion because of their position of authority. It would not even be a debate since Google has already said they make decisions based on facts and data presented to them.

The only question is are they negligent in their assessment or response to a false report. And what would be the damages. In the case of a phishing report that is false courts would already consider it defamation per se (damages presumed)

otterley 3 hours ago|||
> Google saying something is unsafe in the web search or browser would not be considered an opinion because of their position of authority.

Everything the Supreme Court rules is an "opinion." And they're the ultimate arbiter of legal questions in the U.S.

Whether a statement is a fact and whether the person who said it is considered an "authority" or not are independent concerns.

habinero 1 hour ago|||
We are absolutely talking about the 1A lol. Defamation is 1A law. It is one of the few recognized exceptions to the 1A.

And we are also 100% talking about public figures. "Public figures" include companies and it's a critical part of 1A since Times v Sullivan.

Google is a US company and has 1A rights. That's how it works. The rest of what you said is nonsense and is your idea of how it should work, but has nothing to do with how it actually works.

otterley 40 minutes ago||
To be more accurate, defamation is civil tort law, circumscribed by the First Amendment. (Defamation as a cause of action is quite old, reaching back to our English common law roots, and goes back further in history, I believe.)
creddit 8 hours ago|||
How was this Google’s fault? Seems clearly like Radix’s fault.
hamdingers 7 hours ago|||
If a newspaper publishes a false story about a business and someone takes it upon themselves to attack the business, it's partially the newspaper's fault.
WhyNotHugo 6 hours ago||
If a newspaper publishes a story about a business and someone takes it upon themselves to attack the business, the attacker is at fault, regardless of the veracity of the newspapers claims.
rtsam 6 hours ago||
I am in Canada, but I think it is the same in the US? A newspaper can be responsible here. For example, if they say "people should riot" and a riot happens, the newspaper could be responsible for all actions that resulted the same as if they were the ones doing the crime.

Same with if they become aware of defamation and fail to retract and make a statement. But newspapers will generally also thoroughly investigate themselves to make sure what they are publishing is true.

otterley 38 minutes ago||
It is not the same in the U.S. (And, to be honest, I'm quite doubtful this is true in Canada, though I could be persuaded through legal citations that it is.)
account42 8 hours ago|||
It's both's fault. Google for making false and clearly damaging statements (libel) and Radix for acting on them.
otterley 8 hours ago||
(IAAL but this is not legal advice.)

It’s not libel. Defamation requires a false statement of fact. Marking a website as “unsafe” is an opinion.

rtsam 7 hours ago|||
I always wonder what the settlement and damages would be if google marked Amazon as a phishing site for even a few minutes.

The problem is that these gatekeepers of the internet respond to false statements of facts/opinions by so called professionals.

I had cloudflare mark a worker as phishing because a AI "security company" thought my 301 redirect to their clients website was somehow malicious. (url redirects are normal affiliate things)

If the professionals don't understand the difference and cloudflare and google blindly block things, this is scary.

otterley 4 hours ago||
There is a potentially different cause of action, tortious interference with business relationships. It does require that the defendant intended to interfere in a way that would cause harm to the plaintiff, though. Proving Google intended such harm would be difficult and expensive.
pocksuppet 23 minutes ago||
Google intends harm to everyone on that list. That's the point of the list. Google is unlikely to have intended this specific harm, but they don't have to.
otterley 18 minutes ago||
That won’t cut it in court.
retired 5 hours ago||||
Marking a website as "unsafe" in Chrome is equal to standing in front of the door of a small restaurant and blocking 71% of people going inside. Everyone first has to agree that they will enter the restaurant at their own risk.

That is more than an opinion. Chrome has a monopoly and should act accordingly. Blocking entry to a website should be a last resort, not just because someone didn't add their website to the whitelist.

donmcronald 1 hour ago||
Yeah. Everyone uses their list and being blocked by all web browsers is like having someone cover the doorway with a massive DANGER sign. It's insane that people are roaming around here arguing that it's ok because the damage caused is a necessity for "internet scale".
otterley 1 hour ago|||
Right now, any damages are completely speculative at this point. I would suspect in this case, the damages are minimal, and taken in the broader context, the good outweighs the harm. Do you have evidence to the contrary?
retired 1 hour ago|||
Indeed. It is almost like how the Mafia operates. This person didn't submit his website to Google and now Google blocks visitors.
ThunderSizzle 7 hours ago||||
It's being stated as fact, not as an opinion.
jolmg 7 hours ago||
(IANAL) It's not about how it's stated, but whether it can be objectively proven to be true or false. "unsafe" refers to the likelihood of something bad happening in the future. You can't prove that something bad will happen in the future, so it's opinion.
saghm 7 hours ago||
Also not a lawyer, but that makes intuitive sense. If I say "that food tastes bad", it's phrased as a fact, but a "reasonable person" (which is in fact a legal test used for some things, although I admit I'm not sure about libel) knows that there's an implicit "...to me" qualifier because the concept of taste itself is inherently subjective. My instinct is that while there are some things everyone would agree on as unsafe, it pretty quickly turns into a judgment call, and it probably makes sense to allow even ill-informed opinions that are made in good faith rather than malice or negligence. The question then becomes whether there's sufficient evidence to conclude something like that, and while the bar is lower for a libel claim than something criminal, it's still not obvious this would be provable here.
ryandrake 6 hours ago||
"Unsafe" is just a terribly vague word, too. As a layman, I wouldn't even know what that means with respect to a web site. What's "unsafe" about it? Is it going to shoot my dog? Is it going to drain my bank account? Is it going to give my computer a virus? Saying a web site is "unsafe" really isn't providing any interesting information, and it shouldn't be acted upon by pretty much anyone.
otterley 4 hours ago||
I agree that it’s not specific, but I disagree that it should be blindly ignored. It’s not like they have no reason whatsoever for their opinion.
jmye 7 hours ago|||
This seems like a distinction without difference, given everyone in the ecosystem takes that "opinion" as true fact, including the market-leading browser produced by the "opinion"-haver.

I get that's mostly what corporate lawyers argue about, but it's functionally dishonest in this case.

RockRobotRock 5 hours ago|||
That's like a business being dissolved because it got a bad rating from BBB. Absolutely insane.
dizhn 8 hours ago|||
That is the bit that jumped at me immediately too. Why would a registrar take it upon itself to suspend a domain that another entity entirely blacklisted as part of their own completely opaque process? Who is Google? God?

On the flip side of the coin I cannot get a site removed that is a blatant rip off of one of our websites being actively used for invoice redirection fraud.

avaer 8 hours ago|||
It's like being unable to get a passport because Microsoft has you on The List, and Microsoft needs to see your passport to check why you're on the list.

Considering that getting a domain is a normal part of business these days, this kind of thing should be illegal. Not to mention, why does Google have any say in this?

riddlemethat 7 hours ago||
You know it's getting bad out there when corporations act like the government.
dizhn 7 hours ago||
It's like the domain registrar is acting like a vassal state. I don't think Google actually has any say in their decision.
bandrami 7 hours ago||||
> Why would a registrar take it upon itself to

Because keeping Google happy or at least not bothered is an existential priority for registrars

dizhn 7 hours ago||
I am suspecting something like this too but what is the mechanism by which Google would have influence on the registrar? As far as they are concerned the domain is gone from their index.
rustyhancock 7 hours ago|||
Well until a human can verify.

Which likely is slow without a poke it's reasonable to base the decision on whats available.

That's just how reputation works.

dizhn 7 hours ago|||
It doesn't sound reasonable to me at all. Why would we think that the reasons google blacklists a domain would align perfectly with reasons a domain name would be suspended? In the end they don't seem to agree already since the domain was unsuspended. Who knows why it was blacklisted by google? Even the decision to unsuspend it looks arbitrary.
redeeman 7 hours ago|||
and anyone that trusts googles judgement here clearly needs a reputation of their own
the_arun 7 hours ago|||
Should domain name matter? Or this applicable to any domain?
TiredOfLife 6 hours ago|||
Where did you do the warning?
bjt 5 hours ago||
It's not about the .online TLD being "weird". The problem is that it was free. That's going to attract a swarm of fraudsters, spammers, etc, and then turn into a strong "this is probably fraud" signal in all kinds of fraud scoring systems.

There are lots of domains out there other than .com that are just fine.

fckgw 4 hours ago||
.online, .top, .xyz. info and .shop are some of the top TLDs that scammers use, precisely because of their rock bottom registrar fees that make them attractive for sites that have a shelf life of a few hours or a few days before being blocked. As a result, many places have a blanket "suspicious" flag for fresh domains under these TLDs.

If you plan on building a legit site, do not use any of these cheap TLDs.

al_borland 4 hours ago||
Paying through the nose for a .com that is remotely memorable and easy to spell is not a great path forward for a hobbyist or someone who simply wants their own domain for email.

I know someone with a .org domain, and even they have a ton of issues with false flags on their emails due to not coming from a big email provider. They’ve been blacklisted a couple times and regularly get flagged as spam. I’m surprised he hasn’t given up after dealing with this stuff for 25 years.

These new TLDs, I thought, were supposed to open up more options for regular people to get a domain that is semi-decent. Instead they’re essentially useless. Some of the prices are also still insane, due to assumed “premium” status or domain squatters.

There has to be a better way to police this stuff.

garganzol 5 hours ago||
Probably this is what's happened here. Either the OP's domain was previously used for shady activities, or the almost-free stigma puts the whole .TLD in the grey list of high-risk assets. Probably is also explains the nuclear behavior of the registrar (suspension).

Free is good, but sometimes it's not.

pverheggen 8 hours ago||
I wonder if Radix has unknowingly created a negative feedback loop here. From Google's perspective, the DNS records disappear shortly after being flagged by Safe Browsing, which their heuristics may interpret as scammy behavior.
petterroea 7 hours ago||
Side note: My empirical experience is that vanity domains are disliked by some enterprise security systems. I have a friend who owns a .homes domain which ended up being blocked by quad9 as well as the enterprise security system of a friend's work for ~half a year. The block cleared by itself.

I had the same experience while buying another TLD. For ~1 month, certain people whose ISP "helpfully" had "safe browsing" features, simply blocked us outright. For being new and different.

The learning for me was that new domains are no longer trusted, and seemingly some vanity domains get even more strict treatment.

mavamaarten 6 hours ago||
Even (uncommon) country TLD's too. I own a .vg domain which is a perfect match with the initials of my last name. My mails end up in spam quite often too, despite having set up SPF, DKIM, DMARC and all that stuff correctly. It's just not common so some security systems block it.
Avamander 6 hours ago||
It's not just about being common, it's also about the share of abuse coming from such domains.
wink 3 hours ago||
Or just incompetence, I had to lobby to get .org unblocked for mail at some CS faculty of a (not my) university, 20 years ago.
Avamander 3 hours ago||
Usually not, just look at for example SpamHaus's top abusive TLDs. New TLDs dominate.
mghackerlady 5 hours ago|||
Fortinet blocks new domains by default so I can never check out cool new projects on the front page when I'm procrastinating nowadays :(
snailmailman 3 hours ago|||
This does unfortunately actually work pretty well as a security measure. The new domains that are cheap and good for fun side projects, are also cheap for scammers.

For a while I noticed all the scam links my grandmother was getting were from ‘.top’ domains. I fully blocked it at the DNS level. Her DNS settings also block all newly registered sites for 90 days. She hasn’t ever had issues with it. But these have actively prevented her from clicking on scam links multiple times.

Facebook, google, and all the popular sites are all older than 90 days, on popular well known TLDs. My grandmother doesn’t seek out new trendy sites.

It was definitely something I considered when buying a new domain. I sorted by price, and then immediately ignored all the cheapest domains that were ~$1 because I’ve seen them being used for scams. They may be cheap but good luck using them.

roger110 7 hours ago||
Because the entire security mechanism of the www today is "look at the domain name to make sure it matches." And the TLD is at the end where people might miss it.
yanis_t 8 hours ago||
I still remember how Google banned my entire account without providing a reason for a small Android app (more than 12 years ago). To this day I have no idea why, it was absolutely green-area fit tracker or something. There was absolutely no way to know the reason or unblock my account. Turned me away from Android development forever.
seanw444 2 hours ago||
They want to make this the only way to run apps on Android too.
jkestner 8 hours ago|||
A relative’s business has had Google reviews frozen for years. Search results show the bad rating after some former customer and spouse left bad reviews several years ago. Appeal went into a black hole. Running a small business is at the pleasure of Silicon Valley.
pocksuppet 20 minutes ago||
Check with a lawyer if this counts as tortious interference. You could potentially win quite a large sum from Google.
littlecranky67 7 hours ago||
Same shit happend to me - got my google account blocked overnight and locked out of most of my digital life. Learned my lesson and ungoogled asap.
pil0u 8 hours ago||
One conclusion is:

> Not adding the domain to Google Search Console immediately.

I don't understand. What is Google Search Console, and should I add all my domains there right now?

swiftcoder 8 hours ago||
https://search.google.com/search-console

And yes, you probably should, if only to pre-register your ownership thereof if google ever decides to nuke you from orbit

inigyou 8 hours ago||
But if Google decides to nuke me from orbit, and my domain is registered there, the nuke can cross between my domain and my Google account.
swiftcoder 8 hours ago||
Well, yeah, that's digital monopolies for you. I guess one can always create a dedicated google account to register each site with
cube00 5 hours ago|||
It doesn't work, there was a Google employee here mentioning they assign a degree of separation to each account, any accounts that are deemed "close", are included when the ban hammer falls.
Serenacula 7 hours ago|||
Google ties your accounts together on the backend though if they realise they're related, so this isn't as easy as it sounds.
joelccr 8 hours ago|||
If it's already in the Console when it gets blacklisted, you can appeal it without having to 'verify' ownership of the domain that, in this case, you no longer control the DNS of, because you completed that process when adding it to Console.
embedding-shape 8 hours ago|||
> I don't understand. What is Google Search Console, and should I add all my domains there right now?

Google's way of tying real identifies of people to domains, without making it explicit.

Basically, your domain will be weirdly treated by a bunch of entities, none the less Google themselves, if you don't add your domain there (or some other Google property).

Especially with less common TLDs, like .online, they really want to be able to tie it to some identity, so unless you add it there, eventually your domain ends up on some sort of blacklist, in the case of the author it seems they used the "Google Safe Browsing" blacklist to get the author to involve Google somehow.

qingcharles 6 hours ago||
Open a fake Google account under your dog's name using a VPN? It doesn't have to be tied to your own every day Goog acct. Any old account will do.
ssiddharth 8 hours ago|||
To request a formal review, you must be a verified owner in Search Console.
techcode 8 hours ago|||
Can't answer if you should add them or not...

But if you do - you would get some notifications from Google about that website/domain.

I've only ever seen emails of the "There's an increase in 4xx/5xx errors on site/page(s)"

Macha 6 hours ago||
I also get “there were crawl errors”, which upon investigation are for pages that never existed (and I’ve owned the domain for 20 years, so its not a previous owner/operator thing)
onli 8 hours ago|||
https://search.google.com/search-console/about. Yes. It gives you options in cases as described here.

Was called webmastertools before.

notenlish 8 hours ago||
By adding your site to there you can get data on how many clicks & impressions your site received on google, what keywords it ranks for etc.

You can also request Google to index your site on GSC as well.

You should probably add your websites to GSC.

ghoshbishakh 8 hours ago|
We posted this warning on HN before: https://news.ycombinator.com/item?id=40195410

We struggled a lot when we opted for the .online domain for https://pinggy.io urls

More comments...