by janpio on 10/22/25, 8:53 PM with 656 comments
by arccy on 10/22/25, 11:30 PM
by mads_quist on 10/23/25, 6:27 AM
by dmoreno on 10/23/25, 8:34 AM
Not advice with some time to fix any possible problem, just blocked.
We gave very bad image to our clients and users, and had to give explanations of a false positive from google detection.
The culprit, according to google search console, was a double redirect on our web email domain (/ -> inbox -> login).
After just moving the webmail to another domain, removing one of the redirections just in case, and asking politely 4 times to be unblocked.. took about 12 hours. And no real recourse, feedback or anything about when its gonna be solved. And no responsibility.
The worse is the feeling of not in control of your own business, and depending on a third party which is not related at all with us, which made a huge mistake, to let out clients use our platform.
by jdsully on 10/23/25, 1:39 AM
They used to be more generic saying "We don't know if its safe" but now they are quite assertive at stating you are indeed an attacker.
by kevinsundar on 10/22/25, 11:07 PM
Doesn't that effectively let anyone host anything there?
by heavyset_go on 10/23/25, 1:25 AM
by zackify on 10/23/25, 3:54 AM
We have an iOS app in the store for 3 years and out of the blue apple is demanding we provide new licenses that don’t exist and threaten to kick our app out. Nothing changed in 3 years.
Getting sick of these companies able to have this level of control over everything, you can’t even self host anymore apparently.
by gomox on 10/23/25, 4:45 AM
by david_van_loon on 10/23/25, 2:50 AM
I know that I can bypass the warning, but the photo album I sent to my mother-in-law is now effectively inaccessible.
by NelsonMinar on 10/22/25, 11:29 PM
by trollbridge on 10/22/25, 11:47 PM
This also polluted their own domain, even when the redirect was removed, and had the odd side effect that Google would no longer accept email from them. We requested a review and passed it, but the email blacklist appears to be permanent. (I already checked and there are no spam problems with the domain.)
We registered a new domain. Google’s behaviour here incidentally just incentivises bulk registering throwaway domains, which doesn’t make anything any better.
by callc on 10/23/25, 5:00 AM
Surely among us devs, as we realize app stores increasingly hostile, that the open web is worth fighting for, and that we have the numbers to build solutions?
by akersten on 10/23/25, 3:34 AM
So is there someone from Google around who can send this along to the right team to ensure whatever heuristic has gone wrong here is fixed for good?
by nucleative on 10/23/25, 1:05 PM
If any company controls some (high) percentage of a particular market, say web browsers, search, or e-commerce, or social media, the public's equal access should start to look more like a right and less like an at-will contract.
30 years ago, if a shop had a falling out with the landlord, it could move to the next building over and resume business. Now if you annoy eBay, Amazon or Walmart, you're locked out nationwide. If you're an Uber, Lyft, or Doordash (etc) gig worker and their bots decide they don't like you anymore, then sayonara sucker! Your account has been disabled, have a nice day and don't reapply.
Our regulatory structure and economies of scale encourage consolidation and scale and grant access to this market to these businesses, but we aren't protecting the now powerless individuals and small businesses who are randomly and needlessly tossed out with nobody to answer their pleas of desperation, no explanation of rules broken, and no opportunity to appeal with transparency.
It's a sorry state of affairs at the moment.
by asimpleusecase on 10/23/25, 9:39 AM
by aetherspawn on 10/23/25, 3:36 AM
I had prior been tossing up the pros/cons of this (such as teaching the user to accept millions of arbitrary TLDs as official), but I think this article (and other considerations) have solidified it for me.
For example
www.contoso.com (public)
www.contoso.blog (public with user comments)
contoso.net (internal)
staging.contoso.dev (dev/zero trust endpoints)
raging-lemur-a012afb4.contoso.build (snapshots)
by bogzz on 10/23/25, 3:08 AM
https://news.ycombinator.com/item?id=42779544#42783321
Unironically, including a threat of legal action in my appeal on the Google Search Console was what stopped our instance getting flagged in the end.
by akshayKMR on 10/23/25, 3:10 AM
Is a notion page, github repo, or google doc that has user submitted content that can be publicly shared also user-hosted?
IMO Google should not be able to use definitive language "Dangerous website" if its automated process is not definitive/accurate. A false flag can erode customer trust.
by sinuhe69 on 10/23/25, 12:26 PM
Perhaps a complaint to the ETC for abusing the monopoly and lack of due process to harm legitimate business? Or DG COMP (in the EU).
Gather evidence of harm and seek alliances with other open-source projects could build a momentum.
by curioussquirrel on 10/23/25, 5:17 AM
by petepete on 10/23/25, 8:55 AM
https://govuk-components.netlify.app/
I use Google Workspace for my company email, so that's the only way for me to get in contact with a human, but they refuse to go off script and won't help me contact the actual department responsible in any way.
It's now on a proper domain, https://govuk-components.x-govuk.org/ - but other than moving, there's still not much anyone can do if they're incorrectly targeted.
by teekert on 10/23/25, 6:57 AM
The nerdsphere has been buzzing with Immich for some time now (I started using it a month back and it lives up to its reputation!), and I assume a lot of Googlers are in that sphere (but not neccessarily pro-Google/anti-Immich of course). So I bet they at least know of it. But do they talk about it?
by account42 on 10/24/25, 9:46 AM
by captnasia on 10/22/25, 10:57 PM
by archon810 on 10/24/25, 8:15 AM
We still don't know what caused it because it happened to the Cloudflare R2 subdomain, and none of the Search Console verification methods work with R2. It also means it's impossible to request verification.
by pkulak on 10/23/25, 5:35 AM
by KuSpa on 10/23/25, 2:13 PM
by awill on 10/23/25, 3:26 PM
by aborsy on 10/23/25, 5:25 AM
But how effective is it in malware detection?
The benefits seem to me dubious. It looks like a feature offered to collect browsing data, useful to maybe 1% in special situations.
by dizlexic on 10/23/25, 6:47 AM
During the appeal it was reviewed from India, and I had been using geoblocking. This caused my appeal to be denied.
I ended up deploying to a new domain and starting over.
Never caught back up.
by dpifke on 10/23/25, 4:58 PM
Fortunately, I expose it to the internet on its own domain despite running through the same reverse proxy as other projects. It would have sucked if this had happened to a domain used for anything else, since the appeal process is completely opaque.
by stack_framer on 10/23/25, 3:17 AM
by Animats on 10/22/25, 11:29 PM
by akerl_ on 10/23/25, 12:49 AM
by asmor on 10/23/25, 4:19 PM
by kazinator on 10/23/25, 8:37 PM
Navigating to https://main.preview.internal.immich.cloud, I'm right away informed by the browser that the connection is not secure due to an issue with the certificate. The problem is that it has the following CN (common name): main.preview.internal.immich.build. The list of alternative names also contains that same domain name. It does not match the site: the certificate's TLD .build is different from the site's .cloud!
I don't see the same problem on external sites like tiles.immich.cloud. That has a CN=immich.cloud with tiles.immich.cloud as an alternative.
by jakub_g on 10/23/25, 12:16 AM
https://blog.chromium.org/2021/07/m92-faster-and-more-effici...
Not sure if this is exactly the scenario from the discussed article but it's interesting to understand it nonetheless.
TL;DR the browser regularly downloads a dump of color profile fingerprints of known bad websites. Then when you load whatever website, it calculates the color profile fingerprint of it as well, and looks for matches.
(This could be outdated and there are probably many other signals.)
by maltris on 10/23/25, 8:44 AM
There is no responses from Google about this. I had my instance flagged 3 times on 2 different domains including all subdomains, displaying a nice red banner on a representative business website. Cool stuff!
by a10c on 10/23/25, 6:57 AM
Makes precisely zero sense.
by your_challenger on 10/23/25, 2:09 AM
by almosthere on 10/23/25, 5:41 PM
by boobsbr on 10/23/25, 10:48 AM
YAML itself is cursed: https://ruudvanasseldonk.com/2023/01/11/the-yaml-document-fr...
by p0w3n3d on 10/23/25, 9:11 AM
by jstrong on 10/23/25, 1:14 AM
by scottydelta on 10/23/25, 10:30 AM
From their perspective, a few false positives over the total number of actual malicious websites blocked is fractional.
by gtirloni on 10/23/25, 2:16 AM
by jrochkind1 on 10/23/25, 5:29 AM
by ozgrakkurt on 10/23/25, 5:49 AM
by yabones on 10/23/25, 1:03 PM
Google Postmaster Console [2] is another one everybody should set up on every domain, even if you don't use gmail. And Google Ads, even if you don't run ads.
I also recommend that people set up Bing search console [3] and some service to monitor DMARC reports.
It's unfortunate that so much of the internet has coalesced around a few private companies, but it's undeniably important to "keep them happy" to make sure your domain's reputation isn't randomly ruined.
[1] https://krebsonsecurity.com/2020/08/why-where-you-should-you...
by donmcronald on 10/22/25, 9:46 PM
https://old.reddit.com/r/immich/comments/1oby8fq/immich_is_a...
I had my personal domain I use for self-hosting flagged. I've had the domain for 25 years and it's never had a hint of spam, phishing, or even unintentional issues like compromised sites / services.
It's impossible to know what Google's black box is doing, but, in my case, I suspect my flagging was the result of failing to use a large email provider. I use MXRoute for locally hosted services and network devices because they do a better job of giving me simple, hard limits for sending accounts. That way if anything I have ever gets compromised, the damage in terms of spam will be limited to (ex) 10 messages every 24h.
I invited my sister to a shared Immich album a couple days ago, so I'm guessing that GMail scanned the email notifying her, used the contents + some kind of not-google-or-microsoft sender penalty, and flagged the message as potential spam or phishing. From there, I'd assume the linked domain gets pushed into another system that eventually decides they should blacklist the whole domain.
The thing that really pisses me off is that I just received an email in reply to my request for review and the whole thing is a gas-lighting extravaganza. Google systems indicate your domain no longer contains harmful links or downloads. Keep yourself safe in the future by blah blah blah blah.
Umm. No! It's actually Google's crappy, non-deterministic, careless detection that's flagging my legitimate resources as malicious. Then I have to spend my time running it down and double checking everything before submitting a request to have the false positive mistake on Google's end fixed.
Convince me that Google won't abuse this to make self hosting unbearable.
by kazinator on 10/23/25, 8:28 PM
Just because it's your website, and you're not a bad agent doesn't prove that no part of the site is under the control of a bad agent, and that your site isn't accidentally hosting something malicious somewhere, or have some UI that is exploitable for cross-site scripting or whatever.
by amelius on 10/23/25, 10:44 AM
Instead, you should be able to install a preferred contentfilter into your browser.
by zerof1l on 10/23/25, 3:36 PM
Google flagged my domain as dangerous once. I do host Jellyfin, Immish, and NextCloud. I run an IP whitelist on the router. All packets from IPs that are not whitelisted are dropped. There are no links to my domain on the internet. At any time, there are 2-3 IPs belonging to me and my family that can load the website. I never whitelisted Google IPs.
How on earth did Google manage to determine that my domain is dangerous?
by TechSquidTV on 10/23/25, 1:29 PM
by timnetworks on 10/23/25, 11:35 AM
by stephenlf on 10/23/25, 3:58 AM
by ggm on 10/23/25, 1:19 AM
by XiphiasX on 10/23/25, 5:18 AM
by pharrington on 10/23/25, 5:29 AM
by throwaway-0001 on 10/23/25, 4:12 AM
by tjpnz on 10/23/25, 3:51 AM
Something Google actively facilities with the ads they serve.
by renewiltord on 10/23/25, 12:07 AM
0: https://old.reddit.com/r/immich/comments/1oby8fq/immich_is_a...
by shevy-java on 10/23/25, 8:32 AM
by nalekberov on 10/23/25, 6:03 AM
by lbrito on 10/23/25, 4:32 PM
At this point I would rather use an analog camera with photo albums than Google Photos.
by shadowgovt on 10/23/25, 3:14 AM
Correct. It works this way because in general the domain has the rights over routing all the subdomains. Which means if you were a spammer, and doing something untoward on a subdomain only invalidated the subdomain, it would be the easiest game in the world to play.
malware1.malicious.com
malware2.malicious.com
... Etc.
by sneak on 10/23/25, 12:38 PM
Google shouldn’t be a single chokepoint for web censorship.
by lucideer on 10/23/25, 7:00 AM
Google is an evil company I want the web to be free of, I resent that even Firefox & Safari use this safe browsing service. Immich is a phenomenal piece of software - I've hosted it myself & sung its praises on HN in the past.
Put putting aside David vs Goliath biases here, Google is 100% correct here & what Immich are doing is extremely dangerous. The fact they don't acknowledge that in the blog post shows a security knowledge gap that I'm really hoping is closed over the course of remediating this.
I don't think the Immich team mean any harm but as it currently stands the OP constitutes misinformation.
by stemc43 on 10/23/25, 10:37 AM
by inflames123 on 10/23/25, 2:02 PM
by dvh on 10/23/25, 4:13 AM
by yapyap on 10/23/25, 5:22 AM
They did a similar thing with the uBlock Origin extension, flagging it with “this extension might be slowing down your browser” in a big red banner in the last few months of manifest v2 on Chrome. After already having to upload the extension yourself to Chrome cause they took it off the extension store cause it was inhibiting on their ad business.
Google is a massive monopolistic company who will pull strings on one side of their business to help another.
With only Firefox not being based on Chromium and still having manifest v2 the future (5 to 10 years from now) looks bleak. With only 1 browser like this web devs can phase it out slowly by not taking it into consideration when coding or Firefox could enshittify to such an extent because of their manifest v2 monopoly that even that wont make it worth it anymore.
Oh and for the ones not in the know, Manifest is the name of a javascript file manifest.js that decides what browser extensions can and cant modify and the “upgrade” from manifest v2 to v3 has made it near impossible for adblockers to block ads.
by 31337Logic on 10/23/25, 11:43 AM
by Jackson__ on 10/23/25, 5:30 AM
The address appears to be adsense.google.com.
by shoelessone on 10/23/25, 12:58 PM
If you have internal auth testing domains at the same place as user generated content, what's to stop somebody thinking a user-generated page isn't a legit page when it asked you to login or something?
To me this seems like a reasonable flag.