Has this impacted your self hosted instances of Immich? Are you hosting Immich via subdomain?

Related:

top 67 comments

sorted by: hot top controversial new old
[–] 162 points 1 year ago (1 child)

Google, protecting you from privacy

  • source
  • hideshow 1 child comment
  • [–] 54 points 1 year ago (5 children)

    The URLs mentioned in their blog article all have a wrong certificate (different host name).

    I am sure if they fix it Google’s system would reclassify the sites as safe.

  • source
  • hideshow 5 child comments
  • [–] 13 points 1 year ago (3 children)

    I think that marking things as "safe" could have more complications than this depending on their definition but I think you're right that's probably all this issue is. This is almost the only sane comment here. Everyone else seems to be frothing at the mouth and I'm guessing its a decent mix of not understanding much of how these systems work (and blindly running tutorials for those that do self host) and blind ideology (big companies are bad / any practice that restricts my personal freedom in any way is bad)

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (1 child)

    any practice that restricts my personal freedom in any way is bad

    Yes? I don't want to live in a world where giant companies decide what I can and cannot see. And big companies are bad, they act as pseudo governments that aren't accountable to anyone, we used to break them apart before they started buying up politicians and political power.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    Agreed after the yes.

    I'm not sure how what you said either: justifies the comments not fitting that label; justifies that "any practice that restricts my personal freedom in any way is bad" is a practical ideology; or even establishes much a link between what you've quoted and what you've said. And I think you need to be doing one of those to be making a counter argument

  • source
  • parent
  • [–] 1 point 1 year ago

    I don't blame people for thinking that something is off after reading the linked blog post. This wouldn't be the first time Google does something like this to OSS that poses some kind of potential threat to their business model (this is also mentioned in the post).

  • source
  • parent
  • Yeah, sure, 5 years after google flagged one of the sites i hosted, some firewalls (including isp-level blocks) mark the domain as unsafe. Google removed the block after more than a week but the stink continues until today.

    It was also a development domain and we were forced to change it.

  • source
  • parent
  • [–] 70 points 1 year ago (1 child)

    Google

    I have identified the problem.

  • source
  • hideshow 1 child comment
  • [–] 57 points 1 year ago (1 child)
  • [–] 33 points 1 year ago

    Immich users flag Google sites as dangerous

  • source
  • [–] 12 points 1 year ago (11 children)

    Fuck you google. I can't see youtube videos with my browser because google wants me to sign in. Tells me it is protecting the community.

    BULLSHIT.

    Because google doesnt make me sign in to view or edit someone elses google docs they are sharing. Which one is more important google? Assholes.

  • source
  • hideshow 11 child comments
  • [+] 1 point 1 year ago (10 children)
  • [–] 2 points 1 year ago* (8 children)

    No, not age restricted.

    Happens most frequently with using any VPN, which we use all the time at work and I often use at home or while traveling.

    But sometimes it just does it without.

    I think most people are signed into their gmail account or have been recently so the cookie is set. It's crazy when you don't have one how hard Google pushes you.

  • source
  • parent
  • hideshow 8 child comments
  • [+] 1 point 1 year ago (7 children)
  • [–] 2 points 1 year ago* (6 children)

    How should I prove this to you then? You are wrong, it is not just age content.

    I could make a short video, or screen capture, but that's more effort than it's worth.

    I am telling you, this happens all the damn time and it's getting annoying.

  • source
  • parent
  • hideshow 6 child comments
  • [+] 2 points 1 year ago* (5 children)
  • [–] 1 point 1 year ago* (4 children)

    So weird you should argue about this. Do you always tell people "that doesnt happen to me so it doesn't happen to you". Why would I lie about it?

    Why are you such an asshole?

    This is my constant experience with youtube. which happened today while I was checking on the hurricane in Jamaica.

  • source
  • parent
  • hideshow 4 child comments
  • [+] 1 point 1 year ago* (3 children)
  • [–] 1 point 1 year ago* (2 children)

    All of this? What is this? Not believing people when they tell you something?

    And the most interesting part, like I said, was that it doesn't bother when it is google docs. So what is google protecting exactly? That is the main point.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 11 points 1 year ago

    Deadly to their margins by 0.000000000000000000000000000000000001%

  • source
  • [–] 21 points 1 year ago* (last edited 1 year ago) (3 children)

    Stop using google. Don't you know their motto? "Be evil"

  • source
  • hideshow 3 child comments
  • [–] 6 points 1 year ago (1 child)

    Easier said than done, if your end users run Chrome. Because Chrome will automatically block your site if you’re on double secret probation.

    The phishing flag usually happens because you have the Username, Password, Log In, and SSO button all on the same screen. Google wants you to have the Username field, the Log In button, and any SSO stuff on one page. Then if you input a username and go to start a password login, Google expects the SSO to disappear and be replaced by the vanilla Log In button. If you simply have all of the fields and buttons on one page, Google flags it as a phishing attempt. Like I guess they expect you to try and steal users’ Google passwords if you have a password field on the same page as a “Sign in with Google” button.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 7 points 1 year ago

    Firefox ingests Google SafeBrowsing lists.
    If you are falsely flagged as phishing (like I was), then you are fucked regardless of what you use (except you use curl).

    I couldnt even bypass the safebrowse warning on my Android phone in Firefox.

  • source
  • parent
  • [–] 21 points 1 year ago

    Google marks half the apps on my phone as dangerous. Google are evil xxxxxx's

  • source
  • [–] 36 points 1 year ago

    They've also started warning against android apps from outside repos. Basically they want to force people to use their ai-filled bullshit apps.

  • source
  • [–] 10 points 1 year ago (4 children)

    jellyfin had a similar issue too for a long time for servers exposed to the internet. google would always reblock the domains soon after unblocking them. I think they solved it in the latest update. Basically it's that google's scraping bots think that all jellyfin servers are a scam that imitate a "real" website.

  • source
  • hideshow 4 child comments
  • [–] 3 points 1 year ago (2 children)

    What is the usecase for exposing jellyfin to the outernet anyway ?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 1 year ago (5 children)

    Similar issues were reported with aves libre early this week, maybe it's related?

    https://github.com/deckerst/aves/issues/1802

  • source
  • hideshow 5 child comments
  • [–] 8 points 1 year ago (4 children)

    From the OP:

    Google Safe Browsing looks to be have been built without consideration for open-source or self-hosted software. Many popular projects have run into similar issues, such as:

    • Jellyfin

    • YunoHost

    • n8n

    • NextCloud

  • source
  • parent
  • hideshow 4 child comments
  • [–] 10 points 1 year ago (3 children)

    I'm sure it's all accidental and coincidental that open source project that rival Google just weirdly got flagged as being dangerous. Google also doesn't know how this happened, it just did! Magic!

  • source
  • parent
  • hideshow 3 child comments
  • [–] 11 points 1 year ago (3 children)

    this is why you disable google "safe browsing" in librewolf and use badblock instead

  • source
  • hideshow 3 child comments
  • [–] 5 points 1 year ago (4 children)

    Google flags F-Droid updates...

    Why would people have Google security going on if they have set up F-Droid as their appstore? Doesn't that defeat the entire purpose?

  • source
  • hideshow 4 child comments
  • [–] 1 point 1 year ago (2 children)

    Like I understand that if I buy a phone from Apple, and they control everything on the phone and what I can install - well I mean I bought it from Apple, what else did I expect?

    But I didn't buy my phone from Google. They should have no say in what I could or couldn't install.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (1 reply)
  • [–] 5 points 1 year ago* (1 child)

    Was also flagged recently.
    In my case it was the root domain which is

    1. Geofiltered to only my own Country in Cloudflare
    2. Geofiltered to only my country in my firewall
    3. Protected by Authelia (except the root domain which says 404 when accessing)

    So....IDK what they want from me :p My domain doesnt serve public websites (like a blog) destined for public consumption...

  • source
  • hideshow 1 child comment
  • load more comments (1 reply)
    [–] 4 points 1 year ago

    Hopefully your Immich server isn't public facing...

  • source
  • [–] 4 points 1 year ago

    I got a 'dangerous site' warning and then prompts for crap on my Vaultwarden instance (didn't see it on Immich but this was a while ago). I think I had to prove I owned the domain with some DNS TXT records then let them "recheck" the domain. It seems to have worked.

  • source
  • [+] 15 points 1 year ago (11 children)
  • [–] 11 points 1 year ago* (6 children)

    It is for pull requests. A user makes a change to the documentation, they want to be able to see the changes on a web page.

    If you don't have them on the open web, developers and pull request authors can't see the previews.

    The issue they had was being marked as phishing, not the SSL certificate warning page.

  • source
  • parent
  • hideshow 6 child comments
  • [+] 1 point 1 year ago (2 children)
  • [–] 0 points 1 year ago (2 children)

    It is for pull requests. A user makes a change to the documentation, they want to be able to see the changes on a web page.

    So? What that has to do with SSL certificates? Do you think GitHub loses SSL when viewing PRs?

    If you don't have them on the open web, developers and pull request authors can't see the previews.

    You can have them in the open, but without SSL you can't be sure what you're accessing, i.e. it's trivial to make a malicious site to take it's place an MitM whoever tries to access the real one.

    The issue they had was being marked as phishing, not the SSL certificate warning page.

    Yes, a website without SSL is very likely a phishing attack, it means someone might be impersonating the real website and so it shouldn't be trusted. Even if by a fluke of chance you hit the right site, all of your communication with it is unencrypted, so anyone in the path can see it clearly.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 1 year ago (1 child)

    Yes, a website without SSL is very likely a phishing attack, it means someone might be impersonating the real website and so it shouldn't be trusted. Even if by a fluke of chance you hit the right site, all of your communication with it is unencrypted, so anyone in the path can see it clearly.

    No, Google has hit me with this multiple times for sub domains where the subdomain is the name of the product and has a login page.

    So, for example, if I have emby running at emby.domain.com they'll mark it as a phishing site. You have to add your domain to their web console and dispute the finding which is probably automated. I've had to do this at least three times now.

    All my certs were valid.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    Yes, Google has miss reported my websites in the past, all of which were valid, but the person I'm replying to seemed to assume no-SSL is a requirement of the feature, and he doesn't understand that a wrong/missing SSL is indistinguishable from a Phishing attack, and that the SSL error page is the one that warns you about phishing (with reason).

  • source
  • parent
  • [–] 1 point 1 year ago (3 children)

    You could just host it inside your network and do an always on VPN. That's what I do.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (1 child)

    How would that work? The use case is for previews for pull requests. Somebody submits a change to the website. This creates a preview domain that reviewers and authors can see their proposed changes in a clean environment.

    CloudFlare pages gives this behavior out of the box.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago* (last edited 1 year ago) (1 child)

    Google Safe Browsing looks to be have been built without consideration for open-source or self-hosted software.

    IMO Google Save Browsing was built with consideration for open-source and self-hosted software, but it has nothing to do with user safety, just like blocking Android apps from 3rd party sites has nothing to do with user safety. The harder they make it to move away from their products by making using alternatives difficult, the more money they make and money is now the only objective. Even if this only adds a fraction of a fraction of a percent to their profit it's something Google will implement.

    The old social contract of businesses being of benefit to the community as a whole in addition to making a profit is long gone.

  • source
  • hideshow 1 child comment
  • 5 comments in c/technology@lemmy.zip view that post
    [–] 19 points 1 year ago

    Thanks for the recommendation on a FOSS Google Photos alternative. If Google blocks it that means it's good.

  • source
  • [–] 11 points 1 year ago

    Another way Google exploits their monopoly for personal gain.

    Good thing the government identified them as such and....did absolutely nothing about it.

  • source
  • [–] 7 points 1 year ago

    "Accidentally" lol the best of intentions, but this nuts.

  • source
  • [–] 3 points 1 year ago (1 child)

    The question that needs to be asked, "why are you still using Chrome?"

  • source
  • hideshow 1 child comment