Back

Every time you use the word "hacker" when you mean "cybercriminal", "attacker", "malicious actor", you *personally* support this kind of bullshit.

Every time you use the word "hack" to mean "compromise", "break-in", "leak", you *personally* make it harder for a small community of creative people to focus on their projects, because now they have to go prove to Google they are not, in fact, attacking anyone.

And guess what, when Google Sites are used in phishing attacks — and anyone who does any #InfoSec work knows they do, a lot! — somehow the whole sites.google.com domain does not get flagged like that.

When Google Amp is used in phishing attacks — again, not a rare occurrence! — somehow Google Amp domains do not get flagged this way.

Flagging our site stopped exactly zero attacks. But now we have to send in reports and beg Google to maybe please unblock us.

And why is that?

Because over-blocking a website of small hackerspace is *cheap*. "No downside".

Because "hacker" and "hack" have been appropriated by those too lazy to be specific in their use of language when talking about "computer stuff." Also, it drives clicks!

Result? Some algorithm somewhere sees "hacker" and goes bananas: "danger, Will Robinson!"

So forgive me when in the future I react *badly* to some random toot mislabeling cybercriminals as "hackers".

In the meantime, if you want to help our small #hackerspace get our website un-blocked, go here and "report a detection error":
https://safebrowsing.google.com/safebrowsing/report_error/?tpl=mozilla&url=http%3A%2F%2Fhakkavelin.is%2F

And long-term, consider not abusing the h-word when you want to talk about cybersecurity. Even if it's a tiny bit more difficult at first because due to force of habit:
https://rys.io/en/155.html

I am so damn tired of having to prove, after a decade-and-a-half in #InfoSec, that I am not a one-man APT myself, ffs!

And if you happen to ever be in Reykjavík on a Thursday evening, come have a beverage with us.

Hopefully the site gets unblocked soon, we try to keep it up to date with the details of where we meet each week.

Oh by the way, this is what the site looks like (and yes, we will soon move away from the gmail address, because — you guessed it — #FuckGoogle).

@ploum Firefox also uses this. In fact, the screenshot of the warning is from Firefox.

@rysiek : no problem for me on your website.

The real problem being that Mozilla is more or less a Google subsidiary.

No easy fix to this

@ploum@mamot.fr @rysiek@mstdn.social They already removed it from the list, or at least it doesn't appear listed for me.

That's the one thing I'll give Safe Browsing credit for, at least they actually respond decently fast. ​​

@Codified @rysiek, but life inside #matrix (matrix.org) is so much better :P

@riskymanag3ment great to hear!

@bluszcz tak, wiem, dlatego im napisałem ten tekst. Po tym tekście trochę się w Oku poprawiło z używaniem "słów na h".

Technicznie rzecz biorąc sam jestem dziennikarzem piszącym dla Oko Press, więc ostrożnie z generalizacjami.

@rysiek haha ok, no bad feelings :P

@brianxlong no it wasn't. I've convinced ministries and media outlets to stop using the h-word when they want to talk about cybercriminals etc.

It's only lost when we give up. So this kind of defeatist bullshit is what *really* gets me going.

If you don't believe h-word can be reclaimed by the community the way other communities reclaimed other words, whatever. But what's the point, then, of even saying that?

Doesn't make you sound like a sage. Makes you sound like a quitter.

@AdamOnLinux @rysiek just thinking if we can beat them with their own tools. Can we use (hack) their report-mislabeling tool using (a new paid) Microsoft account, send email to it, and automatically "mark as not spam" to lower the score? (maybe send from different accounts from the offended domain to different accounts, rinse repeat)
I can even imagine a little collaborative platform to use different Microsoft accounts for that (imaginably frequently used o365 accounts work better).

@aimee @stux thanks! It definitely does.

@rysiek oh funny, I reloaded it three times, now I am getting the warning as well

@stux interesting. There is a Yunohost instance on that server, in fact, and some services on subdomains are managed by it.

@rysiek I keeo having the same issue with some of my clients servers

@stux seriously, time to start *invoicing* Google for time wasted on dealing with their fucked up ideas on what is and what is not "dangerous".

If they have no actual proof of malicious activity on the domain, they need to be forced to pay up.

Maybe then they will figure out how to tell a phishing site from a static HTML file inviting people to a meetup every Thursday.

@CauseOfBSOD @stux

> I like the sentiment, but content moderation is pretty hard, OK?

Google is one of the largest, wealthiest, most powerful corporations in the world. Surely they can get their shit together and not block a static website of a hackerspace, or a Yunohost login page. They don't get to play the "this is haaard" card, sorry.

@rysiek @stux They also deal with trying to moderate the entire internet.

You can’t do it by hand, and algorithms certainly can’t do it accurately. Even if you did it by hand, it might not always be accurate.

There is just too much content out there.

I think that overblocking sucks too - but with such a system, it is inevitable. This isn’t a problem where you can “nerd harder”, you are going to have errors that slip through. The only real way around it is to have a robust system for correcting false positives (i.e. not what YouTube does with Content ID).

The process definitely could be improved for a lot of Google’s content moderation, but short of outright disabling or drastically shrinking the scope of Safe Browsing, you are going to have overblocking. Even the EU can’t make a fully-functional copyright filter - and that is just one aspect of content moderation on the web. Google has far too much to deal with.

Anyway, if you haven’t seen it yet, you can report an error with Google Safe Browsing here.

@CauseOfBSOD @stux

> They also deal with trying to moderate the entire internet.

Nobody asked them to take this responsibility upon themselves, and I am not sure they should be the ones doing this in the first place.

Especially if they are doing it so badly.

And again, they do not get to play the "but it's haaaard" card. Especially when on the other side there is a tiny social club somewhere in Iceland that just had its website and services blocked.

@aerror @rysiek same. But then I don’t use Chrome (because it’s awful)