Google flags Immich sites as dangerous

The one thing I never understood about these warnings is how they don't run afoul of libel laws. They are directly calling you a scammer and "attacker". The same for Microsoft with their unknown executables.

They used to be more generic saying "We don't know if its safe" but now they are quite assertive at stating you are indeed an attacker.

> The one thing I never understood about these warnings is how they don't run afoul of libel laws.

I’m not a lawyer, but this hasn’t ever been taken to court, has it? It might qualify as libel.

> They are directly calling you a scammer and "attacker".

No they're not. The word "scammer" does not appear. They're saying attackers on the site and they use the word "might".

This includes third-party hackers who have compromised the site.

They never say the owner of the site is the attacker.

I'm quite sure their lawyers have vetted the language very carefully.

I know of no such cases, and would love to know if someone finds one.

you only sue somebody poorer than you

This is tricky to get right.

If the false positive rate is consistently 0.0%, that is a surefire sign that the detector is not effective enough to be useful.

If a false positive is libel, then any useful malware detector would occasionally do libel. Since libel carries enormous financial consequences, nobody would make a useful malware detector.

I am skeptical that changing the wording in the warning resolves the fundamental tension here. Suppose we tone it down: "This executable has traits similar to known malware." "This website might be operated by attackers."

Would companies affected by these labels be satisfied by this verbiage? How do we balance this against users' likelihood of ignoring the warning in the face of real malware?

I worked for a company who had this happen to an internal development domain, not exposed to the public internet. (We were doing security research on our own software, so we had a pentest payload hosted on one of those domains as part of a reproduction case for a vulnerability we were developing a fix for.)

Our lawyers spoke to Google's lawyers privately, and our domains got added to a whitelist at Google.

The problem is that it's so one sided. They do what they want with no effort to avoid collateral damage and there's nothing we can do about it.

They could at least send a warning email to the RFC2142 abuse@ or hostmaster@ address with a warning and some instructions on a process for having the mistake reviewed.

Imagine if you bought a plate at Walmart and any time you put food you bought elsewhere on it, it turned red and started playing a warning about how that food will probably kill you because it wasn't Certified Walmart Fresh™

Now imagine it goes one step further, and when you go to eat the food anyway, your Walmart fork retracts into its handle for your safety, of course.

No brand or food supplier would put up with it.

That's what it's like trying to visit or run non-blessed websites and software coming from Google, Microsoft, etc on your own hardware that you "own".

"The people living at this address might be pedophiles and sexual predators. Not saying that they are, but if your children are in the vicinity, I strongly suggest you get them back to safety."

I think that might count as libel.

It depends, if it's a clear-cut case, then in jurisdictions with a functioning legal system it can be feasible to sue.

Likewise, if it's a fuckup that just needs to be put in front of someone who cares, a lawsuit is actually a surprisingly effective way of doing that. This moves your problem from "annoying customer support interaction that's best dealt with by stonewalling" into "legal says we HAVE to fix this".

i think it's more akin to "people may have broken in and taken over this house, and within the house there may be sexual predators"

You can’t possibly use the “they use the word ‘might’” argument and not mention the death red screen those words are printed over. If you are referring to abidance to the law, you are technically right. If we remove the human factor, you technically are.