←back to thread

Google flags Immich sites as dangerous

(immich.app)
1021 points janpio | 3 comments | 22 Oct 25 20:53 UTC | HN request time: 0.502s | source
Show context
aetherspawn ◴[23 Oct 25 03:36 UTC] No.45677908[source]▶
A good takeaway is to separate different domains for different purposes.

I had prior been tossing up the pros/cons of this (such as teaching the user to accept millions of arbitrary TLDs as official), but I think this article (and other considerations) have solidified it for me.

For example

www.contoso.com (public)

www.contoso.blog (public with user comments)

contoso.net (internal)

staging.contoso.dev (dev/zero trust endpoints)

raging-lemur-a012afb4.contoso.build (snapshots)

replies(2): >>45677924 #>>45678172 #
1. sureglymop ◴[23 Oct 25 04:28 UTC] No.45678172[source]▶
The biggest con of this is that to a user it will seem much more like phishing.

It happened to me a while ago that I suddenly got emails from "githubnext.com". Well, I know Github and I know that it's hosted at "github.com". So, to me, that was quite obviously phishing/spam.

Turns out it was real...

replies(2): >>45678710 #>>45678819 #
2. aetherspawn ◴[23 Oct 25 06:10 UTC] No.45678710[source]▶
This is such a difficult problem. You should be able to buy a “season pass” for $500/year or something that stops anyone from registering adjacent TLDs.

And new TLDs are coming out every day which means that I could probably go buy microsoft.anime if I wanted it.

This is what trademarks are supposed to do, but it’s reactive and not proactive.

3. jeroenhd ◴[23 Oct 25 06:31 UTC] No.45678819[source]▶
PayPal is a real star when it comes to vague, fake-sounding, official domains.

Real users don't care much about phishing as long as you got redirected from the main domain, though. github.io has been accepted for a long time, and githubusercontent.com is invisible 99% of the time. Plus, if your regular users are not developers and still end up on your dev/staging domains, they're bound to be confused regardless.