Google flags Immich sites as dangerous

Maybe a dumb question but what constitutes user-hosted-content?

Is a notion page, github repo, or google doc that has user submitted content that can be publicly shared also user-hosted?

IMO Google should not be able to use definitive language "Dangerous website" if its automated process is not definitive/accurate. A false flag can erode customer trust.

A website where a user can upload "active code".

The definition of "active code" is broad & sometimes debatable - e.g. do old MySpace websites count - but broadly speaking the best way of thinking about it is in terms of threat model, & the main two there are:

- credential leakage

- phishing

The first is fairly narrow & pertains to uploading server side code or client javascript. If Alice hosts a login page on alice.immich.cloud that contains some session handling bugs in her code, Mallory can add some cute to mallory.immich.cloud to read cookies set on *.immich.cloud to compromise Alice's logins.

The second is much broader as it's mostly about plausible visual impersonation so will also cases where users can only upload CSS or HTML.

Specifically in this case what Immich is doing here is extremely dangerous & this post from them - while I'll give them the benefit of the doubt on being ignorant - is misinformation.

It may be dangerous but it is an established pattern. There are many cases (like Cloudflare Pages) of others doing the same, hosting strangers' sites on subdomains of a dedicated domain (pages.dev for Cloudflare, immich.cloud for Immich).

By preventing newcomers from using this pattern, Google's system is flawed, severely stifling competition.

Of course, this is perfectly fine for Google.