Never buy a .online domain
0xsid.com
0xsid.com
This goes right to the top for me, along the ubiquitous "please verify your account" emails with NO OPTION to click "that's NOT me, somebody misused my email". Either people who do this for a living have no clue how to do their job, or, depressingly more likely, their goals are just completely misaligned to mine as a consumer and it's all about "removing friction" (for them).
I wonder if finding people responsible and spamming then with their own service emails would make the team care enough to fix this. But of course that's mostly dubious, probably illegal, and shouldn't be a responsibility of some vigilante hacker
When pointing out that legal parallels exist, to enact a solution, must I envision that solution?
Malicious in-attention then, by the profit driven org? :)
I constantly remove it whenever Gmail sends me the notification.
I can't help but think there is some method for the other person to steal my Gmail account if I never remove my email as their backup.
I hope it's because I have small simple email and not because they want to steal it.
“We’ll be right over.”
Later, after OP told the user and they failed to change their address, OP logged into the site and changed their password, putting an end to the spam they were receiving from the user’s actions.
I don’t have an ethical qualm with this. He didn’t want to sign up for the service. Someone else signed his email address up for it. Legally, I can’t imagine that being prosecutable.
I got divorced a decade ago, and every well-wishing person in my life was strongly urging me to do things which were shockingly counter-productive / dangerous / wrong, based on their confident understanding (assumption, really) of the law which was completely and dangerously inaccurate.
Hacker News audience is global. People start accounts for various purposes. Yet people still freely share the notion that logging in to some unknown website run by an unknown company from a hard to spell country and then touching things is universally safe.
I miss the old "IANAL" tag which at least provided basic warning and self-awareness :-).
Does it? So I can say, "I'm not your lawyer, but I'm happy to go ahead and give you specific legal advice on your case." and I can't be accused of illegally practicing law? I was under the impression that this could still get you into hot water. But not being your lawyer, due to the fact that I am not a lawyer at all, I don't know if it is true or not.
As with all things, who are you going to get in trouble with? And what's so magical about legal practice as opposed to, say, giving shitty medical advice or telling someone how to build porch? Asking genuinely. No one falls all over themselves to say "I am not a doctor, but...", even though their next words could kill someone. The implication is that they don't have formal training but they saw something on Facebook that you should try. What happens next is on you, not on them.
This is precisely why I’m pointing this out: IANAL is a very curious case of people self-labeling their statements as “not trustworthy for the topic”. I can think of perhaps no other cases where it is so popular to claim to not be a professional in the relevant field, which suggests that IANAL is a ‘badge of honor’ rather than a proper legal disclaimer. Certainly few (if any) claim IANAD before writing about their experiences with medical issues, body things, or nutritional supplements here, even though those topics are (as you correctly indicate) potentially lethal.
Thus, IANYL: if your goal is to ensure that the recipient of your advice / opinion / whatever does not have grounds to claim that you provided legal advice, and therefore are their lawyer, then you can either do so weakly with TINLA (“this is not legal advice”), which still leaves the door open for awkward claims by some desperate grifter-rando to reach a bench, or you can do so strongly with IANYL (“I am not your lawyer”), which closes that vulnerability in full.
Not once in years of using IANYL have I seen anyone else properly protect themselves from this vulnerability; meanwhile, “IANAL but” remains in use as a badge of honor. So, yeah, I don’t think anyone considers the particular avenue of vulnerability a serious threat, and yeah, the general context of IANAL here is prideful rather than protective. But after twenty years of dealing with a stalker who was adept at internet and tried to fuck with my job at one point, I do now tend to value closing off legal vulnerabilities with certainty, and as a bonus it doesn’t imply insult to the professions of law.
IANYL, YMMV :)
"It's OK: you can curse on the Internet." "Not when you're typing from Iran!" "Well, OK, if you're in Iran, don't take this American's advice for dealing with a government."
Part of our obligation as a reader is to consider what others are saying in the context of our own circumstances and experiences before trying to apply it. If you don't, and things end badly, that's on you.
But I stand on my words: I think it's ethically OK. You may not. That's alright. We're not required to have the same ethics or morals. And I don't think that's prosecutable. That's my opinion, based on my circumstances, not a statement of fact that applies in all jurisdictions around the world.
Above all else, I got tired of giving disclaimers about every single thing I say lest someone jump in with a "gotcha! scenario" I hadn't considered because it's not relevant to the context of the discussion.
Consider that the “imposter” starts uploading child porn or something, and it’s on an account registered to your address. I think it’s perfectly A-OK to tell the service that it’s not me using the thing and I want them to close the account someone created in my name.
Just include "not me!" In the verification email, dam it
Not jsmith, but kstrauser. Not Gmail, but Yahoo. And I still get banking docs, and HOA meeting minutes, and birthday party invitations, and Facebook logins, and other bizarre random stuff.
I have so many questions. I’ve typoed my address before and had to correct it. That’s understandable. But to wholly invent one and say, yep, that looks good even though I’ve never used it before, I’m sure it’ll be fine! I just don’t get it.
Some of the emails are really unfortunate stuff. "Your account was added as a backup address." - Then inevitably, a few weeks later, dozens of password reset emails. Sorry bud. I've received pay stubs. Orders and invoices. I get phone bills every month for someone in India. Its chaos.
Early on I'd sometimes reply to these random emails telling people they've got the wrong address. The most astonishing reply I ever got was from HSBC bank telling me I needed to come into the branch to change my email address. Over the course of a week, I explained about 3 times that that was impossible. That I live in Australia. That I'm not their customer, and its not my account. Eventually they told me they were disabling online banking on my account. Now I've given up replying at all.
Send emails into that pit of PII misery if you want. I don't read them.
They may well be looking for targets.
A few months later, the owner of the u/batman account added my mail as password reset mail.
I looked up the account. It was hardly ever used in 15 years, mostly for once in a blue moon dropping in a random comment role-playing as Batman. It was not obviously anyone I knew. It looked like they were basically inviting me to take over the account.
That was actually a bit tempting, but then the owner, whoever they were, would know who I was, and I still didn't know who they were.
(For that reason I've changed the name, it wasn't Batman, but it was equally "I can't believe you got THAT as your Reddit username" rare.)
So I clicked "this wasn't me" instead. After a few weeks the account was deleted by the owner. It seems they were willing to burn a 15+ year old account with a super-desirable (to many) name in order to get me back to Reddit, and then when I refused they just deleted it. That was VERY weird, and I wish I knew what was going on.
great way to phish people without looking like a malicious, obvious actor
instead they look like idiots or rubes and you get a little too curious, and in ways that might be considered malicious (and potentially illegal).
>You send it to johnsmith@gmail.com
>You receive a new message, it says "Hey, can you please stop using my email address?"
>You're johnsmith@gmail.com, you only know that's the address that's being used
PD: I know that if he resets the password he can get the other address, but this scenario was funny in my head.
I've had this happen several times... There's a lawyer I used for a dispute a few years ago, and they now have another "First Last" name that matches mine, and he keeps emailing me... my reply, "Wrong Michael, again..."
It's kind of annoying all around... I need to get off my butt and get a few things shifted, then just start relying on my own MTA again, instead of forwarding *@mydomain to my gmail to. I'll still wildcard the domain, but to a single mailbox on my own mta.
I'm not sure how bad the spam might get though... I've had a test account on my mta for a couple years and it hasn't really recived any... my wildcard accounts either... I use the wildcard so I can do things like walmart@mydomain, to see if/where an email address is sold/leaked from regarding spam.
I get TONS of emails of people trying to join services that use my address as a "fake email".
Way back I was working on a loyalty card system that had the entire UK electoral roll and Post Office data and we had to validate people; names and addresses. A "comedian" decided to sign themselves up for the system using a stupid name, and when the loyalty card duly arrived at their (correct) address with their (incorrect) name, they went to the papers and it became a slow news day human interest story.
We had to implement a Scunthorpe filter, and that was really difficult. We ended up with a human looking at the data and hitting a button if they thought this was a made-up "funny" name or address.
You would be amazed at English place names and surnames. Velvet Bottom is a real place in the UK. There are many people wandering around with names that you can't say in polite company.
We both get hit with "OG Hell," where people are constantly entering our emails. I think most time, it is accidental (maybe they meant "XXX1234", and forgot the number).
What makes it worse, is that Apple aliases mac.com, icloud.com, and me.com together, and there's no way to turn off one of the aliases.
mac.com is really in retirement. No one sets up new ones, but the miscreants typo icloud.com, which gets routed to me.
I have a rule, where I shitcan every mail to icloud.com, but I wish I could simply turn off the forwarder.
I do wish there was a requirement for some sort of "no" button that would stop sending sign up requests entirely.
I run a few websites that accept an email address (all noncommercial, I have no interest in spamming anyone). One of them is the "contact me" feature on my personal website. To prevent spam, I had people just put in their email address and it'll automatically email them my email address. This works perfectly to this day, haven't got a single spam email on any of the addresses I've handed out, but the ratio of emails sent out to received is probably 50 to 1. Why would anyone put an email address in there if not to contact me? I've been wondering if it's used by mail bombing services, idk if that's a thing but I know of the concept of annoying someone by signing them up for a hundred newsletters. My site doesn't send recurring emails, though, and it doesn't allow putting more than two email addresses per month in, per /24 IPv4 block (and even more strict on v6). It's useless for mail bombing services but the (presumed) bots keep submitting a steady rate of maybe 2 new email addresses per day, each time from a new ISP in a random country. No email addresses is ever submitted twice. No rhyme or reason to it. If anyone can make sense of this, that might help me in stopping the abuse
That doesn't prevent a huge majority of them from sending you notification emails all the time even if you never verify.
They can't just say "we don't want to deal with small timers who will not pay us big bucks doing nonstandard things" without pushback but they can write the policy so that a huge fraction of those use cases fall into some crack that can only be got out of by incurring the kind of expense that's a non-starter for those users. Your municipal code is rife with examples of this.
The people who create a system have some intent for it. The system may or may not effectively achieve that intent, may or may not outlive the initial conditions that surrounded its creation, and may or may not have side effects.
Purpose is something humans assign. It is sometimes linked to intent. A carpenter's hammer is intended to drive and pull nails, and that is often also its purpose. The purpose of the hammer I keep in my basement is breaking open walnuts.
The phrase is stating that the purpose we should assign to systems when judging them is their outcome, and not the intent behind them.
The classic example is a hospital for treating cancer patients. Suppose that one third of the patients are successfully treated, while the other two thirds die of their cancer. Is the purpose of the hospital to kill two thirds of the patients? Clearly not, but that is the outcome.
However, if the expected 5 year mortality for the cancer was 50%, and with this treatment 2/3 died, then the rule would apply. A choice to continue using that treatment could be criticized as equivalent to a choice to kill 1/6 more patients. Because despite the intention, the known outcome was more patients dying.
But no, the truth is that this hospital was built to provide jobs for civil servants <https://www.youtube.com/watch?v=x-5zEb1oS9A>. The purpose of a thing does not have to be related to the outcome.
how naive. most of the world work to survive, not because its their dream vocation. they probably dont care as much as you do
Relevant xkcd:
Yeah, I get the same regularly.
On the other hand... Occasionally someone gets my info because some careless person entered my email address into their system incorrectly. You'd think this problem would be solved by moving to a custom domain, but I still once in a while find someone completely ignore what I put into the form and sign me up as firstnamelastname@gmail.com.
I got hit by this from google.
1. Gmail added requirement for 2FA on my primary email address. Since I had no phone number on file, it instead used my recovery email address. Thankfully, I still had the password for my recovery email address, and could continue to (2).
2. Gmail added requirement for 2FA on my recovery email address. Since I had no phone number on file, it instead used by recovery's recovery email address. Thankfully, I still had the password for my recovery's recovery email address, and could continue to (3).
3. SBC Communications no longer exists, as it merged with AT&T in 2005. Email addresses at `sbcglobal.net` were maintained up until around 2021-ish, when they started purging any mailboxes that had been idle for more than 12 months.
Fundamentally, this was google's fault for misusing a recovery email for 2FA. Unfortunately, the only way to fix it would be to contact AT&T, asking them to pretty please update the email settings for somebody who hadn't been a paying customer for two decades.
Or yours, for not caring about 2FA. It's been a common practice for many years, and strongly recommended by most identity services, as well as OWASP and NIST recommendations.
What would you do in Google's place?
This probably doesn't comply with the relevant recommendations, but cutting a user of from their email is worse in my opinion.
If Google wanted to lock me out of my account for my own good until I enabled 2FA, fine. But as GP stated, they abused the recovery email addresses to force 2FA on people and ended up locking some people out of their accounts.
The rest of your complaints make sense but this one is bizarre. It's a recovery email, isn't having access to it the entire point? Like what else did you think it was supposed to be there for beside being accessible?
Google clearly misused it for something else, and you have a strong argument they shouldn't have. This one sentence just needlessly weakens the argument.
It was pretty sobering when Google demonstrated to me a new and novel way that made them the actual threat to my account security. I thought that by carefully refusing to publish anything with their add-ons (YouTube, Docs, Android Store, etc, etc) that I'd avoid getting swept up in an autoomated account-wide bannination, but, nope. A perfectly ordinary login to the account I'd had for years from the exact same location and IP address I'd used the day before was "suspicious" and required "recovery".
Best treat all org controlled email address as temporary.
Google is one of the rare places I actually see positive value to 2FA. Compare with say banks, where it being demanded actually decreases my security. But regardless, it should not be forced.
They certainly did a proper thing forcing people to use 2FA AFTER multiple emails over the years recommending to turn it on, and warning that they will enforce it, which they did.
Yes, some banks implement it silly, like SVB requiring biometric login in order to scan one-time QR 2FA code from their app (biometric login is less secure), but you don't have to use the QR code, can use regular 2FA without biometrics.
But even then having 2FA is 42 times better than not having it.
if you make an app it is not your customers responsibility to secure it with additional actions from their side..if it is, you need to make it mandatory and guide them step by step.
you cant after a while enable some toggle.and tell people to fuck off and its the fault of their ignorance to not know some technical details.
most consumers of these services dont know shit about IT and they should not be burdened with it..any product that demands it is either only meant for tech savy people or more likely lazily and badly engineered by money hungry people who see opportunity to make more money in user's issues.
That's why Google sent them multiple emails explaining what it is and recommending to turn it on. What else could Google do?
Is it possible that you use email differently than most people? I virtually never actually check my inbox. I'm either reading an email that I knew was coming (e.g. an order confirmation with a shipping link) or I'm searching for something specific. So no matter how many emails Google sends I'm unlikely to read them.
Once it became clear that they'd shifted from "crappy customer service" to (IMNSHO) "we fetishize the complete absence of customer service" it became dangerous to depend on them. Really, what's the worst that could happen? Maybe someone spams emojis in live chat on a game livestream at the request of the streamer on a personal account, it gets banned for abuse, Google recognizes that it's linked to other services and locks down everything? But that's so unrealistic I'm sure it could never happen.
It's not like they also have the ability to identify links between multiple accounts accessed by the same person and have automated processes that might stomp the associated accounts as well. Why, that would probably require something like allowing poorly-understood automated agents to take actions on their own!
While this would absolutely suck and I sympathise with anyone getting hit by this out of the blue, it's pretty clearly your fault, not Google's. What should they have done? Just permit everyone to avoid upgrading to 2FA indefinitely? That would result in relatively more account hacks overall, for which they would inevitably be roasted in the court of public opinion.
Google will insist on sending a notification to a phone you have no longer access to, and regaining access always feels like hacking yourself. I dread the day I lose a phone together with my SIM card and ID during travel. I will never be able to go back and will have to start a new life as an illegal immigrant, living as a hermit in some deep forest.
Yes. I've had online accounts for nearly as long as there's been an "online". The only time I've ever lost control of an account was due to 2FA.
2FA should always be optional for one's personal accounts. [0] People who can securely manage passwords simply don't need it. And if Organized Crime or Mossad wants access to my accounts, 2FA is not going to stop them.
[0] Corporate accounts and hardware are a different matter. You manage those however your employer commands you to manage them.
Even though you could say a person getting their 1FA account details phished is technically "their own fault", certainly to a greater extent than my HTTP example, spending the time understanding the issue well enough to realise that it was their own fault and not BigRichCompany's fault is not high on most people's list of fun things to do.
One of the requests was for a business card ... I haven't had a business card made with my name on it in 20 years.
The amazing thing is that I bet scammers working this system can get through this faster than I can.
At this point they should just give me control because no way would some scammer fail this much at this ungodly process.
I didn’t expect speed but what I’ve experienced has been what feels like bottom of the barrel outsourced support you get from some no name brand company….
This all helps make them immune from manipulation by "social engineering" or other forms of influence. But of course it also means they have virtually zero incentive to give a shit about the customer.
There are obviously many ways that they could improve customer experience, but giving them an incentive to do so, without opening the door to influence, is a hard problem.
Personally I think it should be the law that you can put up a bond to get to accelerate the process. Unfortunately the amount potentially at risk is probably larger than some customers accounts, at least at places like AWS where their services can trivially be exchanged for cash. So in many cases a bond would be over the customers means. But if any customers can afford it, it would provide a feedback path.
In the past when this happens I usually reset the password and change the email to some anon throwaway but I can't do that without Raymonds DOB (don't quote me on that, been a while since I tried).
After a few months, I told them I was concerned about the privacy ramifications and would have to report it to their state insurance regulator, and it was very quickly fixed.
Etc.
What would you expect clicking that "wasn't me" link to do?
In 99% of cases, the user who signed up with your address already can't do any more with that account unless you positively confirm it was you; and the site also won't send you any more email because they don't consider the email verified (and so sending to it might result in their emails getting sent to spam -> their email-sending reputation score going down.) So things are already in the state you'd want them to be in, no?
The only problem I can think of with that state is that now you can't sign up "fresh" for an account with the same provider, because now there's already an account associated with your email address sitting there in their DB in the pending-email-verification state. (But you still can acquire that account, by clicking "forgot/reset password" and going through that flow, which will inevitably go through your email, as anything like a 2FA setup flow always waits behind email verification.)
Netflix, for one, didn't do this. They kept allowing this guy to "resend his confirmation email" periodically over several months (I never had a Netflix account).
My theory is that it was an affiliate scam of some sort; someone probably got paid for everyone who signed up with his code. So he "signed up" thousands of random mails in the hope that some of them would click through on the "you're almost ready to start your Netflix journey!" mail and actually subscribe to Netflix.
I believe they included the “unsubscribe” link too…
https://tldrisk.com/beyond-basics/reclassification/
> This basically makes the entire TLD unviable for serious use.
It doesn't just make the TLD in question unusable. I think it makes most of the new gTLDs unusable. Registries can enact policies and systems like this, regardless of the detriment to registrants, due to a lack of oversight and registrant consideration by ICANN. That creates uncertainty and makes it pragmatic for registrants to simply choose the gTLDs with lots of history and precedence; .com, .org, etc..
The only two TLDs I'd personally rely on are .com (gTLD) and .ca (ccTLD).
.store .online .tech .site .fun .pw .host .press .space .uno .website
So, might as well to block entire TLDs and never buy a domain under those TLDs
Scam websites will use any TLD in my experience. Based on the ones that made it to my Google search results, .it and .info are the TLDs I should be blocking. When I search for "free roblox cash", most websites are .com. "Free robux" also brings forth a few .ca websites. "Free steam gift card" leads to .org and .com.
Aren't they only affordable for the first year though?
TLDs like .stream, .click, .top, and .link are cheap in general, even compared to .com
I use them when I need a random domain.
When I first bought an .online, it was not cheap
ad ads adult af alibaba alipay analytics anquan asia baidu
bar bcn bible blockbuster by cf cfd cg chintai christmas
citic click cloud cn coop country creditunion cyou data
dish diy dm dot dtv dvr et feedback food forum fun gift
hiphop hiv hk hkt host icbc il in iq ir kfh kp ky latino
lb lifestyle link living locker lol love ly ml mm mo
mobile moscow mov music my nhk ni nz observer ollo online
ott ph phone pid porn press property pw quest realty
redstone ren rest ru sbs sex sexy shouji site sling
so sohu space st store su sy tech to top trust ua unicom
uno vana ve wang website xihuan xxx yandex ye yun zipEt voilà ... ! this is precisely the slippery slope I warned about a decade ago. The indirect censorship becomes direct censorship, defeating all the arguments about the morality of such a list. And:
> Not adding the domain to Google Search Console immediately. I don't need their analytics and wasn't really planning on having any content on the domain, so I thought, why bother? Big, big mistake.
Yet more monopolistic power to Google.
On the flip side of the coin I cannot get a site removed that is a blatant rip off of one of our websites being actively used for invoice redirection fraud.
Considering that getting a domain is a normal part of business these days, this kind of thing should be illegal. Not to mention, why does Google have any say in this?
Which likely is slow without a poke it's reasonable to base the decision on whats available.
That's just how reputation works.
Because keeping Google happy or at least not bothered is an existential priority for registrars
It’s not libel. Defamation requires a false statement of fact. Marking a website as “unsafe” is an opinion.
“unsafe” is a term that is both broader and more vague, so I would consider it opinion unless backed up by appropriate facts (like “contains CSAM”, “contains malware”, and so forth).
Except when it isn't. CSAM may be easier to define and identify than pornography, but there still exists material that treads a moral grey area.
If the opinion is meant to be just another opinion, then it shouldn't cause any blacklisting of any sorts anywhere.
I agree with this! The registrar should not have triggered a suspension because of this. They're not obligated to, and the two processes should be decoupled.
No.
The source should be more careful. It's the equivalent of a renowned newspaper printing warning a restaurant being unsafe to visit. Should the customers' willingness to visit be magically decoupled from this opinion?
I'm not saying they should "ignore" reports of abuse but treat them as they are -- reports. They can then perform their own independent investigation.
That may well have happened here. I suspect the author isn't telling us something.
In other countries local TLDs are of course normal (e.g. .it for Italy, .za for South Africa, .cn for China...) and not only used for scam links.
No, it's not.
You're welcome to cite case law if you want to insist. Otherwise, unsafe (in the context of infosec) has a definition of likely or able to cause harm or malfunction. Something that is provable or falsifiable with evidence.
For clarity I'm not agreeing or disagreeing, but what means sense to the layperson (including experts in a particular field) is sometimes at odds with what the law says.
I reported a falsely flagged site repeatedly for weeks with absolutely no action from them.
Mozilla and Microsoft both did actually remove the warnings after the reports (Edge and Firefox stopped displaying the warning). Google did not. Google strong armed me into registering for google products, like a fucking bastard of a company.
This was the moment I went from "I don't love google anymore" to "Google can get fucked".
I wish them bankruptcy and every damn legal consequence that is possible to enforce.
"In addition to establishing that the defendant was aware of his statement's defamatory meaning, the plaintiff also must show that the defamatory statement is false. The falsity requirement has evolved gradually through a two-step process. Initially, the courts recognized that truth was a defense in a defamation suit. With time, however, the burden of proof on the issue of the statement's truth or falsity shifted to the plaintiff, so that now a statement is not actionable unless it can be proven false."
https://scholarship.law.wm.edu/cgi/viewcontent.cgi?params=/c... (pp. 851ff).
If a typical page can be shown to be prima facie safe to well formed parsers, without obvious shell code. It would require a response if there was additional evidence google was using in their determination.
What you can't do is imply non-public knowledge, aka "I heard from my cousin who works in law enforcement that Kyle murdered a hobo when he was 12 but the records were sealed", or state specific facts that can be proven true or false: "Kyle murdered a hobo on September 11, 2018 out back of the 7-11 in Gainesville, FL"
The standard for libel/slander is much, much higher than people think. It's extremely difficult to meet them, and for public figures, it's almost impossible.
That's ... not quite true. I wouldn't go that far.
1A rights are construed really broadly. The courts don't do the 'he wasn't legally convicted therefore it's illegal to call him one' thing.
The First Amendment doesn't protect the speaker against all forms of defamation (though it does put some barriers up that make it harder to win in some circumstances). If it did, defamation as a cause of action wouldn't exist at all.
As a practical matter, though, this is largely theoretical. Once you've been through the rigamarole of arrest, prosecution, and trial, even if you're found not guilty of the crimes committed, the reputational damage is just too widespread. You're not going to go after the defamers: there are just too many, and if you tried, there would be a fair question as to whether you have any positive reputation left to injure. Your life is pretty much ruined. It's a pretty terrible situation for the wrongly accused.
For one, it's an opinion, and traditional journalism likes to pretend it doesn't have those.
The bigger reason is anyone can sue for anything in the US. Litigation can be ruinously expensive, and cost hundreds of thousands of dollars just to get it thrown out. Hundreds of lawsuits gets expensive, even if you win or hand out $25K "get lost" settlements.
(That's why SLAPP laws are so important -- a strong SLAPP law like CA kills this behavior)
Whether or not something is prudent behavior has nothing to do with legality.
Fuck Google.
This is absolutely libel. They put a big fucking red banner on top of my site, telling the world that it's unsafe, using all the authority they have as one of the largest tech companies in the world.
In my case - it was a jellyfin instance I'd stood up to host family videos of my kids for my parents.
It was not compromised, and showed only a login page. I reported it as a false flag repeatedly, for weeks, with Google doing jack fucking shit.
Only after signing up in their search console and registering the site did the warning disappear.
They are abusively forcing people into their products. Fuck Google.
In case it wasn't entirely clear - Google can get fucked. Fuck Google.
> Libel is the publication of writing, pictures, cartoons, or any other medium that expose a person to public hatred, shame, disgrace, or ridicule, or induce an ill opinion of a person, and are not true
They literally show a giant red banner to every user of their browser that tries to access my site, calling me unsafe. Which is factually incorrect, and absolutely induces a negative opinion.
There's nothing on my site except a login page, it wasn't compromised, and it wasn't available for public access or registration. They can't "opine" on safety - it's just factually incorrect.
Convenient for them that the only way to resolve the issue is to sign up for Google products, though. Wonder how that works...
---
Next you'll try telling me that calling someone a cheat is also just an opinion, but it's standard legal libel.
I dont care if their pre-LLM ai says "thingy bad". They are responsible for the scripts or black boxes they control. I dont care if they dont give a reason.
Claiming bad/malicious/etc site is 100% libel. And doubly so, anybody who has been forced to agree to a ToS with binding arbitration should have it removed for libel.
No it isn't. https://www.law.cornell.edu/wex/defamation
Please, use words correctly.
> a plaintiff must show four things: 1) a false statement purporting to be fact; 2) publication or communication of that statement to a third person; 3) fault amounting to at least negligence; and 4) damages, or some harm caused to the reputation of the person or entity who is the subject of the statement.
They falsely marked the site unsafe[1] on a published list[2], the results weren't checked and couldn't be appealed[3] and OPs site was taken down[4].
Opinions and facts in a legal context usually comes down to who is saying what. Someone personally says "this soup is bad" on a review site = opinion. A news site plastering it on their front page = fact.
A person saying something as an individual is usually considered an opinion. A company doesn't have that same protection.
In the US, it really doesn't matter who says it, the only thing that matters is who it's being said about.
If you are a "public figure" -- which is a much broader category in 1A law than you think -- then in order to prove defamation, you have to prove the thing was false _and_ that the person saying it knew it was false at the time. Not that they were mistaken, not that they were careless, not that they knew later, they deliberately lied and knew they lied as they said it.
If your next question is "how do you prove what someone was thinking", then yes. That is the reason it's nearly impossible.
Opinions (Protected) vs Facts (Not Protected)
Defamation cases where individuals say something are usually considered opinions and companies are usually considered facts in the eyes of the courts. I say "Usually"
Defamation also DOES NOT require intent, but it requires a minimum level of fault (negligence)
Google saying something is unsafe in the web search or browser would not be considered an opinion because of their position of authority. It would not even be a debate since Google has already said they make decisions based on facts and data presented to them.
The only question is are they negligent in their assessment or response to a false report. And what would be the damages. In the case of a phishing report that is false courts would already consider it defamation per se (damages presumed)
Everything the Supreme Court rules is an "opinion." And they're the ultimate arbiter of legal questions in the U.S.
Whether a statement is a fact and whether the person who said it is considered an "authority" or not are independent concerns.
And we are also 100% talking about public figures. "Public figures" include companies and it's a critical part of 1A since Times v Sullivan.
Google is a US company and has 1A rights. That's how it works. The rest of what you said is nonsense and is your idea of how it should work, but has nothing to do with how it actually works.
Whom are you quoting here? A court opinion?
Libel suits can be financially catastrophic, so even a tiny false positive rate could present risk that disincentivizes producing such software at all.
And a threat detection mechanism that has a 0.0% false positive rate is conservative to the point of being nearly useless.
In other words, if you can't deal with the false positives in a timely manner. You SHOULD be liable for the damages.
I can't build a budget car put together in an unsafe manner. Then complain I can't compete due to all the peoples cars crashing and blowing up and suing me.
Scalable systems need to use heuristics to catch threats. Needing concrete evidence in every case means that an enormously higher amount of malicious resources will not be flagged.
There is a policy argument as to the right balance of concerns here. But there is a clear trade-off to make.
Giving everyone a fair trial just doesn't scale. It costs too much.
"Your Honor, we banned this person's website because his web page contained the word 'bitcoin' more than 5 times" will not hold up.
"Your Honor, we banned this person's website because it contains a bitcoin miner script. See, here is the script, and it matches the hash value found in these other attacks" hopefully holds up.
It’s not libel. Defamation requires a false statement of fact. Marking a website as “unsafe” is an opinion.
I get that's mostly what corporate lawyers argue about, but it's functionally dishonest in this case.
The problem is that these gatekeepers of the internet respond to false statements of facts/opinions by so called professionals.
I had cloudflare mark a worker as phishing because a AI "security company" thought my 301 redirect to their clients website was somehow malicious. (url redirects are normal affiliate things)
If the professionals don't understand the difference and cloudflare and google blindly block things, this is scary.
That is more than an opinion. Chrome has a monopoly and should act accordingly. Blocking entry to a website should be a last resort, not just because someone didn't add their website to the whitelist.
I use Ubiquiti as an example for an update they pushed to their UniFi systems a long time ago (5+ years). Some people were configuring their devices to use an https URL to connect to a management console when it was supposed to be http. Before the update, the console accepted http on the https port. After it didn't. That caused devices to disconnect from the management portal and remain offline.
When people complained, Ubiquiti said they realized it would happen, but it "would only affect a tiny percentage of customers." However, most customers that were affected had a 100% rate of failure. One person had something like 600-700 devices that got disconnected and required manual reconfiguration.
A 1% failure rate might be ok for the company, but it shouldn't be if the 1% of people affected suffer 100% failure. The distribution of the failures needs to be considered.
I had my primary domain that my entire family has used for 25 years put on that blacklist. If I hadn't been able to get it removed it would have had a massive negative impact on my life. Had it been suspended by the registry the way the OP of this article describes, I'm not sure how it would have worked out.
So it may be a false positive of .0000000001%, but would have ruined my life. I have 900 entries in my password manager and probably half of them are tied to that domain. Is my entire digital life acceptable collateral damage? Is yours?
I don’t mean to say your experience isn’t real and that you didn’t suffer some inconveniences. But come on, have some perspective.
And what did you do to get put on that blacklist, anyway?
Same with if they become aware of defamation and fail to retract and make a statement. But newspapers will generally also thoroughly investigate themselves to make sure what they are publishing is true.
"21(1) Parties to Offence: Anyone who actually commits the offense, aids in committing it, or abets (encourages) someone in committing it is a party to the offense."
I work in a law firm but NAL. I could probably find some cases if I had time. Most of the responses from people saying defamation is not very successful and "good luck" in the us because of 1A seem strange to me also.
I’m not sure you got the law right. “Abetting” does not mean encouragement. And the code itself does not have “(encourages)” in parentheses in it. The text of the code is right here: https://www.statutes.ca/r-s-c-1985-c-c-46/21
Since you work in a law firm, maybe you should ask your colleagues.
Perhaps spend less time picking apart comments and trolling on the internet if you do not know the definitions of words?
https://www.merriam-webster.com/dictionary/abet
1 : to actively second and encourage (something, such as an activity or plan) abet the commission of a crime 2 : to assist or support (someone) in the achievement of a purpose The singer was abetted by a skillful accompanist. especially : to assist, encourage, instigate, or support with criminal intent in attempting or carrying out a crime —often used in the phrase aid and abet accused of aiding and abetting a criminal
abet implies both assisting and encouraging.
And further,
https://nprobinson.com/blog/parties-to-an-offence-in-crimina...
Who Is Considered a Party to an Offence? Under s. 21(1) of the Criminal Code, you may be considered a party to an offence if you:
Section 21(1)(a) Committed the crime yourself (the principal); Section 21(1)(b) Assisted someone else in committing it (aided); Section 21(1)(c) Encouraged or promoted its commission (abetted).
I won't put quotes around the words this time.
You mean you had an LLM write it. This is the second time you’ve done that in this conversation. Please stop. It’s giving you incorrect or misleading information. Bona fide lawyers are finding themselves subject to disciplinary action for relying on LLMs, which have been found to falsify law and cases: https://www.reuters.com/legal/government/us-appeals-court-or...
Please, I beg you, go talk to your colleagues instead of armchair lawyering here. The law does not always adhere to dictionary definitions. It has been interpreted over the centuries and courts follow those interpretations. Besides, “Encourages” is a different word than “abets,” and merely offering support in the verbal or spiritual sense is very unlikely to lead to prosecution and conviction. If you can find a single case in Canada where this has happened, show us the proof.
I’m not “trolling,” I am a lawyer myself with 3 years of formal training, a Bar license, and decades of continuing education.
If you give me the number of your law firm, I will gladly call them myself.
I highly doubt you are a lawyer.
The external people treating these lists as absolute truths and automatically taking domains down are the ones at fault here. Google didn't grab power, Radix gave it to them without asking.
What is to stop everyone from doing this blacklisting?
There is no incentive for adding false positives to lists of malicious websites.
Chrome is big enough that a website owner can't afford a false positive on their malware list, just like they can't afford to have all their email end up in spam for all Gmail users.
Due to their near-monopoly Google also has no incentive to avoid adding false positives to their blocklist - provided they don't accidentally block high-profile targets. And if a CxO is screaming over your shoulder that your website has been blocked, arguments about "false positives" aren't very compelling: they'll just demand you move off the "shitty basement provider" and switch to "proper hosting, like the Google Cloud"...
that whiny bullshit about somebody elses website? you dont have to rely on a website or app. either you need their monopoly because you cant do it yourself, or you have options.... in both cases the whining is not needed
Spyware filters used to boast about how many domains they filter out because they wanted you to buy their filters instead of someone else's. By the time they hit a false positive, they've already sold a year's subscription to that customer.
The incentives are different.
Step 2: Alter filters to mark newly-registered domains and low-traffic websites as "potentially harmful".
Step 3: Charge a lot of money for "business verification" - which gives them a fancy badge somewhere and incidentally makes their website trustworthy in the eyes of your filter.
Step 4: Profit!
The Big Tech cartel has been doing this pretty successfully with email (see the weekly "Don't self-host your email" posts), why should we assume they are doing anything different with browser-based website blocking?
Indeed. I was going to register an account somewhere the other day, and the signup form had a list of acceptable email domains. Gmail, Protonmail, Outlook, Yahoo, Icloud... a few others. It's not the first time that's happened to me. Sad.
EDIT: Didn't even include Fastmail, who's pretty big after all. They host MX for my domain, so I could have "circumvented" it that way with their disposable address feature, but nope.
Yeah, sounds like a great cartel idea, if they actually did that. None of my domains ever got marked as potentially harmful, even the one that I bought as a joke because it would be so easy to turn it into a phishing site.
Not everything is a big conspiracy to oppress the population. We hear about the cases where it goes wrong because the HN front page is the fastest way to reach the single part-time support person Google seems to employ.
There is also the headache of PR issues when they get a false NEGATIVE. “Google didn’t protect grandma from this scam website!”
- They make almost all their money on advertising
- They have deep ties to the US intelligence agencies (To the point that a Google employee managed the appointment calendar for our Secretary of State a few years ago!)
So, how would these incentives apply to their Internet blacklist?
- If you are parking lots of Google ad spam, they are taking a cut of your revenue, so they have an incentive to take you off the list (evidence and testimony from the antitrust trial documented ongoing fraud in every layer of Google's vertical ad monopoly)
- If you are hosting something the intelligence agencies dislike / are neutral to / like, that'll impact your presence on the list.
It doesn't really matter that it's Google. It could have been Microsoft, or PAN, or McAfee or some fly-by-night vendor. The problem was Radix taking the list as iron-clad truth and disabling the domain without any notification or way to resolve the issue.
What Radix does has no impact on Google, and I don't see how Google would be incentivized to pressure Radix. So I don't see how to make the leap blaming Google for Radix's incompetence. Yes, Google should recognize the risk of this happening, but they'd have to balance that against the rewards (or at least what they consider rewards)
I had my main family domain put on Google's safe browsing block list and it has a massive impact. No one can visit the site. I think apps using system browser runtimes (ie: mobile) may stop working. I've seen reports that it can impact email deliver-ability. And, now, we see that it can get your domain put on serverHold so the problem becomes impossible to rectify.
Google should have to pay for the damage. In my case, it was about 4h of work to figure out what was going on and how to fix it, so not much, but I've seen small businesses that rely on their primary domain to drive most of their sales via web and email. In those cases, having your domain placed on server hold because of Google's false statements can have a serious, detrimental financial effect.
But my point is that any knock on effects like domain suspension, email deliver-ability, etc. stem from 3rd parties misusing the safe browsing list outside the scope of safe browsing.
I don't see how Google can be blamed for other companies erroneously treating the safe browsing list as a source of truth for generally malicious domains
Google should not have known that someone would misuse their block list to block domains. But now that someone is misusing their block list to block domains, if someone brings it to their attention, the next time this happens, they will have known it.
I am not a lawyer, I am not your lawyer, and this is not legal advice.
That's fair and I agree. My opinion is that both should be liable in a case like this. If I had to attribute it, my starting point would be that Google is liable for the loss of website traffic and the registry is liable for the loss of email and all other lost services due to the domain suspension.
It spirals though because, like you pointed out, no one forced (ex:) Mozilla or Apple to adopt the blacklist. They did that voluntarily, so they should be responsible for their share. That's why nothing ever gets fixed. It's broken, but there's so much potential for finger pointing that no one gets pinned down and held responsible.
The answer is always the same IMO. Break up big tech companies into a million little pieces.
I totally agree, but if I went after every company I felt to be incompetent to the point of criminal negligence I'd be up to my eyeballs in lawsuits just over password requirements.
> The answer is always the same IMO. Break up big tech companies into a million little pieces.
Generally I agree, but in this case I think there's an even simpler solution: 1) hold Google accountable for entries in their safe browsing lists (as an adjacent poster pointed out, the legal precedent may be there) and 2) make companies legally liable for misusing 3rd party data.
Really just the second part would suffice, and frankly it's purely good for society. The inevitable outcome is that no one exposes data they can't guarantee, and maliciously consuming 3p data would nearly disappear
"See details"> "ignore the risk" works for me. Even Chrome lets you ignore the warning if you click the details button. That's not the problem, though; the problem is that the registrar decided that the browser warning ("something might be wrong") as proof of malice (took down the domain entirely).
And Google has the right to publish a list, there should be more lists not less. But Google was at fault for not correcting their blacklist. Until the article appeared on Hacker News, this was not 0% on Google. A small, correctable mistake, but they deserved a tiny bit of blame.
If all it takes to be taken from the blacklist was to temporarily delete the NS record - the list would be useless against malware.
What stands out to me:
> Earlier this year, Namecheap was running a promo that let you choose one free .online or .site per account.
I wouldn't be surprised if most of Namecheap's customers who used the "register a domain for free" discount were indeed malicious. Without seeing the results of whatever analysis Google did to flag this website, it's hard to say whether Google is at fault here.
I had the same experience while buying another TLD. For ~1 month, certain people whose ISP "helpfully" had "safe browsing" features, simply blocked us outright. For being new and different.
The learning for me was that new domains are no longer trusted, and seemingly some vanity domains get even more strict treatment.
For a while I noticed all the scam links my grandmother was getting were from ‘.top’ domains. I fully blocked it at the DNS level. Her DNS settings also block all newly registered sites for 90 days. She hasn’t ever had issues with it. But these have actively prevented her from clicking on scam links multiple times.
Facebook, google, and all the popular sites are all older than 90 days, on popular well known TLDs. My grandmother doesn’t seek out new trendy sites.
It was definitely something I considered when buying a new domain. I sorted by price, and then immediately ignored all the cheapest domains that were ~$1 because I’ve seen them being used for scams. They may be cheap but good luck using them.
There are lots of domains out there other than .com that are just fine.
Free is good, but sometimes it's not.
If you plan on building a legit site, do not use any of these cheap TLDs.
I know someone with a .org domain, and even they have a ton of issues with false flags on their emails due to not coming from a big email provider. They’ve been blacklisted a couple times and regularly get flagged as spam. I’m surprised he hasn’t given up after dealing with this stuff for 25 years.
These new TLDs, I thought, were supposed to open up more options for regular people to get a domain that is semi-decent. Instead they’re essentially useless. Some of the prices are also still insane, due to assumed “premium” status or domain squatters.
There has to be a better way to police this stuff.
I see a lot of .fr, .de, .jp (and many other European ccTLDs) used by people from those places for their hobbyists/small projects/individual purposes. The regulators and operators of these domains tend to be pretty decently reputable. They often require proof of either local residence/citizenship or local business, which keeps domains more available, at the cost of requiring you to hand over some identifying information.
Now for whatever reason, I don't really see the `.us` one in use at all, so that is potentially a big exception to the initial premise for people from the US. I presume that its due to combination of it being operated by GoDaddy and the fact the `.com` and `.org` are sort of defacto US ccTLDs..
We struggled a lot when we opted for the .online domain for https://pinggy.io urls
> Not adding the domain to Google Search Console immediately.
I don't understand. What is Google Search Console, and should I add all my domains there right now?
You can also request Google to index your site on GSC as well.
You should probably add your websites to GSC.
Was called webmastertools before.
But if you do - you would get some notifications from Google about that website/domain.
I've only ever seen emails of the "There's an increase in 4xx/5xx errors on site/page(s)"
Google's way of tying real identifies of people to domains, without making it explicit.
Basically, your domain will be weirdly treated by a bunch of entities, none the less Google themselves, if you don't add your domain there (or some other Google property).
Especially with less common TLDs, like .online, they really want to be able to tie it to some identity, so unless you add it there, eventually your domain ends up on some sort of blacklist, in the case of the author it seems they used the "Google Safe Browsing" blacklist to get the author to involve Google somehow.
And yes, you probably should, if only to pre-register your ownership thereof if google ever decides to nuke you from orbit
I'm not particularly familiar with SEO or the massive black box that is Google Search - is this really as critical as the author makes it seem? I have both .lol and .party domains, both through porkbun (and the TLDs seem to be administrated by Uniregistry and Famous Four Media, respectively), and both are able to be found on Google Search. It seems like this preemtive blacklisting would be the result of some heuristics on Google's end; is .online just one of the "cursed" TLDs like .tk?
It is critical in the sense that if you want to appeal the decision in a case like this, it will go much better if you pre-verified that you own the domain.
(I don't think it has much effect on google search placement at all)
I've also never added domains to Google Search Console and haven't had blacklisting issue other than with a free .ml (another "cursed" TLD) site that was by default assumed to be spam by Facebook Messenger.
It's unfortunate that this category exists, but I don't share the OP's .com purism; I've used a mix of TLDs and even the cheap ones like .fyi and .cc haven't come under extra scrutiny as far as I can tell.
That should be enough to trigger an antitrust case against Google and a split of its activities. When despite unrelated, it becomes the gatekeeper of your presence in internet.
Safe Browsing itself has an appeal process so I think legally they're covered. Users and governments surely appreciate someone filtering bad actors online, even if casualties don't.
The moment that 80%+ users go to internet through their browser but at the same time control which we site can be accessed with their safe list.
The moment that you need to create an account and start using their services and accept their terms and conditions to be removed from wrongfully added "list" impacting someone.
Want to set up a new domain for whatever purposes (conference, new product, etc)? Be prepared to spend the first half a year fighting the various blacklists before people can actually reliably connect.
Would make so much sense if you could just have a .well-known/other-domains.txt (or something something DNS) with a list of domain names that should be considered just as trustworthy as your main domain.
It's not even about .online or other weird TLDs, it's just that the domain is new and therefore "not trustworthy". Even worse if you need to use your existing branding on the new domain - instantly flagged as a phishing site everywhere.
Alas, the .tech domain is quite popular.
https://www.spamhaus.org/reputation-statistics/gtlds/malware...
It said that https://aid.de was available. I was out of the moon happy (silly me) thinking that its such a good domain or something.
Then I saw aid.de available in namecheap for around 2$ ish but for some reason I took a bath and hten later it showed 10$ ish.
Okay, I then went to spaceship and it also showed me aid.de available. I then took my card and signed up
Well the transaction took place but got refunded. It said that there was an issue or something and got insta refunded
Silly me, thought that the payment had issues and decided to do payment again. This time though my refund had to wait 10 days to come back because of international laws.
Now I had only very little amount stuck btu I can see someone losing substantial money/having it stuck
I contacted their support and they told me that both namecheap/spaceship have a bug where some domains show available when they aren't.
I haven't checked but since the amount was like 1-2$ now but this whole thing really soured my relationship with namecheap/spaceship.
For context, before this, I also had a hate/love relationship with namecheap because once I bought a domain with them using crypto and also bought their vpn which was like 20 cents basically
It had auto renewal on and my domain costed 1$ but crypto payment requires 10$ minimum and the VPN charged me money from that.
Luckily I had spotted before the 2nd month and to be honest, like only 1 month 10 days or something and I urged the namecheap company to do what's right (in that moment because a lapse of judgement had been made from my side/error and I hoped that namecheap could realize it and do "right" instead given that the cost was only around 10$ fwiw)
After waiting for many days, they finally did what's right and gave me my credits back as a one off thing and I then turned off their domains.
I also used a crypto swap thing to convert b/w usdc and btc (what namecheap accepts) and I had an issue of doing two times payment after the timeperiod of btc payment (15 mins) but they also fixed that issue by adding the credits manually when I raised the issue.
Their customer support at times can be good but the platform itself is a little shady in my opinion. For the VPN thing if I remember correctly, the auto renew was written with grey and I genuinely didn't read it without my specs.
I am gonna keep my domain with namecheap that I have and if I get deals from namecheap/spaceship then use them, but for individual domains without deals, hell no.
I know that many people don't like the centralized nature of cloudflare but cloudflare is a good thing for domains :/
I personally just buy domains from wherever's there's a deal right now as some domains I have are some that I keep for only 1 year or similar.
To be honest, if I want to pick a domain-thing, I'd rather pick the one which is the cheapest or if not, then the one which only sells domains
I just looked at porkbun and they only sell domain related things and at best mail (they also have a deal with proton which can be interesting to many)
Porkbun is also cheap so I think I would recommend porkbun/cloudflare.
I haven't decided if I will transfer my domains from namecheap or not but their customer service is nice but the same can't be said for their service sometimes in my opinion.
Email isn't decentralized. Mastodon isn't decentralized. Matrix isn't decentralized. XMPP isn't decentralized. The web certainly isn't either.
All of them can be killed by Safe browsing. All of them can be killed by ICAN (which is under significant influence from the US government). All of them can be killed by their domain registrar and registry operator. All of them can be killed by Let's Encrypt adding their certificates to a CRL, and refusing to issue new ones. All of these will eventually be weaponized, when the war over who controls information truly begins.
> Anyone can be killed, my Lord!
So nothing is decentralized?
Somehow, Zoominfo picked up the site, and rated The Aetheric Message Machine Company as having revenue of about $5 million a year and, at peak, 24 employees. We had a back story for roleplay purposes, in the operating manual for the cosplayers.[2] Someone apparently took it seriously.
That was a fun project.
[1] https://vimeo.com/124065314
[2] https://aetherltd.com/public/othermanuals/operatormanual05.p...
The problem is the vanity domain registrar Radix using that as a reason to _put the whole domain on hold, including all subdomains, email entries etc._
This means:
- no way to fix accidental wrong "safe search" blacklisting
- if it was your main domain no mails with all the things it entails
- no way to redirect API servers, apps etc. to a different domain. In general it's not just the website which it's down it's all app, APIs, or anything you had on that domain
Google Safe search is meant to help keep chrome users safe from phishing etc. it is fundamentally not designed to be a Authority Institute which can unilaterally dictate which domains are no longer usable at all.
Like basically what Radix did was a full domain take down of the kind you normally need a judge order for... cause by a safe browsing helper service misfiring. That is is RALLY bad, and they refuse to fix their mistake, too.
You normally don't have _that_ level of fundamentally broken internal processes absurdity with the more reputable TLD operators (which doesn't mean you don't have that in edge cases, but this isn't an edge case this is there standard policy).
That's not me saying there shouldn't be a warning and a recourse, but the time-to-profit for domain abuse is really short so anti-abuse actions have to be quick.
Nor did I say anything about wanting a registry acting on it, it's just that the motivations and reasons are incredibly clear. At least to me.
And let me also reiterate that I clearly said that it should be a thought-out process and they haven't thought it out.
The only issue was the usual trap with all Namecheap domains: They tell you it's all set, and it works, until they randomly email you a week later asking for email verification. If you don't do that promptly, they suspend your domain until you trigger a resend. Which is easy to fix but also strange.
So yes, this appears to be a TLD- (or at least registry-) specific issue.
Also, go figure Namecheap works with these morons.
.store, .online, .tech, .site, .fun, .pw, .host, .press, .space, .uno, .website
not sure about other registrars
Sorry, can’t buy a frame.work laptop because that’s a “Malicious TLD”, according to the folks at ZScaler.
Also, some TLDs directly speculate on having very low prices for the first year or two, then 10x it on year 2 or 3.
https://prezkennedy.com/2026/01/15/the-free-domain-trap-the-...
> Freenom’s terms of service allowed them to “cancel” a free domain at any time without warning. Users reported for years that as soon as their free site started getting significant traffic (and becoming valuable), Freenom would reclaim the domain and fill it with ads, effectively hijacking the user’s hard work.
I suspect there is something the author is not telling us.
There are many of reports of the same happening to other sites, some of the top ones (you can find many more by searching HN for "google safe browsing"):
- https://news.ycombinator.com/item?id=33526893
OP says:
> no gore or violence or anything of that sort
That’s not even the right criteria. OP is confused about Google Safe Browsing vs Safe Search.
At this point, NEVER buy any radix.website TLD domains.
I am seeing pinggy had the same issue with their .online domain and this actually definitely caused hurt to their business https://news.ycombinator.com/item?id=40195410 (I saw this post from their comment in here referencing it)
In my opinion, .de , .ovh , .uk or personally my country's .in (yes OVH has their own TLD that you can use)
.de is one of the more interesting domains to me personally even though I am not german.
Considering .top domains have cheap registration and renewal. To me, it does feel as if .top are very speculative. I liked to search random things in tld-list to find unique-word.<any tld> so like random.top but my past experience says that .top domains are bought quite a lot/very speculative.
If possible I like .de but I think that .top are fine too. Both are great for what its worth.
> It however is falsely maligned by those with small brains who stereotype things.
I didn't know about this, can you please elaborate more about it?
Those with small brains who stereotype things often claim that .top is used only for scams, and that if a site is using .top, it means they're a scam site. In making this foolish assertion, they confuse P(A|B) with P(B|A). To continue, see the ChatGPT share 699f272e-475c-8012-ae9a-a89bd136fd01
> it does feel as if .top are very speculative
Sure, they can be, but again it's no reason to stereotype. They can be or become whatever they want to be.
We understand how frustrating it can be when a domain stops resolving unexpectedly. We’ve sent you an email with more details on what happened and the steps taken so far. We’re also reviewing this internally to understand why the domain was flagged and how we can reduce friction in similar cases going forward. We’re happy to continue the conversation over email and share any additional context if helpful.
Thank you.
I was price-gouged out of owning a single, rare .icu domain when renewal fee for it went from 20 usd to 220 usd overnight, just for this one domain... I'm pretty sure it's not Gandi, but the TLD opetator, because other .icu domains I've had were fine. I decided to eventually abandon them all anyway. Moved away from Gandi later when they started doing gouging of their own, too.
What is HN's opinion on Dynadot?
More than what Gandi is now? 100%
https://www.scaleway.com/en/domain-names/
Could be very interesting for the people who love/host on scaleway.
Scaleway is a good company fwiw imo.
Getting Google to index my personal site has been a pain. Every other search engine works fine, but ever since I switched the images on my site to .webp (a format created by Google!), my site's content just doesn't get indexed anymore. I've given up since web search traffic matters less and less these days with LLMs, and it only really bothers me when I'm trying to search for my own articles.
I use my older, much longer domain for email and identity (it used to be #3 on SERP for "Sid"). This one is just for giggles so I can blog in peace without affecting the main one.
I don't think that they could ban emails from .de for what its worth.
Personally I like .in domains too. Makes more sense to me because I am well Indian and we all use it quite frequently/sort of intutitively know fwiw but if I just want a domain for email purposes for cheap. Honestly, .de could be good.
https://tld-list.com/ [Try seeing the cheapest renewal rate with top level TLD and ignore .storage which costs 465$ for registration smh]
Some other domains like .top exist as well in this league imo but .de is one of the best if you can find a relevant domain in .de
It's quite possible that the domain you chose was registered previously and dropped because the previous owner misused it and burned that domain. The .ONLINE extension has been around for several years now.
And you have system and reputational damages.
Go for small claims suit, $5000. It'll cost more than that for their attorney to go to your jurisdiction.
it's not meant to have any other consequences
so basically what happens is that because of hearsay of google thinking you site is not bad Radix does what normally should involve a judge order (taking down the whole domain)
(1): Yes that still would cause damages on any site with customers, but like way less and way more fixable then what happened here.
(IAAL, but this is not legal advice. Consult a licensed attorney for legal advice.)
If I'm the only one with access to the site, they're calling me an attacker and saying that I might try to steal passwords, credit card info, etc.. If they're calling me an attacker, that seems like more than an opinion. Wouldn't they have to prove I'm a bad guy if they're asserting I'm a bad guy?
Similar issues to .io happened with the popularity of .tv domains, which again is a ccTLD. The government of Tuvalu sought to increase income from sales of their ccTLD and prices went up. Tuvalu is such a small nation .tv domain sales ended up making a significant part of the State's income.
Another fun example of the mess you can get into with ccTLDs was when the UK left the EU. All UK registered .eu domain names were cancelled following the UK exit from the bloc.
gTLDs generally have some degree of insulation from State-level politics. ccTLDs permit the nation or territory they represent much more say in how they are priced and who they are sold to.
Lots of good stuff in this thread I was not aware of. I have a few vanity domains with personal projects so it's not a big deal if they have low SEO but good to know going forward that I should be prioritising country domains like the Irish .ie one instead of 'fun' looking domains that are memorable.
If you were a lawyer, you could have fun with this.
Btw, perhaps unrelatedly, we had a domain marked as unsafe by Google as well for no particular reason.
Or don't want to pay a $2k ransom to a name squatter... For some businesses that is a rounding error (saas, other high volume high margin stuff), but for small businesses like restaurants or event planners, spending that much on a domain name would be foolish.
No thanks.
especially country level domains, they are not regulated and your register can ignore whatever requirements they have to fullfil
I wouldn't party too soon - from my experience getting something removed from Google's libel machine doesn't mean the same process that put it there in the first place is fixed and it you will most likely go through the same thing again and again.
> Not adding the domain to Google Search Console immediately. I don't need their analytics and wasn't really planning on having any content on the domain, so I thought, why bother? Big, big mistake.
This is just another way how Google has inserted themselves as the gatekeeper of the web.
At first I was stoked to have a two letter domain, but then I looked into it and learned these companies will get you hooked with a low initial price, then jack up the prices as the domain becomes established.
Quite the grift. My plan is to tread lightly on that domain and be ready to back away from it when the rent seekers move in.
You’d think there would be some sort of rules to the neutrality of these TLD administrators, but nope.
The second time around I wised up and go ogplus.net for an API domain instead of ogplus.media. I’ll take neutrality over vanity any day.
and if hectic maybe .io
How on earth we ended up with this company bother anyone including those that want their services? Imagine that you could get your driving license banned because you did not buy a toyota...
ftfy
.mil and .gov have always been too strict for ordinary folks though.
The bigger problem is the unbanning - for which there should be a better system, probably that should take the form of the registrar having a short grace period to aid in the Google stuff (DNS verification etc.) with additional checks by the registrar to make sure it's not being used for spam/malicious content.
The other point being why was Google banning you so quickly? This is the opaque part. Was the site reported? Was there some URL hijinks? That's the thing you'll probably never find out.
If the registrar tracks this information, a possibly helpful course of action would be to notify or warn the domain owner that they are on the list.
In the modern adversarial web, I do not want a registrar that proactively disables my domain because of some third party report.
The was my first thought as well. Yes, using the Safe Browsing list feels wrong, but I don't know enough to speak definitively in that regards. However wouldn't a relatively simple solution be that if a registrar is choosing to use some third party's list of banned DNS entries that the registrar then also implement sufficient unblocked components that will allow people to be unbanned from that third party?
> Add a DNS TXT or a CNAME record.
I haven't had a use-case for a TXT record come up yet, but isn't it low risk enough to allow domain owners to continue to configure TXT records even if the registrar wants to ban configuring other record types? Then the person in the article could prove ownership and could then get off of the third party ban list that the registrar was utilizing.
Now whether this downside justifies the massive problem it causes on false positives...
The registry only maintains a list of NameServers associated with the domain (and records for DNSSEC zone signing). Registries have nothing to do with regular records. They only record who defines those records.
Even google safe search isn't blocking you site per-se, it just adds a very annoying "this site is not safe" dialog you can "somehow" bypass (but most people wont and don't know how).
Like if this where the main site of a company (which it very much could be) this would also have taken down mail, all APIs, all Apps relying on such APIs.
so no this is absurdly unreasonable actions
that they seem to neither know nor care that this makes it impossible to "fix" false positives with google isn't helpful put this in the area of high levels of negligence which can get you into a lot of trouble in the EU