PSA: Always use a separate domain for user content

Re:PSA: Always use a separate domain for user content by jeroenhd on Friday October 10, 2025 @12:12PM (#45540573)

The thing about Google is that they regularly get this stuff wrong, and there is no recourse when they do.

I think most people working in tech know the extent to which Google can screw over a business when they make a mistake, but the gravity of the situation becomes much clearer when it actually happens to you.

This time it's a phishing website, but what if the same happens five years down the line because of an unflattering page about a megalomaniac US politician?

[ Parent | on HN ]

Re:PSA: Always use a separate domain for user content by neon_erosion on Friday October 10, 2025 @04:59PM (#45543716)

Then that would be an example of a system having failed and one that needs to change. Instead, this is an example of a hosting company complaining about the consequences of skipping some of the basic, well-documented safety and security practices that help to isolate domains for all sorts of reasons, from reputation to little things like user cookies.

[ Parent | on HN ]

Re:PSA: Always use a separate domain for user content by gcr on Friday October 10, 2025 @06:18PM (#45544485)

This article shows an example of this process working as intended though.

The user's site was hosting phishing material. Google showed the site owner what was wrong, provided concrete steps to remedy the situation, and removed the warning within a few hours of being notified that it was resolved.

Google's support sucks in other ways, but this particular example went very smoothly.

[ Parent | on HN ]

Re:PSA: Always use a separate domain for user content by arcfour on Friday October 10, 2025 @10:42PM (#45546129)

> Oh my god, my site was unavailable for 7 hours because I hosted phishing!

Won't someone please think of the website operator?

[ Parent | on HN ]