Comment

Comment on We Know 15,579 Websites Are Infected. How Do We Tell Them?

Why not just send an email to every website?

I could probably try to automate that, but to what email address? I’d have to hit a selection of common ones, info@, support@, abuse@, maybe others?

I’d use “webmaster@”, which is a pretty long-running convention, though I don’t know how many people have it set up. I don’t know if there’s an RFC backing that.

source

Sort:hotnew top

Ooops@feddit.org ⁨1⁩ ⁨day⁩ ago
Another option is looking for the security.txt (toplevel or under .well-known/) of a site (that’s RFC 9116, which should have a Contact field with a mailto:<contact address> field (although tel:<number> and https://<contact information page> are allowed, too, although far less common).

source
- tal@lemmy.today ⁨1⁩ ⁨day⁩ ago
  Yeah, he mentioned security.txt in the article, but complained that few implemented it.
  
  I guess that even if someone who apparently does computer security isn’t familiar with it, that Average Joe probably has no idea. Maybe there’s an argument that there should be some sort of browser support for “report problem wirh this page/site” that sends an email to an appropriate address with an URL for the page and comment so that people are more aware of it.
  
  source
  - Ooops@feddit.org ⁨1⁩ ⁨day⁩ ago
    
    but complained that few implemented it
    
    Now that you mention it… I decided to check our lemmy instances and both lemmy.today and feddit.org have a robots.txt (or course^^) but no security.txt *sigh*
    
    Yours didn’t even bother to fill out the /legal page (which should also have contact information) although it’s a fixed part of the lemmy software with a link at the bottom of the site.
    
    source