We Know 15,579 Websites Are Infected. How Do We Tell Them?

Comments

• originalucifer@moist.catsweat.com ⁨1⁩ ⁨day⁩ ago

  i once asked a colleague 'how do i tell the boss he just spent 500,000$ on the wrong thing?'

  the answer was hilarious to me; 'in an email'

  source

  • ryper@lemmy.ca ⁨1⁩ ⁨day⁩ ago

    I know the implication is supposed to be “Not to his face”, but if the boss a huge mistake it’s good to have some record (like an email) that you told him.

    source
• xxce2AAb@feddit.dk ⁨1⁩ ⁨day⁩ ago

  And this, right here, is why I don’t permit the execution of javascript by default.

  source

  • tal@lemmy.today ⁨1⁩ ⁨day⁩ ago

    Even here:

    github.com/LemmyNet/lemmy-ui/issues/1895

    Lemmy instances with custom emojis allow malicious Javascript

    nvd.nist.gov/vuln/detail/cve-2026-54743

    An approved member or a remote federated instance can store such content, and a viewer who renders it may execute JavaScript in the lemmy-ui origin, exposing the viewer’s session and authenticated actions.

    source
  • oinari@piefed.zip ⁨1⁩ ⁨day⁩ ago

    NoScript has returned to my browser this year

    source

    • tal@lemmy.today ⁨1⁩ ⁨day⁩ ago

      Too much of the Web just doesn’t work with browsers without Javascript on for me to do that these days.

      There was a time when I did browse like that.

      source
    • xxce2AAb@feddit.dk ⁨1⁩ ⁨day⁩ ago

      Wise. Personally, I prefer umatrix since that allows me more fine grained control and has the ability to selectively block other resources or types of requests too, but anything is better than letting every website one visits run reams of arbitrary code.

      source
• Hirom@beehaw.org ⁨1⁩ ⁨day⁩ ago

  (Temporarily) add the websites to existing malware blocklists, ideally ones that are loaded by default by uBlock Origin, and browsers with integrated blocklists.

  This would protect visitors, and make the problem harder to ignore for webmasters since lots of visitor would get a big read scary screen. This is a radical option, but fixing this mass would take such a radical action.

  source

  • Scrollone@lemmy.zip ⁨7⁩ ⁨hours⁩ ago

    Surfing the web without uBlock Origin in 2026 is so dangerous. We should all push our friends and family to install it

    source
• DataCrime@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

  Obviously by posting information on how to fix it directly on the website 🤣

  Note: Your security sucks...
  

  source
• tal@lemmy.today ⁨1⁩ ⁨day⁩ ago

  Why not just send an email to every website?

  I could probably try to automate that, but to what email address? I’d have to hit a selection of common ones, info@, support@, abuse@, maybe others?

  I’d use “webmaster@”, which is a pretty long-running convention, though I don’t know how many people have it set up. I don’t know if there’s an RFC backing that.

  source

  • Ooops@feddit.org ⁨1⁩ ⁨day⁩ ago

    Another option is looking for the security.txt (toplevel or under .well-known/) of a site (that’s RFC 9116, which should have a Contact field with a mailto:<contact address> field (although tel:<number> and https://<contact information page> are allowed, too, although far less common).

    source

    • tal@lemmy.today ⁨1⁩ ⁨day⁩ ago

      Yeah, he mentioned security.txt in the article, but complained that few implemented it.

      I guess that even if someone who apparently does computer security isn’t familiar with it, that Average Joe probably has no idea. Maybe there’s an argument that there should be some sort of browser support for “report problem wirh this page/site” that sends an email to an appropriate address with an URL for the page and comment so that people are more aware of it.

      source

      • -> View More Comments
• baltakatei@sopuli.xyz ⁨1⁩ ⁨day⁩ ago

  Can we see the list so I can know if my site is vulnerable and fix it?

  Why hasn’t the list of sites been published? There are a few reasons:

  • I didn’t want this to be a ‘name and shame’ as the sites on that list are, after all, victims of attacks. Someone broke into their site, and the owners probably have no idea.
  • If the list is widely disseminated and absorbed into blocklists, trying to get your domain of those lists afterwards is close to impossible. For a small business, that could be devastating.
  • Many of these websites were likely infected because of an existing vulnerability that was exploited in something like WordPress, Magento or similar. Handing out a list of viable targets does not seem like a good idea.

  Cynically speaking, their story disappears if too many people fix their websites.

  source