Hacker News Reader

Comment by Guestmodinfo | Hacker News Reader

Make a website, name it 15579infected.com and name everywebsite. Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify. You can charge them for your service.

View on HN

Charging them to detail the infection to them risks coming off as extortion to less savvy site owners. You might get a significant portion who would report you to the police rather than talk to you.

Just give them the deets.

Your business idea is 100% a straight up scam.

You're trying to assert authority and make money off of what is super basic cybersecurity. I'm not sure why you think word of mouth would cause anyone to do anything but laugh at you at best, or get the law after you at worst.

Don't do that dude.

Why not?

its a free for all of targets known to be vulernable to javascript injection via some route or other?

And? They won’t be less vulnerable by not being listed, nor easier to find for any moderately skilled attacker (especially these days) by being listed publicly.

This is the right move. Contrary to what the other comment says, this is not "name and shame". Instead, this is a database, useful to check for website owners to see if their site is listed inside.

This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.

He should just put up a txt file on his blog and call it a day.

I don't get why he brings "responsible disclosure" into this. That is appropriate when you find a door lock that is easily picked; that is not appropriate when you are watching from across the street while a house gets looted.

Exactly. This is not rocket science. Name and shame. Sort by estimated traffic.

Reply on news.ycombinator.com