Comment by JdeBP | Hacker News Reader

Comment by JdeBP | Hacker News Reader

Parent Full thread

Let me offer the wisdom of the BBS Era, which had the same problem of people uploading bad files to small, oftentimes non-commercial, nodes: Scan files on upload.

Running anti-virus scanners immediately on uploaded files was a widespread practice in the BBS Era, adopted in response to the same kind of abuse. FTP sites did it, too. There was usually a delay for (run on a schedule) virus scanning between uploading to one of the shareware FTP sites and the file getting out of the upload directory and into the download areas.

The headlined article isn't really about hosting user-uploaded files, though. In no sensible system do user-uploaded files go straight into the site's own published JavaScript. The headlined situation is not analogous either to you or to BBSes, involving script hyperlinks to defunct third parties in one form of the problem, so what to do when it comes bad uploads from users is really going off on a tangent from Scott Helme's actual question.

Thanks. I've considered scanning but besides that it's extra attack surface, delay, resources, and gives a false sense of security (it's trivial to make something for which there's not already known signatures), github and other file hosting sites don't do this either. Some do, I think Google Drive does it after the fact, but it doesn't seem to be the deciding factor in whether vigilantes try to take your site down versus report the malicious user content

Maybe it works to stop 90% of the reports though. It is worth considering, just a pain. Also because I used it for getting malware onto lab machines when I was investigating their network traffic patterns for my bachelor's thesis, I'd have had to constantly work around such an antivirus. If people would just not try to find other people's files by url guessing, they'd also not be upset by them

Maybe scan every time it is accessed as well? So if and when a malicious file hits the lists maybe your antivirus can flag it? This is an amateur question for the discussion not advice.

I think this has become much more expensive these days. We do it, at a significant computational cost. Not with a small hobbyist machine, but a beefy hobbyist machine. Sometimes making the hubby a bit less worthy...

> Sometimes making the hubby a bit less worthy...

You may want to meet with a marriage counselor.

Reply on news.ycombinator.com