Aachen

HIBP works fine when you check it every once in a while, but as a mechanism to reach site owners about urgent issues, they'd all have to subscribe to such a central reporting place. Not sure what the advantage is of subscribing to "has my site been pwned" as compared to just having a /security.txt, working WHOIS record, obvious contact page linked from the homepage... lots of ways already

Edit: I could see the benefit if they do vetting of the message though. Like if one person vets the message and then it makes it into 15000 inboxes is better than having to deal with 15000 antispam mechanisms. Maybe there's something to this after all. Or if email providers would act upon spam better and we block the ones that don't, maybe we could just not have spam in the first place. Idk why this is so hard in the first place

The old answer I've heard is to look up what their address and room number is in WHOIS and walk over or pick up the phone!

But to be fair, that small web situation was before my time as well. Afaik that's still the directory to look in though. Complaining to third parties behind these owners' backs is a bit of a dick move, though I can understand the reasoning since most people are not aware of the repercussions (see my other replies in this thread, e.g. https://news.ycombinator.com/item?id=50397828)

Replying to the updated FAQ in this post:

> Since GDPR back in 2018, I've found that data to be mostly useless. What you get is either nothing, a registrar web form, or a relay address

This is the way though. If there is no contact in the domain's whois, then contact the abuse handler for the IP address that it's hosted on

Domain registries (not the registrars) are usually very interested in dead contact methods, at least I've been repeatedly threatened with losing the domain if they find it's not functional. You usually get like two weeks to fix it if issues are found, but they do seem to care. Maybe not .ru (I have no experience with them), but in general I'd let them know and see if that triggers an update before moving to more drastic measures

Another way would be looking for an email address on the homepage or pages linked from the homepage (usually /contact or /impressum or such, but of course this varies)

Lastly, some people may be willing to help out and look for a contact method in a crowdsourced manner. Could also use an LLM but I expect people are more reliable and volunteers are cheaper too

> If the list is widely disseminated and absorbed into blocklists, trying to get your domain of those lists afterwards is close to impossible. For a small business, that could be devastating.

As someone who experienced this (thankfully just a hobby project and not a business), thanks for that consideration! However, I'd encourage this line of action for the ones that are uncontactable. If the site is abandoned, what else are you going to do?

Contacting the registered abuse contact (per the WHOIS data) is just step one. If that fails then, sure, go ahead and let the domain registry know that the contact method on their file is dead and then it makes sense to put the sites on a blocklist

Not enforced no, but this works a lot of the time though (include info@ as well). In whois data you can also always find an email contact for abuse notifications

(To be fair, I was a bit annoyed by a recent AI bro spamming about fifteen such prefixes on my domain with a false positive vulnerability report. The PoC did not work and the field they were injecting was already correctly escaped. But it is an effective contact method if you're facing a bulk problem like this I suppose. Maybe try just one prefix at a time until an email is accepted)

> Then: \n\n either web admin notices and fixes website \n\n or people stop visiting them

Okay so let's say this is your site. You notice that Firefox gives a warning, you find the issue, remove the malicious dependency and roll out the new version. Now what? Who do you talk to to get unblocked?

I run a site that's on blocklists. There's no coming off of them once you're there (described elsewhere in this thread: https://news.ycombinator.com/item?id=50398014). These mechanisms are useful for sites that are unmaintained, but I'd not wish it upon admins that immediately respond to vulnerability or abuse reports

I can understand that most people are not aware of this though, just a bit frustrating to see the call for nuking it altogether. It's not what you'd do if one of these 15000 sites was Onedrive: you'd realise the solution is talking to Microsoft. Only when they don't fix their infection would it make sense to take their site offline

Maybe, let's see. I have the same amount of faith in humanity and the legal system as I did in the forum era. No CSAM reports so far. Very little porn in general, maybe one video per year or so? In my particular case it's also not very useful because the uploads are all self-destructing. After a few hours you'd have to upload it again, but from a new IP address because I'd block any (C)SAM uploaders and report all evidence I have to police in the appropriate country. Seems like a silly way to burn through a set of working proxies if someone wanted to try to keep abuse material available on that site

Usually the file is already gone by the time they finished reporting it, but otherwise delete and ban the uploader if it's a valid report. Criminals don't seem to use my site for malware spreading, though, because all uploads expire after a number of hours. Much better to put it somewhere that's stable until the victim clicks on it, like Google Drive or whatnot. You'd say Google is also responsible for infecting innocent victims right?

So far as I can tell, the malware uploaded to my site is when people use it as a virtual usb stick; transferring files to a lab system or something else they already have access to. A multiplayer remote desktop site was popular for a while, loads of links to shared virtual machines and sometimes people would upload screen recordings of something that happened (usually social things like someone saying something edgy in a chat that runs alongside). Since it's a lab environment, the users enjoy letting loose all sorts of malware and they'd use my site to get it there, but they always already had access or you can't type in the URL and execute the file

There was one instance where someone did make a self-spreading piece of malware, custom for my site. It would try to occupy a lot of short links, so pretty much no matter what you guessed, you'd end up finding that Windows executable and, if you ran it, it would upload itself to create yet more valid download links. Didn't do anything malicious to infected machines, just a nuisance to the site until I banned IP addresses that continued to spam the site

Of course, that's just focusing on the malware. The vast majority of uploads are screenshots, legit software (matching sha2sum with a known good source), long links or commands someone would otherwise have to type over, stuff like that. On occasion there's waves where some community will decide to use it for something, like rich Koreans sharing chatroom links for about a year comes to mind. A few teachers use it for very short temporary links that they can write on the chalkboard/whiteboard for students to download coursework from. It was down for 2h last week due to a power outage and one of my old teachers opened a github ticket about it, that was nice to see :)

I didn't newly start this in 2026; I just haven't stopped the existing system :). Fifteen years ago there weren't all these issues though. Attempts at taking it down whenever anything bad was spotted started probably somewhere around 2019-2020, and user reports are picking up as well since about a year. People suddenly care a lot more that when they guessed a url and found malware (something no legitimate user would stumble upon), it gets removed promptly. So far the number of reports is very very manageable, but it's interesting to observe the collective consciousness change over time from "don't run executables that you don't know are safe" to "untrustworthy files shouldn't exist online in the first place"

I'd be fine if that were the law. What really frustrates me is the double standard where I can't host something that Microsoft or Wetransfer can without repercussions

Very few people host email, and even fewer in the same VM as where their website is. I would be surprised if this is the case for even 1% of the sites, and attackers probably are exploiting sites by the hundreds, not babysitting and monitoring the email traffic of one of them to quickly delete any vulnerability reports coming in

Thanks, then I wish the same upon any creation of yours that other people can interact with and use for evil

> companies want to use responsible disclosure as a mechanism so it can save face and their reputation

That sounds like the opposite of the goal of that procedure, since the point is the disclosure. Telling everyone about a weakness before it can be solved would harm users, that's why you coordinate with the vendor, but disclosure and resolution is the goal you're working towards. Saving face would be a gag order or agreement, which many companies indeed have tried, but that's the opposite of companies that publish their procedure for coordinated vulnerability disclosure (also/formerly called responsible disclosure) so that white-hats can report issues without fearing legal action. That also means that these companies have to own up to it once the issue is resolved, or at least the hacker is free to talk about it

The rest of your comment is right though: for sites that are already infected, being quiet about it doesn't prevent a vulnerability from being exploited anymore

Don't worry, once you're on one of the naughty lists, it's going to spread by itself. Your domain will never be off of all lists simultaneously, it goes around and you can keep chasing it if it's your domain but you'll never convince everyone before another has copied it again

Most vendors of such lists don't have a contact method, don't respond, or say they're only aggregating a set of secret sources and it's up to me to look for those. Only a handful will actually respond to requests to re-evaluate the allegation, and remove you if it was/is false

I run a website where people can upload files. Not everyone uploads nice files. Every time someone downloads such a file from my site with their antivirus enabled, it's now my problem to discover which fifteen block lists the whole domain has newly been put on. People don't treat big tech this way; you don't think "oh, there's malware on Github, let me just report github.com as a suspicious website that nobody should be able to visit anymore"

The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales

The part in your edit is indeed what I was referring to, sorry that could have been clearer

But you feel we should be wasting their resources out of spite or what's the idea when you're not even affected?

On another server with the same setup, there's various services and websites running, so load average is never zero there (due to scrapers) but ssh has yet to catch my eye in htop. Whenever I've looked, even the amount of cpu that a Windows VM uses constantly while idle is many times higher than what ssh uses

Such solutions always felt like swapping one risk for another. With good separation (running the VPN on a separate host from the SSH login, otherwise a bug in the VPN solution still might result in a shell on the box), at best you'd need two vulnerabilities before someone gets in, but it's not fundamentally different unless you find a way simpler protocol where you can be more certain that it's secure than ssh is (for all its scrutiny and track record of no pre-auth bugs for decades)

Putting services behind ssh forwarding was the way to secure something you're worried about rather than the other way around, but Wireguard actually makes a good argument nowadays. Iirc they did proofs for the cryptography and it has good design in terms of attack surface, and it's old/mature enough now that I'll say it's probably better than exposing SSH. On the other hand, when this thing running in your kernel gets compromised, you're slightly worse off than with someone logging into a passwordless service account as in the current bug

Huh? I run ssh (OpenSSH) on port 22 with root login enabled and no fail2ban on a single-core laptop cpu from fifteen years ago. The load average is 0.00 even with the small mail and web server that runs on it

What cpu and especially what disk load are you talking about? Also not running out of sockets, not sure if that's RAM-dependent (the box has 2GB)

> > Because a 20 character random password is comparable in brute force complexity to an SSH key.

> You can't be serious with your comment. \n\n No its not.

If you differ in opinion, maybe provide evidence? Especially for a claim like long randomly generated value 1 being absurdly ("can't be serious"-level) weak as compared to long randomly generated value 2

If you mean it's log(62^20,2)≈119 bits of entropy instead of 128+ and so it's theoretically weaker when we build a Dyson sphere around the sun to brute force that key (after somehow obtaining the shadow file, since an online attack would be way too slow), then sure

Doesn't it also need a user to be added with a password entry?

I only ever see Alpine Linux used for containers which don't need accounts with interactive user logins, which is not to say it doesn't exist, just that it doesn't seem like Alpine comes with all preconditions met out of the box

And it happened on the opposite side of the planet! I guess that's why it took five years to analyse the data: quake from 2021, article published last month: https://www.nature.com/articles/s41467-026-78193-6

W I?

Ah yes, the poison-the-product-you're-trying-to-use strategy

> the company can agree to everything and then dissapear.

Isn't that the case for every law related to commitments? Warranty, repair parts and battery longevity is a thing now iirc... haven't had issues with that being avoided so far, at least not in this way

Was going to say that, depending on the device's age, this law may apply, where article 13 sub 9 specifies a decade of updates is the minimum: https://eur-lex.europa.eu/eli/reg/2024/2847/oj But then it turns out that this "applies from" late 2027 :/

Simultaneously Wikipedia says the Act has "entered into force" in 2024. Does anyone know the difference between "enters into force" and "applies"? Is it like this 2016–2018 grace period for GDPR where it was "law" but not enforced? (The wording sounds backwards if it's that, but I'm not a native speaker)

Yes, you'd introduce a lot of new bugs because the code is newly written[1], but eventually you'll get to the same maturity as today except you can't have all these devastating memory-handling-related vulnerabilities

The question is whether your software will be in use long enough to be worth the cost of change more than whether it's a good idea in the long run. For Linux, I'd argue that that's likely. At least new code would ideally be contributed in a safe language, where practically possible (there'll surely be places where you need to deal with memory as a kernel)

Relevant article: reducing memory vulnerabilities through a combination of memory-safe languages and an exponential decrease of bugs as existing code ages https://security.googleblog.com/2024/09/eliminating-memory-s..., from which I'll also quote my reference for [1]: "A large-scale study of vulnerability lifetimes published in 2022 in Usenix Security [...] found that the vast majority of vulnerabilities reside in new or recently modified code"

https://en.wikipedia.org/wiki/Express_Data_Path for anyone else wondering what that is

> our locations are visible to each other via GPS

... via mobile data or WiFi, you mean. Whether it uses GPS, Galileo, track measurement points, or even "driver calls the control centre to update their position" doesn't have much to do with it. What I assume you mean is redundancy so that two or more systems can communicate train positions independently, where the more relevant problem is how to get the data across in a timely manner. The driver of the stationary train called in their position and it wasn't used: it's a communication problem, not a "where am I" problem. Idk why the focus on GPS and using GPS for communication (which GPS can't do, and newer systems only do at very low speeds for emergency communication) but finding one's position is usually not the problem