Better than a customer telling you they got a nasty bug from your site!
I already know many will disagree, but this is far too vague for your answer to make much sense.
Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.
That's the standard definition of a supply chain attack. If the website maintainer was acting maliciously or incompetently, it wouldn't be a supply chain attack anymore.
The blame game isn't going to solve this. Blaming the website owners/maintainers is only treating the symptoms instead of the disease. Even from a legal perspective, this responsibility is shared in the licensing agreement.
The scripts should be 100% static files hosted by the same origin and not be obfuscated. They should not make additional requests to inject even more scripts that cannot be known until run time and are specific to that user. These scripts should be released in the usual semver tradition with matching hashes that never change without the explicit action by the same domain that the user actually visited (making the nonce obsolete).
Like I said, this is a very old debate with a very simple solution whose only problem is that it breaks the business model of a multi-billion dollar idea.
Maybe if the site owners experience their sites going down due to this they'll look for some alternatives.
I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain. Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?
Why haven’t you already done it?
For all the whining I've ever heard about package managers like npm, this one is even uglier and likely being exploited right now and is very hard to pin down because of its dynamic behavior by design.
It's perfectly actionable to stop using 3rd party scripts the way I outlined in a reply to a sibling comment. I'm not sure what else you need me to say.
It's very simple. Don't open up your web server's content security policy to domains that you "trust" just because a big name company tells you to. The only rub is that it directly contradicts all the instructions every analytics/ad provider gives for their scripts.
When their visitors begin seeing red warning notices they will learn why they should care.
> I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain the user visits on a regular basis. You're basically "shooting the messenger". Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?
I'm not sure what point you're trying to make here.
I would agree with that.
Yes, I do.
Enjoy your tiny corner of the web that nobody else participates with.
The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales
This is an incredibly brave thing to do in 2026.
Sorry mate, the era of forums is over.
A State might be composed of humans but it is a machine, a generally unthinking machine, which projects force on and breaks individuals.
My biggest worry was preventing CPAM, and the possibly huge cost and emotional scarring thereof. What surface(s) are your primary concern? I don’t know what I don’t know. Thanks!
There's a middle ground for this though. Platforms like Youtube, Facebook, etc, have no excuse anymore. They can literally scan with these models they have available and handle it. So write the legislation based on their capacity so you don't screw the one dude just trying to support some indie game devs in a small community or something.
So far as I can tell, the malware uploaded to my site is when people use it as a virtual usb stick; transferring files to a lab system or something else they already have access to. A multiplayer remote desktop site was popular for a while, loads of links to shared virtual machines and sometimes people would upload screen recordings of something that happened (usually social things like someone saying something edgy in a chat that runs alongside). Since it's a lab environment, the users enjoy letting loose all sorts of malware and they'd use my site to get it there, but they always already had access or you can't type in the URL and execute the file
There was one instance where someone did make a self-spreading piece of malware, custom for my site. It would try to occupy a lot of short links, so pretty much no matter what you guessed, you'd end up finding that Windows executable and, if you ran it, it would upload itself to create yet more valid download links. Didn't do anything malicious to infected machines, just a nuisance to the site until I banned IP addresses that continued to spam the site
Of course, that's just focusing on the malware. The vast majority of uploads are screenshots, legit software (matching sha2sum with a known good source), long links or commands someone would otherwise have to type over, stuff like that. On occasion there's waves where some community will decide to use it for something, like rich Koreans sharing chatroom links for about a year comes to mind. A few teachers use it for temporarily having a very short link that they can put on the chalkboard/whiteboard for students to download coursework from
Are you talking about CollabVM? :)
> The correct answer is probably the abuse contact shown in the WHOIS data. That's programmatically accessible and thus scales
... They don't treat Github that way either. You mean to report the domain as abusive to the registrar?
Running anti-virus scanners immediately on uploaded files was a widespread practice in the BBS Era, adopted in response to the same kind of abuse. FTP sites did it, too. There was usually a delay for (run on a schedule) virus scanning between uploading to one of the shareware FTP sites and the file getting out of the upload directory and into the download areas.
The headlined article isn't really about hosting user-uploaded files, though. In no sensible system do user-uploaded files go straight into the site's own published JavaScript. The headlined situation is not analogous either to you or to BBSes, involving script hyperlinks to defunct third parties in one form of the problem, so what to do when it comes bad uploads from users is really going off on a tangent from Scott Helme's actual question.
You may want to meet with a marriage counselor.
Can anybody tell me it's not that bad?
When I showed and asked who maintains her site, she said it regard to the malware, "All sites look like this"
That was when it hit me. They have won. The web is so full of garbage to the average person that they cannot even recognize it as it feeds on them.
The webadmin is some Chinese guy on upwork.
What exactly would be "responsible" about that?
How is that better than just directly publishing the entire list?
I believe the default configuration for suspected spam and phishing and other malicious sites is that the user gets a red warning page that they have to click through first. Website owner would either get notifications from users or notice the drop off in traffic?