Are you replying to something else? I don't see the connection to a problem affecting a small number of websites or the suggestion of reporting them all to a browser maker to indirectly inform them.

No. This is a very old debate I'm bringing up. The criteria for being listed as an "infected site" is not clear enough.

Your example is how the site got infected. The types of infection is listed 2 or so paragraphs above that

What makes you so sure that kind of malware isn't being distributed by otherwise trusted 3rd-party scripts?

That's the standard definition of a supply chain attack. If the website maintainer was acting maliciously or incompetently, it wouldn't be a supply chain attack anymore.

If I’m about to enter my credit card information on a site that’s compromised, I don’t care if it’s because of infected first party code or infected third party code. I want my browser to say “bro this site is fishy, maybe don’t”.

If a site is using a third-party analytics site that brings in malware, they can stop bringing in that analytics script.

Yes, exactly! I'm saying the surface area to audit is much bigger than any particular or group of websites. All websites have problems like this that are out of their hands.

The blame game isn't going to solve this. Blaming the website owners/maintainers is only treating the symptoms instead of the disease. Even from a legal perspective, this responsibility is shared in the licensing agreement.

It's not about blame. The idea here is to protect the visitors of the site. Do you think they shouldn't be warned?

Warning people sucks. We need to actually fix it.

[delayed]

If we're really being serious about getting it fixed and not just waving a magic wand and laying blame, the scripts should not be distributed via a platform that tells web maintainers to blindly paste a script tag and leave their web servers wide open for the whitelisted 3rd party domain(s) to send whatever they want to visitors. We need to end the security theater with nonces that is bypassing what most people expect from a content security policy that is almost never true in practice.

The scripts should be 100% static files hosted by the same origin and not be obfuscated. They should not make additional requests to inject even more scripts that cannot be known until run time and are specific to that user. These scripts should be released in the usual semver tradition with matching hashes that never change without the explicit action by the same domain that the user actually visited (making the nonce obsolete).

Like I said, this is a very old debate with a very simple solution whose only problem is that it breaks the business model of a multi-billion dollar idea.

All of that sounds great but also it's important to protect visitors.

Maybe if the site owners experience their sites going down due to this they'll look for some alternatives.

You're totally not getting what I'm saying and that's fine, but why do you post these replies then?

I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain. Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?

This is a great list of things “someone” should do. Can the author of TFA do it?

Why haven’t you already done it?

You have not offered an actionable plan to "fix it". I think its quite reasonable that people hosting malware on their websites should be made aware of it, and then they should stop hosting it. Blocking websites that don't respond to emails sent to their abuse contact - or that can't responsibly host content on the internet is totally reasonable.

I think you're trying to muddy waters here (along with several of the other replies I've responded to). I've been very clear about implementation to mitigate against a specific opportunity for a supply chain attack that hardly anyone ever thinks about despite it being a gaping hole.

For all the whining I've ever heard about package managers like npm, this one is even uglier and likely being exploited right now and is very hard to pin down because of its dynamic behavior by design.

It's perfectly actionable to stop using 3rd party scripts the way I outlined in a reply to a sibling comment. I'm not sure what else you need me to say.

It's very simple. Don't open up your web server's content security policy to domains that you "trust" just because a big name company tells you to. The only rub is that it directly contradicts all the instructions every analytics/ad provider gives for their scripts.

That is very simple for anyone that reads the email sent to the WHOIS abuse contact and understands what it means and why they should care. Since virtually none of them will both understand and care, the next step after sending the email to the abuse contact is to blocklist their domain.

When their visitors begin seeing red warning notices they will learn why they should care.

I'll quote my own reply to your sibling.

> I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain the user visits on a regular basis. You're basically "shooting the messenger". Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?

I still do not know what you think the relevance of that statement is. What is the specific action you are advocating the author of TFA take that does not require addressing it at each and every website operator?

If more than one sentence at a time is too much for your context window, you might need to pick another topic to discuss.

If it’s not asking to much from you, maybe you could link me to a comment from someone else who understands what you are getting at.

They aren't saying "analytics script = infection"

I'm not sure what point you're trying to make here.

How about "Using third party analytics scripts is a bad idea in general, because they can and frequently do have vulnerabilities and your trust in $BigCompany is misplaced"?

I would agree with that.

Exactly. This is what website operators need to learn. People generally don't learn lessons like this without experiencing some pain first, so in my mind skipping straight to the blocklist is the most efficient.

You need to look up what a supply chain attack actually is. This is not necessarily malicious behavior or incompetence.

> unless you consider putting ads on a website incompetence

Yes, I do.

Then it's confirmed. You are now going off-topic into politics instead of cybersecurity.

Enjoy your tiny corner of the web that nobody else participates with.