Re:We Know 15,579 Websites Are Infected. How Do We Tell Them?
by davedx on Friday November 06, 2026 @03:15PM
(#50397807)
How do you responsibly disclose to 15 thousand websites?
Re:We Know 15,579 Websites Are Infected. How Do We Tell Them?
by nextaccountic on Friday November 06, 2026 @04:36PM
(#50398848)
You don't (well not unless you want to run a mass email campaign that is indistinguishable from spam)
Re:We Know 15,579 Websites Are Infected. How Do We Tell Them?
by newAccount2025 on Friday November 06, 2026 @03:19PM
(#50397869)
This seems correct? If true, they are currently dangerous to others and they should be called out for it. Why will people be more proactive here if they can just hide their mistakes?
Re:We Know 15,579 Websites Are Infected. How Do We Tell Them?
by Aachen on Friday November 06, 2026 @03:42PM
(#50398222)
> companies want to use responsible disclosure as a mechanism so it can save face and their reputation
That sounds like the opposite of the goal. The point is the disclosure: telling everyone about a weakness before it can be solved would harm users, but disclosure and resolution is the goal you're working towards. Saving face would be a gag agreement, which many companies indeed have tried, but that's the opposite of companies that publish their procedure for coordinated vulnerability disclosure (also/formerly called responsible disclosure) so that white-hats can report issues without fearing legal action
The rest of your comment is right though: for sites that are already infected, being quiet about it doesn't prevent a vulnerability from being exploited anymore
Re:We Know 15,579 Websites Are Infected. How Do We Tell Them?
by deckar01 on Friday November 06, 2026 @06:34PM
(#50399969)
It’s not a notice of a vulnerability. For all they know it was an employee abusing access. You don’t leave a skimmer on a pump and politely keep sending emails to corporate waiting for a response. You call the cops and they should shut the pumps off until the skimmers are removed. With the amount of AI security report slop and AI extortion spam out there this is basically a service that only the web host can provide.
Responsible disclosure is to prevent harm. You think about your disclosure options and pick the one that is best overall weighing the impact and harm.
They're already infected - or so you claim.
I get that companies want to use responsible disclosure as a mechanism so it can save face and their reputation, and if both are possible at the same time then sure.
But if you think you're right, you have to pick one and live with the consequences; and its not that hard to pick the right choice.
In fact, if you don't make the right choice you need stop misusing the word “responsible disclosure”.
Publish the URLs that prove they're infected. Auto update it whenever one get's fixed.