Warning people sucks. We need to actually fix it.

[delayed]

If we're really being serious about getting it fixed and not just waving a magic wand and laying blame, the scripts should not be distributed via a platform that tells web maintainers to blindly paste a script tag and leave their web servers wide open for the whitelisted 3rd party domain(s) to send whatever they want to visitors. We need to end the security theater with nonces that is bypassing what most people expect from a content security policy that is almost never true in practice.

The scripts should be 100% static files hosted by the same origin and not be obfuscated. They should not make additional requests to inject even more scripts that cannot be known until run time and are specific to that user. These scripts should be released in the usual semver tradition with matching hashes that never change without the explicit action by the same domain that the user actually visited (making the nonce obsolete).

Like I said, this is a very old debate with a very simple solution whose only problem is that it breaks the business model of a multi-billion dollar idea.

All of that sounds great but also it's important to protect visitors.

Maybe if the site owners experience their sites going down due to this they'll look for some alternatives.

You're totally not getting what I'm saying and that's fine, but why do you post these replies then?

I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain. Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?

This is a great list of things “someone” should do. Can the author of TFA do it?

Why haven’t you already done it?

You have not offered an actionable plan to "fix it". I think its quite reasonable that people hosting malware on their websites should be made aware of it, and then they should stop hosting it. Blocking websites that don't respond to emails sent to their abuse contact - or that can't responsibly host content on the internet is totally reasonable.

I think you're trying to muddy waters here (along with several of the other replies I've responded to). I've been very clear about implementation to mitigate against a specific opportunity for a supply chain attack that hardly anyone ever thinks about despite it being a gaping hole.

For all the whining I've ever heard about package managers like npm, this one is even uglier and likely being exploited right now and is very hard to pin down because of its dynamic behavior by design.

It's perfectly actionable to stop using 3rd party scripts the way I outlined in a reply to a sibling comment. I'm not sure what else you need me to say.

It's very simple. Don't open up your web server's content security policy to domains that you "trust" just because a big name company tells you to. The only rub is that it directly contradicts all the instructions every analytics/ad provider gives for their scripts.

That is very simple for anyone that reads the email sent to the WHOIS abuse contact and understands what it means and why they should care. Since virtually none of them will both understand and care, the next step after sending the email to the abuse contact is to blocklist their domain.

When their visitors begin seeing red warning notices they will learn why they should care.

I'll quote my own reply to your sibling.

> I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain the user visits on a regular basis. You're basically "shooting the messenger". Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?

I still do not know what you think the relevance of that statement is. What is the specific action you are advocating the author of TFA take that does not require addressing it at each and every website operator?

If more than one sentence at a time is too much for your context window, you might need to pick another topic to discuss.

If it’s not asking to much from you, maybe you could link me to a comment from someone else who understands what you are getting at.