We Know 15,579 Websites Are Infected. How Do We Tell Them?

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by sublinear on Saturday November 07, 2026 @10:50PM (#50410272)

I think you're trying to muddy waters here (along with several of the other replies I've responded to). I've been very clear about implementation to mitigate against a specific opportunity for a supply chain attack that hardly anyone ever thinks about despite it being a gaping hole.

For all the whining I've ever heard about package managers like npm, this one is even uglier and likely being exploited right now and is very hard to pin down because of its dynamic behavior by design.

It's perfectly actionable to stop using 3rd party scripts the way I outlined in a reply to a sibling comment. I'm not sure what else you need me to say.

It's very simple. Don't open up your web server's content security policy to domains that you "trust" just because a big name company tells you to. The only rub is that it directly contradicts all the instructions every analytics/ad provider gives for their scripts.

[ Parent | on HN ]

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by jeremyjh on Sunday November 08, 2026 @09:46AM (#50413795)

That is very simple for anyone that reads the email sent to the WHOIS abuse contact and understands what it means and why they should care. Since virtually none of them will both understand and care, the next step after sending the email to the abuse contact is to blocklist their domain.

When their visitors begin seeing red warning notices they will learn why they should care.

[ Parent | on HN ]

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by sublinear on Sunday November 08, 2026 @10:56AM (#50414319)

I'll quote my own reply to your sibling.

> I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain the user visits on a regular basis. You're basically "shooting the messenger". Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?

[ Parent | on HN ]

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by jeremyjh on Sunday November 08, 2026 @01:57PM (#50415953)

I still do not know what you think the relevance of that statement is. What is the specific action you are advocating the author of TFA take that does not require addressing it at each and every website operator?

[ Parent | on HN ]

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by sublinear on Sunday November 08, 2026 @02:51PM (#50416491)

If more than one sentence at a time is too much for your context window, you might need to pick another topic to discuss.

[ Parent | on HN ]

Re:We Know 15,579 Websites Are Infected. How Do We Tell Them? by jeremyjh on Sunday November 08, 2026 @03:01PM (#50416589)

If it’s not asking to much from you, maybe you could link me to a comment from someone else who understands what you are getting at.

[ Parent | on HN ]