4 ms·

I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. Most of the owners probably barely know the Goog

I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. Most of the owners probably barely know the Googles from the Facebooks, so even if you email them saying 'you have this JavaScript thing that's bad' they won't understand and will blow you off. OP doesn't go into details of how they check the stores, but I'd assume they have some sort of script as they checked 255k. If that's the case it would be trivial to send an automated email if malware is detected, and include links explaining how to fix it. It won't resolve everything but it's a lot nicer than naming&shaming businesses who have effectively done nothing wrong. What I mean is they probably hired a developer or team to build their website, and assumed that they would build a secure website - they didn't go out purposely and find someone to build them a site that would be hacked.

zAy0LfpBZLC8mAC 10y ago
So, you don't think that if you operate something that is a risk to other people, it's your obligation to reduce the risk? You can just say that you are incompetent at what you are doing, and therefore you shouldn't be shamed for putting other people at risk?
- lucaspiller 10y ago
  I edited my post, but I don't think that's really fair. The business most likely outsourced the development of their site to someone who probably assured them that they would build a secure site. The business probably trusted them (maybe the developer was even recommended) yet here we are. The business didn't know enough about building a secure website, so hired someone they assumed did. Edit - Poor analogy removed.
  - zAy0LfpBZLC8mAC 10y ago
    What's even your analogy here? Because sometimes people have bad luck and you can make up a completely unrealistic scenario of how bad luck someone possibly could have, we should not hold anyone responsible for anything? To give you an idea of how unrealistic your scenario is: In reality, yes, the owner of the damaged property could force you to pay for the repair, but also, you could force the plumber to reimburse you for that, and they in turn probably will have insurance for that sort of thing that will reimburse them in turn. Noone would be kicked out of anything, except for the plumber by the insurer if they had that happen a bit too often.
  - sillysaurus3 10y ago
    A solution to this is to hire a pentester for your site. You can find them for ~$5k, with followup tests for new features being around $2k. A professional, world-class pentest runs around $50k, but a lot of smaller sites can't afford that. You can't really hire someone with the expectation that they'll develop secure code. Finding flaws in code people thought was secure is a pentester's job, and it's a completely different skillset.
    - lucaspiller 10y ago
      I agree, but my point is the people who hired the developers probably don't even know what a pentester is.
      - sillysaurus3 10y ago
        Yes. A lot of them also respond with threats when you try to contact them to tell them about vulnerabilities. It's not really up to the author to shoulder that kind of responsibility. https://news.ycombinator.com/item?id=12309035 https://news.ycombinator.com/item?id=12309035 is informative. For what it's worth, it changed my mind on the matter.
bsder 10y ago
> I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. So the malware should be allowed to continue stealing credit card numbers just because the site owners don't know any better? Is that really a position you wish to defend?
- lucaspiller 10y ago
  No I don't agree that it should be allowed to continue, but how is naming&shaming people going to fix anything? Nothing is going to come of this, other than maybe some other hackers will see them as weak targets. Do you expect this list to be read on prime time CNN or something? People who want to buy something online aren't going to search through GitLab to check if the site has been hacked (maybe they should though), they just look for the green padlock and assume it's safe. As I said, and GitLab suggested, OP should at least contact them. If you contact them and they say they won't do anything, now that's a different story...
  - robryk 10y ago
    > No I don't agree that it should be allowed to continue, but how is naming&shaming people going to fix anything? Someone will make a browser extension that uses this list to warn users?
  - flopto 10y ago
    > So far, between Oct 10 and Oct 14, 631 stores have been fixed. [0] So it sounds like does a pretty good job of fixing things [0] https://gwillem.gitlab.io/2016/10/14/github-censored-research-data/ https://gwillem.gitlab.io/2016/10/14/github-censored-researc...
  - kabes 10y ago
    Well, from the responses he's got it's pretty obvious some shop owners just don't care. I can imagine if they're being publicly shamed about it, they might start caring and actually do something about it. So yeah, it helps.
- edejong 10y ago
ComodoHacker 10y ago
>send an automated email if malware is detected, and include links explaining how to fix it Twitter is better. Warned users are the best motivation to fix.
barkbro 10y ago
> It won't resolve everything but it's a lot nicer than naming&shaming businesses who have effectively done nothing wrong. They are putting their users at risk through negligence. Many would argue that's wrong.
raimue 10y ago
Whenever a business hires a contractor to do something for them, the customers will blame the business first if anything is wrong in their product or service. It is up to the business to take the damages in reputation and lost business opportunities to the contractor. Why should we handle this differently for software running online shops?
sangnoir 10y ago
> I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed This had been empirically proven false. As noted in an addendum to the post, 631 broken sites got fixed in just 2 days after the list got published.
jupiter2 10y ago
> naming&shaming businesses who have effectively done nothing wrong. Aren't they actively running malware as a result of their own laziness not to upgrade their Magento[1] Site? This malware is being used to steal customer credit cards (at the very least) - perhaps identity theft as well. They are the very agents of 3rd-party hackers. This list[2] should be sent to the proper authorities and have the stores closed immediately. Customers who have made purchases at these stores can and should be looking at lawsuits. If you're going to run a 3rd-party solution for your ecommerce needs and patches have long been made available, you patch. If you can't even do this one simple thing - you get run off the internet for criminal negligence. [1] https://magento.com/ https://magento.com/ [2] https://www.magereport.com/page/about https://www.magereport.com/page/about
lazyjones 10y ago
> Most of the owners probably barely know the Googles from the Facebooks, so even if you email them saying 'you have this JavaScript thing that's bad' they won't understand and will blow you off. So, because you expect the owners of the affected websites to be dumb, users should not be protected from malware? But I'll give you an example of how such sites would get fixed: I used to own and work for a CSE, where thousands of stores are listed. If I had easy access to this list, I'd take a quick look at it for possible clients and ask my former company to contact them. They'd first delist the affected shops from the comparison shopping website, then spend enough time with the owners to make sure they understand and can fix the problem. Github in their ignorance prevented this, but thankfully archive.org exists... On the other hand, the safe browsing feature of modern browsers usually creates enough pressure on affected shops that they are fixed quickly - so if some shops don't seem to act quickly, they're probably fraudulent themselves.

zAy0LfpBZLC8mAC 10y ago

So, you don't think that if you operate something that is a risk to other people, it's your obligation to reduce the risk? You can just say that you are incompetent at what you are doing, and therefore you shouldn't be shamed for putting other people at risk?

lucaspiller 10y ago
I edited my post, but I don't think that's really fair. The business most likely outsourced the development of their site to someone who probably assured them that they would build a secure site. The business probably trusted them (maybe the developer was even recommended) yet here we are. The business didn't know enough about building a secure website, so hired someone they assumed did. Edit - Poor analogy removed.
- zAy0LfpBZLC8mAC 10y ago
  What's even your analogy here? Because sometimes people have bad luck and you can make up a completely unrealistic scenario of how bad luck someone possibly could have, we should not hold anyone responsible for anything? To give you an idea of how unrealistic your scenario is: In reality, yes, the owner of the damaged property could force you to pay for the repair, but also, you could force the plumber to reimburse you for that, and they in turn probably will have insurance for that sort of thing that will reimburse them in turn. Noone would be kicked out of anything, except for the plumber by the insurer if they had that happen a bit too often.
- sillysaurus3 10y ago
  A solution to this is to hire a pentester for your site. You can find them for ~$5k, with followup tests for new features being around $2k. A professional, world-class pentest runs around $50k, but a lot of smaller sites can't afford that. You can't really hire someone with the expectation that they'll develop secure code. Finding flaws in code people thought was secure is a pentester's job, and it's a completely different skillset.
  - lucaspiller 10y ago
    I agree, but my point is the people who hired the developers probably don't even know what a pentester is.
    - sillysaurus3 10y ago
      Yes. A lot of them also respond with threats when you try to contact them to tell them about vulnerabilities. It's not really up to the author to shoulder that kind of responsibility. https://news.ycombinator.com/item?id=12309035 https://news.ycombinator.com/item?id=12309035 is informative. For what it's worth, it changed my mind on the matter.

bsder 10y ago

> I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. So the malware should be allowed to continue stealing credit card numbers just because the site owners don't know any better? Is that really a position you wish to defend?

lucaspiller 10y ago
No I don't agree that it should be allowed to continue, but how is naming&shaming people going to fix anything? Nothing is going to come of this, other than maybe some other hackers will see them as weak targets. Do you expect this list to be read on prime time CNN or something? People who want to buy something online aren't going to search through GitLab to check if the site has been hacked (maybe they should though), they just look for the green padlock and assume it's safe. As I said, and GitLab suggested, OP should at least contact them. If you contact them and they say they won't do anything, now that's a different story...
- robryk 10y ago
  > No I don't agree that it should be allowed to continue, but how is naming&shaming people going to fix anything? Someone will make a browser extension that uses this list to warn users?
- flopto 10y ago
  > So far, between Oct 10 and Oct 14, 631 stores have been fixed. [0] So it sounds like does a pretty good job of fixing things [0] https://gwillem.gitlab.io/2016/10/14/github-censored-research-data/ https://gwillem.gitlab.io/2016/10/14/github-censored-researc...
- kabes 10y ago
  Well, from the responses he's got it's pretty obvious some shop owners just don't care. I can imagine if they're being publicly shamed about it, they might start caring and actually do something about it. So yeah, it helps.
edejong 10y ago

ComodoHacker 10y ago

>send an automated email if malware is detected, and include links explaining how to fix it Twitter is better. Warned users are the best motivation to fix.

barkbro 10y ago

> It won't resolve everything but it's a lot nicer than naming&shaming businesses who have effectively done nothing wrong. They are putting their users at risk through negligence. Many would argue that's wrong.

raimue 10y ago

Whenever a business hires a contractor to do something for them, the customers will blame the business first if anything is wrong in their product or service. It is up to the business to take the damages in reputation and lost business opportunities to the contractor. Why should we handle this differently for software running online shops?

sangnoir 10y ago

> I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed This had been empirically proven false. As noted in an addendum to the post, 631 broken sites got fixed in just 2 days after the list got published.

jupiter2 10y ago

> naming&shaming businesses who have effectively done nothing wrong. Aren't they actively running malware as a result of their own laziness not to upgrade their Magento[1] Site? This malware is being used to steal customer credit cards (at the very least) - perhaps identity theft as well. They are the very agents of 3rd-party hackers. This list[2] should be sent to the proper authorities and have the stores closed immediately. Customers who have made purchases at these stores can and should be looking at lawsuits. If you're going to run a 3rd-party solution for your ecommerce needs and patches have long been made available, you patch. If you can't even do this one simple thing - you get run off the internet for criminal negligence. [1] https://magento.com/ https://magento.com/ [2] https://www.magereport.com/page/about https://www.magereport.com/page/about

lazyjones 10y ago

> Most of the owners probably barely know the Googles from the Facebooks, so even if you email them saying 'you have this JavaScript thing that's bad' they won't understand and will blow you off. So, because you expect the owners of the affected websites to be dumb, users should not be protected from malware? But I'll give you an example of how such sites would get fixed: I used to own and work for a CSE, where thousands of stores are listed. If I had easy access to this list, I'd take a quick look at it for possible clients and ask my former company to contact them. They'd first delist the affected shops from the comparison shopping website, then spend enough time with the owners to make sure they understand and can fix the problem. Github in their ignorance prevented this, but thankfully archive.org exists... On the other hand, the safe browsing feature of modern browsers usually creates enough pressure on affected shops that they are fixed quickly - so if some shops don't seem to act quickly, they're probably fraudulent themselves.