5 ms·
Scanning something for malware and publishing it in search results seem like 2 completely different things to me...?
by rsbadger 4y ago
Scanning something for malware and publishing it in search results seem like 2 completely different things to me...?
- Xylakant 4y agoBut there is nothing to indicate either in the post or in the referenced SO thread that the URLs are published to the search results. They are visited by bingbot, that much seems confirmed, but there’s no example where one of these results shows up in the public search results.
- rsbadger 4y agoThey were indexed in Bing results, I’ve shared the URL of that in this thread
- cma 4y agoHoly shit thats bad. Do unlisted youtube and gdrive share links get indexed through this?
- 9dev 4y agoYou’d assume those have proper robots.txt configuration?
- boxed 4y agoI have a disallow all robots.txt for a production system. Have had from the beginning. Bing indexes it. This is my first major security incident and I have no idea how to fix this without making everything totally shitty for the users.
- ratg13 4y agoYes, but there is no indication they are publishing it in the search results. The original post is just complaining that the malware scanning is visiting the links. They come to the following conclusion >This effectively makes all one-time use links like login/pass-reset/etc useless. Which we all know is not true because sites like onetimesecret.com allow for entering a separate password to prevent this sort of thing when it does happen. It would be an interesting discussion to talk about what Microsoft's whitelisting process looks like, but the original article doesn't seem to understand what is going on well enough to drive the conversation in that direction.
- nopassrecover 4y agoThey are publishing them - it has bitten us (e.g. expired one click links for customers ending up on Bing from their emails)
- ratg13 4y agoIf you can say for certain that the links being published are coming from the malware scanning, and not being taken from users' browser sessions that are using Microsoft Edge you should elaborate on this.
- boesboes 4y agoThat would be even worse.
- ratg13 4y agoNobody is saying it isn't. It's about trying to get to the core of the issue, not just the random speculation going on in the article and in this comment thread.
- rsbadger 4y agoI would be pretty mortified if browsers were using user browser sessions to scan content and pass it to bingbot…? What about if you’re browsing something local? Or your bank account?