Hacker News
points by Guestmodinfo 1 day ago | 0 comments
Make a website, name it 15579infected.com and name everywebsite. Most of the website owners would soon wise up by word of mouth and visit your website and most probably contact you and you tell them what vulnerability each one has so they can rectify. You can charge them for your service.
[–] Jolter 1 day ago
Charging them to detail the infection to them risks coming off as extortion to less savvy site owners. You might get a significant portion who would report you to the police rather than talk to you.

Just give them the deets.

[–] sublinear 2 hours ago
Your business idea is 100% a straight up scam.

You're trying to assert authority and make money off of what is super basic cybersecurity. I'm not sure why you think word of mouth would cause anyone to do anything but laugh at you at best, or get the law after you at worst.

[–] henearkr 1 day ago
This is the right move. Contrary to what the other comment says, this is not "name and shame". Instead, this is a database, useful to check for website owners to see if their site is listed inside.

This would be an idea very similar to haveibeenpwned.com, which is immensely helpful.

[–] sampaio96 1 day ago
Don't do that dude.
[–] auslegung 1 day ago
Why not?
[–] alienbaby 1 day ago
its a free for all of targets known to be vulernable to javascript injection via some route or other?
[–] Topfi 1 day ago
And? They won’t be less vulnerable by not being listed, nor easier to find for any moderately skilled attacker (especially these days) by being listed publicly.
[–] testplzignore 1 day ago
He should just put up a txt file on his blog and call it a day.

I don't get why he brings "responsible disclosure" into this. That is appropriate when you find a door lock that is easily picked; that is not appropriate when you are watching from across the street while a house gets looted.

[–] ryandrake 1 day ago
Exactly. This is not rocket science. Name and shame. Sort by estimated traffic.