Thanks. I've considered scanning but besides that it's extra attack surface, delay, resources, and gives a false sense of security (it's trivial to make something for which there's not already known signatures), github and other file hosting sites don't do this either. Some do, I think Google Drive does it after the fact, but it doesn't seem to be the deciding factor in whether vigilantes try to take your site down versus report the malicious user content

Maybe it works to stop 90% of the reports though. It is worth considering, just a pain. Also because I used it for getting malware onto lab machines when I was investigating their network traffic patterns for my bachelor's thesis, I'd have had to constantly work around such an antivirus. If people would just not try to find other people's files by url guessing, they'd also not be upset by them

I think this has become much more expensive these days. We do it, at a significant computational cost. Not with a small hobbyist machine, but a beefy hobbyist machine. Sometimes making the hubby a bit less worthy...

That's actually an interesting idea! I remember looking at that list and I don't qualify but I also currently don't have subdomains, maybe it would work then. Not sure if the issue was needing a certain size, like 100k users or whatever (which you'll never reach if half the people can't use your site. I should look into this again with the subdomains option in mind

I've tried contacting various domains via their abuse and technical contact WHOIS info over the the years. Mostly small-to-midsize domains, including colleges. I've never gotten a reply, and I don't know if the emails ever went to a real person. Occasionally the issue I was reporting got fixed, but I have no idea if my email had anything to do with anything.

I didn't newly start this in 2026; I just haven't stopped the existing system :). Fifteen years ago there weren't all these issues though. Attempts at taking it down whenever anything bad was spotted started probably somewhere around 2019-2020, and user reports are picking up as well since about a year. People suddenly care a lot more that when they guessed a url and found malware (something no legitimate user would stumble upon), it gets removed promptly. So far the number of reports is very very manageable, but it's interesting to observe the collective consciousness change over time from "don't run executables that you don't know are safe" to "untrustworthy files shouldn't exist online in the first place"

/shrug - I have an end-to-end encrypted file delivery service. It's a dumb service. If the box got compromised, it doesn't even matter. The files can't be read or stolen because they would have to actually crack the algorithm... which if they did then it's just over, the internet is plaintext again if people are able to defeat what's been recommended as best practices for SSL/TLS these days.

I'd be fine if that were the law. What really frustrates me is the double standard where I can't host something that Microsoft or Wetransfer can without repercussions

When running an actually competent LLM is as cheap as a $10/mo cloud server (for the moderation), I'll actually agree with this sentiment. Probably wont be unpopular long beyond that point in time.

There's a middle ground for this though. Platforms like Youtube, Facebook, etc, have no excuse anymore. They can literally scan with these models they have available and handle it. So write the legislation based on their capacity so you don't screw the one dude just trying to support some indie game devs in a small community or something.

Usually the file is already gone by the time they finished reporting it, but otherwise delete and ban the uploader if it's a valid report. Criminals don't seem to use my site for malware spreading, though, because all uploads expire after a number of hours. Much better to put it somewhere that's stable until the victim clicks on it, like Google Drive or whatnot. You'd say Google is also responsible for infecting innocent victims right?

So far as I can tell, the malware uploaded to my site is when people use it as a virtual usb stick; transferring files to a lab system or something else they already have access to. A multiplayer remote desktop site was popular for a while, loads of links to shared virtual machines and sometimes people would upload screen recordings of something that happened (usually social things like someone saying something edgy in a chat that runs alongside). Since it's a lab environment, the users enjoy letting loose all sorts of malware and they'd use my site to get it there, but they always already had access or you can't type in the URL and execute the file

There was one instance where someone did make a self-spreading piece of malware, custom for my site. It would try to occupy a lot of short links, so pretty much no matter what you guessed, you'd end up finding that Windows executable and, if you ran it, it would upload itself to create yet more valid download links. Didn't do anything malicious to infected machines, just a nuisance to the site until I banned IP addresses that continued to spam the site

Of course, that's just focusing on the malware. The vast majority of uploads are screenshots, legit software (matching sha2sum with a known good source), long links or commands someone would otherwise have to type over, stuff like that. On occasion there's waves where some community will decide to use it for something, like rich Koreans sharing chatroom links for about a year comes to mind. A few teachers use it for very short temporary links that they can write on the chalkboard/whiteboard for students to download coursework from. It was down for 2h last week due to a power outage and one of my old teachers opened a github ticket about it, that was nice to see :)

> Unfortunately, this is how I found out 10 years ago when someone hacked a 3rd party dependency I was using on my site.

Better than a customer telling you they got a nasty bug from your site!

Contacting the registered abuse contact (per the WHOIS data) is just step one. If that fails then, sure, go ahead and let the domain registry know that the contact method on their file is dead and then it makes sense to put the sites on a blocklist

Guessing you run an ad blocker? I'm always shocked by how unusable the web is without one

Don't worry, once you're on one of the naughty lists, it's going to spread by itself. Your domain will never be off of all lists simultaneously, it goes around and you can keep chasing it if it's your domain but you'll never convince everyone before another has copied it again

Most vendors of such lists don't have a contact method, don't respond, or say they're only aggregating a set of secret sources and it's up to me to look for those. Only a handful will actually respond to requests to re-evaluate the allegation, and remove you if it was/is false

Yes, exactly! I'm saying the surface area to audit is much bigger than any particular or group of websites. All websites have problems like this that are out of their hands. What if all 3rd-party script vendors are like this (spoiler: they are)?

The blame game isn't going to solve this. Blaming it entirely on the website owners/maintainers is only treating the symptoms instead of the disease.

No. This is a very old debate I'm bringing up. The criteria for being listed as an "infected site" is not clear enough.

How about "Using third party analytics scripts is a bad idea in general, because they can and frequently do have vulnerabilities and your trust in $BigCompany is misplaced"?

I would agree with that.