Hacker News

points by jeremyjh 5 hours ago | 0 comments

You have not offered an actionable plan to "fix it". I think its quite reasonable that people hosting malware on their websites should be made aware of it, and then they should stop hosting it. Blocking websites that don't respond to emails sent to their abuse contact - or that can't responsibly host content on the internet is totally reasonable.

[–] sublinear 4 hours ago

I think you're trying to muddy waters here (along with several of the other replies I've responded to). These websites are not necessarily hosting the malware themselves. Even these script vendors don't necessarily know either. That's what makes it a supply chain attack. I've been very clear about implementation to mitigate against this.

Hardly anyone ever thinks about this despite it being a gaping hole. For all the whining I've ever heard about package managers like npm, this one is even uglier and likely being exploited right now. Its dynamic behavior is by design making it very hard to reliably demonstrate when it's being exploited, but it's a hole nonetheless.

It's perfectly actionable to stop using 3rd party scripts the way I outlined in a reply to a sibling comment. I'm not sure what else you need me to say.

It's very simple. Don't open up your web server's content security policy to domains that you "trust" just because a big name company tells you to. The only rub is that it directly contradicts all the instructions every analytics/ad provider gives for their scripts. Is that the real reason why you're saying it's "not actionable"?