Quote from TFA:

> Supply chain - a third-party script file that a site loads is infected with malware, and is then loaded on to the site, exposing all visitors.

I already know many will disagree, but this is far too vague for your answer to make much sense. The list of 15k websites isn't given.

Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.

You usually get the whole clown car as soon as you allow one 3rd-party script for relatively innocent use cases like wanting a heatmap of user interaction.

You should fully expect that such a blacklist would take out most, if not all, of the websites you use every day. The security model for 3rd party scripts tends to be "trust me bro, we're $bigname"

▲

phyzome 10 hours ago | parent | next [-]

If a site is using a third-party analytics site that brings in malware, they can stop bringing in that analytics script.

▲

sublinear 9 hours ago | parent [-]

Yes, exactly! I'm saying the surface area to audit is much bigger than any particular or group of websites. All websites have problems like this that are out of their hands. What if all 3rd-party script vendors are like this (spoiler: they are)?

The blame game isn't going to solve this. Blaming it entirely on the website owners/maintainers is only treating the symptoms instead of the disease.

▲

phyzome 8 hours ago | parent [-]

It's not about blame. The idea here is to protect the visitors of the site. Do you think they shouldn't be warned?

▲

sublinear 8 hours ago | parent [-]

Warning people sucks. We need to actually fix it.

▲

renehsz 7 hours ago | parent [-]

Visitors getting a big red warning page is the most effective way to get it fixed though. There's no way for site admins to sweep the issue under the rug

	▲	sublinear 5 hours ago \| parent [-]
		If we're really being serious about getting it fixed and not just waving a magic wand and laying blame, the scripts should not be distributed via a platform that tells web maintainers to blindly paste a script tag and leave their web servers wide open for the whitelisted 3rd party domain(s) to send whatever they want to visitors. We need to end the security theater with nonces that is bypassing what most people expect from a content security policy that is almost never true in practice. The scripts should be 100% static files hosted by the same origin and not be obfuscated. These scripts should not make additional requests to inject even more scripts that cannot be known until run time and are specific to that targeted visitor. These scripts should be released in the usual semver tradition with matching hashes that never change without the explicit action by the same domain that the user actually visited (making the nonce obsolete). Like I said, this is a very old debate with a very simple solution whose only problem is that it breaks the business model of a multi-billion dollar idea. Not only would this tighten up security, but your favorite websites wouldn't lag so hard anymore either. The vast majority of complaints about the web being slow are from the dozens of HTTP requests constantly being made behind your back. This is exactly why so many users feel forced to use an adblocker even though that doesn't always work.

▲

telebub 11 hours ago | parent | prev | next [-]

Are you replying to something else? I don't see the connection to a problem affecting a small number of websites or the suggestion of reporting them all to a browser maker to indirectly inform them.

▲

sublinear 11 hours ago | parent [-]

No. This is a very old debate I'm bringing up. The criteria for being listed as an "infected site" is not clear enough.

▲

306bobby 11 hours ago | parent | next [-]

Your example is how the site got infected. The types of infection is listed 2 or so paragraphs above that

	▲	sublinear 4 hours ago \| parent [-]
		What makes you so sure that kind of malware isn't being distributed by otherwise trusted 3rd-party scripts? That's the standard definition of a supply chain attack. If the website maintainer was acting maliciously or incompetently, it wouldn't be a supply chain attack anymore.

▲

akerl_ 10 hours ago | parent | prev [-]

If I’m about to enter my credit card information on a site that’s compromised, I don’t care if it’s because of infected first party code or infected third party code. I want my browser to say “bro this site is fishy, maybe don’t”.

	▲	10 hours ago \| parent [-]
		[deleted]

▲

Catloafdev 10 hours ago | parent | prev [-]

They aren't saying "analytics script = infection"

I'm not sure what point you're trying to make here.

	▲	treadmill 8 minutes ago \| parent [-]
		How about "Using third party analytics scripts is a bad idea in general, because they can and frequently do have vulnerabilities and your trust in $BigCompany is misplaced"? I would agree with that.