Hacker News

points by avidruntime 1 day ago | 0 comments

Not sure what to believe here. Wouldn't it be possible to create a site that has some js embedded that is able to be aware of archive's process so that the archived page renders a different page than the original? Could that secondary page be what is trying to deliver the malware, using archive as an unwitting laundry? That matches the MO of malware delivery via other services, no? I'm baffled as to why the mods don't provide any details whatsoever. There are more links to the controversy between the blogger who sought archive's webmasters identity than details of this incident. The mods in this subreddit are doubling down on not sharing details under the guise of "not our job to be infosec". Perhaps a write up is in due time but at the moment this feels like a sketchy extension of the aforementioned drama

Edit: Another r/seattle moderator (not the OP of the original post) has posted their technical writeup of the malware, which is detailed and definitely more in line with what we'd expect with this kind of PSA. While I stand by all criticisms of the OP moderator and their initial handling of the disclosure, you can find the details of the incident in this excellent write up: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

[–] no-name-here 1 day ago

Archive.today has been caught intentionally using JS in the past to target others maliciously, so probably better not to give them the benefit of the doubt: https://www.tomshardware.com/software/search-engines/archive...

[–] RobotToaster 1 day ago

In that case he was targeting someone who was attempting to dox him to get him arrested. What would be the motivation in this case?

[–] no-name-here 1 day ago

The reporting describes it as:

> … a blog post from 2023, where the researcher looked into what makes Archive Today tick.

> The exposé reads as mostly positive, even suggesting that folks donate to Archive Today, as it provides a valuable service to the online community. Among the post's contents, Patokallio shows relatively slim and unverified findings about the Archive's operator's (or operators') identities and their income sources.

Is your argument that it's legitimate to intentionally cause user's PCs to conduct a malicious DDoS against someone who has possibly revealed who is operating a service and/or committing crimes? If someone posted that OpenAI had committed a crime or revealed its backers, would it be defensible for OpenAI to insert code for every ChatGPT.com visitor to make requests to that user's site every 0.3 seconds?

Or do you not think the archive.today operator's existing actions are defensible?

[–] bulder 1 day ago

Same kind of spite that led them to block the entire country of Finland? The site owner clearly isn't above attacks based on existing in the same country as someone who's slighted them.

[–] eyya 1 day ago

This wasn’t the first incident involving Finland and its government since the archive was established, nor was it even the second.

And when you consider that Jani Patokallio isn’t just some random, curious, cybersecurity blogger, but the ~40-year-old son of a high-ranking Finnish official who suddenly took up slighting and doxing, the story takes on a whole new dimension and it’s hard to come up with a benign explanation for his curiosity: either you’re being hounded by the deep state or a wealthy nutcase.

[–] iam-py-test 14 hours ago

There's no conspiracy here. I have thoroughly investigated this case, and there is absolutely zero evidence supporting your claims. Jani's article was motivated by curiosity, not malice.

[–] jaychandra68 12 hours ago

What amazes me is the existence of a stable group of archive haters who have been actively stalking it on all the platforms for many years, if not decades: gyrovague, iam-py-test, waad, .... What has it done to you that you’re chasing him? Isn’t it enough for you to simply stop using a free service that isn’t being forced on you? Are you its upset co-founders?

Curiosity? I don't buy it. Too long and persistent.

Combined with zero curiosity on neighbor projects like 12ft or magnolia1234's bypass-paywalls-clean.

You do stalk exact people behind archive.today and btdig, for years, not investigating the niche, so don't call yourself "security bloggers" or "journalists"

[–] Ukv 1 day ago

Seems unlikely to be the case here if what one of the mods said is true:

> We verified this isn't just us or just this source (it's a link in a NYT article to a PDF anyway, about the most safe combo I can think of)

Might be able to find the article in question by looking for NYT links posted to the subreddit recently (if the presumably-deleted archive link was posted separately as a reply).

[–] avidruntime 1 day ago

Perhaps, but it could also just be "take our word for it" devolving into more "take our extended word for it". Being prepared to make an alarming enough claim that it sparks discussion outside of the sub but being unwilling to provide evidence remains suspicious.

That suspicion becomes more grounded when the conversation with the subreddits mod regarding why the claim was made without a willingness to provide evidence looks like this:

>If you're going to make an allegation like this, it's necessary to be specific. Specifically, what is the malware, and what is the evidence that it was "injected"? This is "consult a security researcher" and "speak to the media" territory, not "mod announcement" territory.

>>No it's not. These archive sites are a legal gray area anyway. We don't have to consult anyone to decide not to allow the links. No we are not talking to the media, we're not providing research, or a proof. I'm not calling the mayor. We are reddit mods . This is purely about community management.

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

[–] Ukv 1 day ago

Found it: archive[.]is/jXv3A

Originally posted here: https://www.reddit.com/r/Seattle/comments/1xh57il/removed_by...

The "filed on Tuesday" link seems to go to gullible-thanks[.]com, which redirects to random shady sites.

[–] avidruntime 1 day ago

Reproduced on my end too.

[–] lysace 1 day ago

It looks like some reddit mods on a power trip. Zero actual evidence presented.

Edit: Now there is something here: https://www.reddit.com/r/Seattle/comments/1xhf6qp/comment/19...

[–] avidruntime 1 day ago

Is it a power trip stemming from a technical misunderstanding (archive.today exploited to deliver malware =/= archive.today attempting to deliver malware) or is it something else? In any case, reading the comments on reddit, seems like the mods are going out of their way to appeal to hysterics.

Unbelievable that the comment asking for evidence sits at -24 upvotes in that thread as of now. https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

[–] mahboi 1 day ago

Seems like the moderators don't know what's going on and are blacklisting it out of abundance of caution. Cause whether the malware comes from the archived site or the archiver itself, it means the archiver isn't safe in a way. Which is fine. It's just ridiculous that someone is asking for details and getting ostracized as a result.

[–] avidruntime 1 day ago

I disagree with your characterization of that the mods don't know what's going on.

The moderators seem to be making it quite clear: they do know what is going on and the onus is not on them to prove it, only to notify actions have been taken in response. https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

This attitude is extended when someone else asks a question about evidence, instead of replying to the question, the moderator sarcastically calls out the commentor for posting in the sub for the first time: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

The moderator conflates questions about evidence and requests for more details as "making demands" https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Its unusual and arguably suspicious because this attitude is antithetical to the stated point of the thread: To make a PSA to the community. They've also limited the comment section to only flaired users, which seems quite unusual given that this thread is ground-zero for a newsworthy claim.

[–] mahboi 1 day ago

Eh, still think simplest explanation is most likely here, which is that there's no secret motive, but the mods and some users over there are just dumb. I don't mean because they're nontechnical or don't have randomly specific web knowledge (one of them actually does), it's about how they responded to people.

[–] avidruntime 1 day ago

Now that the evidence is shared and reproducible, I agree with you. This should be an embarrassing moment for the r/seattle mods, but I somewhat doubt it will be. Glad a more level headed conversation found its way to HN.

[–] Arainach 1 day ago

What's to be embarassed? These are busy community moderators, not whitehat hackers. They don't owe anyone a writeup of technical vulnerabilities. They owe the community clear communication of rule changes and most people expect explanation of why rules were changed, and they delivered both.

[–] jrflowers 1 day ago

> This should be an embarrassing moment for the r/seattle mods, but I somewhat doubt it will be.

Imagine the shame of blocking the spread of malware before attempting to appease somebody that’s falsely accusing of you hysterics.

Every day I wake up and shake my head that another mod on the internet did something without my, the Grand Regent of Online, say so

[–] tyrabound 1 day ago

As much effort that has been put into trying to subjugate and control archive.today, it makes me immediately leery of believing any of this was some kind of deliberate thing on behalf of archive.today.

It’s not to say it’s not so, but people are fools to just chomp down on the bait.