alt Hacker News> Then: \n\n either web admin notices and fixes website \n\n or people stop visiting them
Okay so let's say this is your site. You notice that Firefox gives a warning, you find the issue, remove the malicious dependency and roll out the new version. Now what? Who do you talk to to get unblocked?
I run a site that's on blocklists. There's no coming off of them once you're there (described elsewhere in this thread: https://news.ycombinator.com/item?id=50398014). These mechanisms are useful for sites that are unmaintained, but I'd not wish it upon admins that immediately respond to vulnerability or abuse reports
I can understand that most people are not aware of this though, just a bit frustrating to see the call for nuking it altogether. It's not what you'd do if one of these 15000 sites was Onedrive: you'd realise the solution is talking to Microsoft. Only when they don't fix their infection would it make sense to take their site offline
Most people use Chrome with default settings, maybe with some extra AV as well. These websites are going to get added to the list anyway.
Perhaps a coordinated attempt with CERTs or a basic attempt at email contact would be a good idea, but if emails are nowhere to be seen and there is no way to determine a relevant taskforce, reporting the domains seems like the obvious problem.
Getting blocklisted sucks, but so does identity theft, drive-by malware, and credit card fraud. Without things like SECURITY.txt or contact email addresses, there's not a lot more you can do to prevent these people from (unwittingly? intentionally?) spreading harm.