Saying they detected malware already does that.
Being slightly more specific shouldn't be a problem.
Being slightly more specific shouldn't be a problem.
Saying "we know you are compromised and know exactly where, but we're not going to tell" is very childish. Now, if they said for a nomial fee, we'd be happy to share the results of our work, would be another thing totally.
The sad think is they didn't even tell that, they gave the admins no ways to be able to differentiate between:
- we don't care if we destroy your company with a false positive and
- we are sure we are right, if you didn't do it intentionally you are probably compromised
Are you saying that if you have this info correctly set up, these companies can verify your email domain is the same to provide assistance? What does law enforcement do with this info?
Email domains aren't always match with domains running the web-site (don't forget only ten years ago www. was still expected and people redirected you there from non-www. name).
But having access to DNS zone you can prove 'ownership' (at least technical) of the domain (even if it doesn't have the associated MX records for e-mail), precisely why LE is doing it.
> by copying&pasting whatever the original certbot
> I have no idea what they do, who can read them, when, where, why, etc
Oh my...
> Are you saying that if you have this info correctly set up, these companies can verify your email domain is the same to provide assistance?
More like "to prove you are the one responsible for tailspintoys.com - create a TXT record under that domain with 'dylan604 is admin here'".
> I have no idea what they do
TXT records are just plain text strings (in ASCII), nothing more, nothing less.
> who can read them, when, where, why
Everyone, anytime, anywhere, because it is you who placed it there in a system of Public DNS servers
I've been in the situation where a company kinda 'ghosts' me before. And found out I was indeed the bad player (unintentionally, of course).