Hacker News Reader

I don't understand why they didn't first contact the website owners. Isn't this exactly what the WHOIS technical contact is for?

View on HN

There are too many names on that list - not to contact, but to trust. To everyone that you give secret advance notice, you're potentially handing a zero-day.

That's true. Have they contacted them now? Do these places which will only fix a problem if they're shamed into it actually know that they are on the wall of shame?

More to the point: has a widespread public vulnerability ever before been released alongside a list of everyone who is vulnerable to it? I can't recall such a thing ever happening.

The same folks providing the list this time around also made one for Heartbleed. It was posted roughly the same time as the initial disclosure, from what I recall.

http://web.archive.org/web/20140411064356/https://zmap.io/he...

So they did, I wasn't aware of that.

This sort of proves my point from another comment: they stopped updating the list shorting after it was posted, and so all of these domains are forever stuck on the shame list.

Viewing domains from the Alexa top 1M list so many times today also makes it very clear that it is total crap.

One cannot realistically expect a secret to remain with that many people.

Reply on news.ycombinator.com