Archive.today = archive.is - which is added via comment on a huge percentage of posts on HN.
Link to comment explaining the discovery:
https://old.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.
From historical posts on HN:
Archive.today is directing a DDoS attack against my blog https://news.ycombinator.com/item?id=46843805 (8 months ago, 366 points, 178 comments)
Ask HN: Weird archive.today behavior? https://news.ycombinator.com/item?id=46624740 (9 months ago, 140 points, 71 comments)
For everyone's information: r/Seattle's mod team has stickied this technical debrief in response to this HN post. We are the "external site" that is kinda brigading them.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
The only thing I'd add is that I see redirects to at least two domains:
> DDoS
I presumed DDoS was used colloquially, but no, they literally added JS so every visitor made a request every 0.3 seconds to that blog server, in response to a blog article. Wholly malicious based on the reporting.
Wasn't the "victim" trying to get the "attacker" life in prison for the crime of archiving public information?
What is this referring to? I tried to find when Jani Patokallio tried to get the people behind archive.today imprisoned, but can't find anything.
Yeah, everyone is freaking out about the (not very efficient as I can see) DDoS attempt, but it was a response to a totally unprovoked attempt to deanon the maintainer which could cost them freedom at least - and us all the only more or less reliable paywall remover.
I don't really care about the motivation? Malware is malware.
To make my edit in the parent clear: HN mods have changed the title, to the exact title of the post reddit on r/seattle. This is understandable.
I always respect the "don't editorialize" rule, but felt that this was a special case as the post title is so sub-reddit specific. My original post title was along the lines of "r/Seattle mods discover archive.today injecting malware, ban site.
Version that doesn't require login: https://reddit.com/r/Seattle/comments/1xhf6qp/archivetoday_l...
I'm confused though, it says the site injected malware into its archived form. But the HN title says archive.today injected the malware.
You said the same thing twice. “The site” == archive.today
The claim is that archive.today is injecting malware into archived pages. Given some of the past behavior, this is not hard to believe.
The archive.today site is the one injecting the malware, not the site being archived.
"It was discovered by a member of the mod team today that an article archived by archive.today had injected malware links into the archived article."
Idk, maybe this is just a typo, but grammatically this is saying the article injected the links.
Go to https://archive.ph/jXv3A#selection-5079.208-5079.212 Click on "Filed on Tuesday" and it will redirect you to a site telling you to download something.
(To be fair, that isn't the only redirect so you might need to click it a few times.)
It immediately stands out that that link is to a /wp-content URL. AKA wordpress. AKA PHP. AKA very recently vulnerable (and perhaps still)...
Whereas other links (e.g. the immediate next one to arxiv) seem unaffected.
edit: That was a red herring. It seems to redirect all .pdf links I try that don't point to a valid snapshot. Very interesting.
Thanks, that's pretty much all I was looking for. Was able to reproduce but then started getting 429s.
I reproduced it too but was hoping to get a log, now all I get is 429 as well.
Just for the sake of preserving what I did see, the URL linked in the text was:
and that now seems to have been purged from the archive.today cache, as this page says "No results":https://archive.ph/https://schenklawfirm.com/wp-content/uplo...
You get 429 if you visit the link directly. Not sure what mechanism is used to tell that, doesn't seem to be the referrer though. This does the refresh to the malware site:
Interesting. Same behavior here with a generic User-Agent and no Cookie header at all.
Response headers mention an onion-location and link to stolidityseashellshotter... but also mementoweb... pretty strange. Most generously, maybe some kind of cache poison instead of explicit bad behavior?
The page has other links that all go to archive.today. Seems like any link to a PDF causes this to happen. https://archive.ph/Y6BOX near "Download the PDF, which contains the dolls and all of the looks, here." Wonder if it's all links in general that aren't archived.
This looks like some kind of misconfiguration more than intent, or a mix, but it's still bad.
Wow, yeah, same two redirects for that PDF link. Geez. It'd sure be interesting to know the full cause here, otherwise it really destroys a lot of trust in the tool.
Edit: It sure does seem to be a PDF problem, these were both NYT things, but I tried a CCC talk page that had a slides link and sure enough, same behavior.
[dead]
I think they meant it as in "an article archived by archive.today had malware links injected into the archived article."
TIL; I always thought it was part of archive.org and I never understood why people hated it. Now I get it
no one can view old.reddit.com w/o being authorized. idk if you're aware, but it lost a lot of appeal as such. what i'm saying is, folks can view reddit.com w/o logging in, but not old.reddit.com
Lemmy is shaping up to be the reddit replacement.
And it is federated so when the biggest Lemmy instance starts to suck, Lemmy can be the Lemmy replacement, too.
I understand that mentioning it on popular subreddits is verboten.
https://lemmy.world/
Thanks for the reminder. Theoretically, I know this, but it’s a really hard habit for me to drop.
you used to be able to set the redesign_optout cookie to true, but that doesnt seem to work anymore as of like a day ago for me
They just demoed an entirely new version of Old Reddit at ModWorld. Same front-end but runs on the New Reddit backend.
Is that the version that looks like old reddit, but also only loads just as few comments as new reddit, and just as few nesting layers?
The fact that only some comments are loaded it's so infuriating. It's the main reason I stopped using Reddit altogether.
> Same front-end but runs on the New Reddit backend.
That's the entire reason I use old.reddit - the New Reddit backend is a pile of unreliable dung. Just like everything that is made with GraphQL.
Looks like ClickFix impersonating GitHub
https://en.wikipedia.org/wiki/ClickFix
Ahh thanks... I hadn't heard of "clickfix" before.
it's the worst possible malware. very deceptive
Hmmm... any other day I'd think that I need archive.today to get past reddit's login wall to read that.
You wouldn't have, if I could get out of the habit of posting old.reddit links.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
And, indeed, you can use archive.today to get past the login wall:
https://archive.ph/HcOq2 (This is a link to the post for this article)
(If one’s ISP can’t access archive.today, I find that Firefox’s built in free VPN can usually access them)
Or, you can use on of the various Reddit scrapers, e.g:
https://redlib.catsarch.com/r/Seattle/comments/1xhf6qp/archi...
Here’s a list of Reddit scrapers:
https://github.com/redlib-org/redlib-instances/blob/main/ins...
Personally, as scummy as archive.today is at times, I can generally trust them to have an honest archive about, say, someone’s drunk post before said drunk deletes the post.
You can just not use old.reddit.com. Regular reddit.com works without login.
Old still exists and gets heavy use a decade or so later exactly because regular reddit just doesn't work at all, even when you're logged in.
But even aside from opinions on their UX, they're aggressively experimenting with the login more... Even on the new UI I now semi-regularly see that I can read the initial post and one or two comments but as soon as I scroll past or try to expand a comment thread get a login prompt.
Maybe this will be enough to finally rule against paywalled submissions here on HN.
that is almost everything nowadays though. and not all paywall sites give paywalls all the time