Security nerds have launched a Gofundme to buy back securityfocus.com, a domain that hosted the Bugtraq site and more than 120,000 links from the National Vulnerability Database that are now dead.

[womble@infosec.exchange]

@briankrebs why reward the lowlifes who are squatting the name? It's not entirely dissimilar to paying ransomware. Instead, put up the site on a new domain and do a search and replace in the NVD. It doesn't fix all the other dead links out there, but it's better than paying a rentier.

[womble@infosec.exchange]

@HopelessDemigod domain squatting is against the rules. Speculation, on the other hand, is perfectly fair and reasonable.

[the_moep@mastodon.de]

@womble @HopelessDemigod
How?

[womble@infosec.exchange]

@the_moep bad people squat domains, savvy businesspeople speculate.

[ohir@social.vivaldi.net]

@briankrebs It would be way better for "security nerds" to register securityfocus.is or whatever.eu and supply the non nerd community with `s/securityfocus.com/whatever.eu/` solution.

Were times better the ACPA and pro bono lawyers would be enough.

[jorismeys@mstdn.social]

@briankrebs
Nah, not paying for thieves and opportunistic bags of shite. 175k for a domain? Hell no.

[x41h@infosec.exchange]

@briankrebs The whole vulnerability publication lifecycle is such a shit show. Vulnerability management tools are now handling their own CVE databases and enriching data without waiting for NISTs bottleneck.

[en3py@onlyarts.social]

@HopelessDemigod @briankrebs maybe someone could escalate the problem to ICANN?

Symantec is awesome at breaking down things... it almost feels like it's their mission.

Let's buy this awesome product. And ruin it.

[poing@chaos.social]

@en3py @HopelessDemigod @briankrebs

This is nothing that ICANN really has anything to do with. Unless an ICANN contracted party did something wrong or if this would fall under DNS abuse, but even then the registrar would be the one investigating. I don't think this is a case of either.

And as others already said, domain squatting is only the case if it infringes on the rights of others and us abusive. Selling domains itself does not constitute squatting.

[poing@chaos.social]

@fancysandwiches @briankrebs

Yeah I think it might have been better to try to reach out to the owners first. According to archive org, it looks like Accenture had control over the domain already in 2023, unless the subdomain redirect messed up the archives somehow.

[michael@westergaard.social]

“Lets reward domain squatting instead of running a search/replace”

[john_philip_bell@defcon.social]

@briankrebs
What am I missing here? Getting the domain back does not restore the information the links point to. Is someone saying there is a backup somewhere to restore?

Restore it (old target website) anywhere (to a new host), I've downloaded the (NVD) database for local processing many times in my life... In your own copy, search and replace the domain reference to a new host...

If this is important enough to the community at large, work on getting the NVD data itself to be updated. It is all text (once upon a time, XML, now I think JSON)

Edit: clarified 'it' as "(old target website)...(to a new host)"; and 'database' as "(NVD)"

[rusty_shackleford@colorlessgreenvoid.com]

@briankrebs
Why in the hell would you pay a squatter for a domain? Fuck that guy

[johnlogic@sfba.social]

@poing @fancysandwiches @briankrebs

Why not just fix the links and automatically point them to pages at archive org ?

[quinn@social.circl.lu]

@briankrebs Accenture. Of fucking course.

[franga2000@chaos.social]

@briankrebs fuck that, sed -i all the links in the NVD to point at archive.org and donate the 175k to them. Getting the domain won't restore the content anyways.

[rusty_shackleford@colorlessgreenvoid.com]

@franga2000 @briankrebs

This. Buying the domain from a squatter is a retard move.

[rusty_shackleford@colorlessgreenvoid.com]

@franga2000 @briankrebs
Also this is the kinda thing a scammy group of crypto bro indians in a telegram channel would do. Buy a domain, then pretend to be concerned group of internet denizens and start a gofundme to buy the domain that they now own, trick of bunch of well meaning idiots into raising the money, and profit.

I see stupid ops like this purpetrated by indians go down all time around crypto spaces.

[odr_k4tana@infosec.exchange]

@briankrebs sounds like something a big consulting firm or whatever they are would typically do for the planet.

[poing@chaos.social]

@johnlogic
Also a good idea, but likely a logistical nightmare as it involves many many different site owners/webmasters.

(hmm, do we still use that term? Feels like I haven't used it in a long time.)