edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.
no one can view old.reddit.com w/o being authorized. idk if you're aware, but it lost a lot of appeal as such. what i'm saying is, folks can view reddit.com w/o logging in, but not old.reddit.com
Not sure what to believe here. Wouldn't it be possible to create a site that has some js embedded that is able to be aware of archive's process so that the archived page renders a different page than the original? Could that secondary page be what is trying to deliver the malware, using archive as an unwitting laundry? That matches the MO of malware delivery via other services, no? I'm baffled as to why the mods don't provide any details whatsoever. There are more links to the controversy between the blogger who sought archive's webmasters identity than details of this incident. The mods in this subreddit are doubling down on not sharing details under the guise of "not our job to be infosec". Perhaps a write up is in due time but at the moment this feels like a sketchy of the aforementioned drama
Is it a power trip stemming from a technical misunderstanding (archive.today exploited to deliver malware =/= archive.today attempting to deliver malware) or is it something else? In any case, reading the comments on reddit, seems like the mods are going out of their way to appeal to hysterics.
I think it's a shame that copyright laws don't allow us to host a non shady alternative to this. The only reason people use such dubious sites is that there's no other way to share a link to a news site without risking that the text will be altered later or hidden behind a paywall.
Residential proxies DDoSing half the internet is standard operating procedure this decade and yet everyone still buys connected garbage and monetizes their apps this way.
not sure why this is downvoted. they modified their captcha so that visitors contributed to a ddos against a blog, on top of a handful of other threats, tampering of archived data, etc.
There's been quite a lot of people still defending the site. Basically "who cares about DDoS attacks and altering archived sites' content when it allows bypassing paywalls?"
Disappointing but not that surprising; it's been banned from Wikipedia for months because it was enlisting viewers' computers in a DDoS against an investigative journalist for trying to figure out who was behind it. But it's the only way I've found to access a lot of information that is otherwise lost. So, what do we do?
That's been my nagging fear about them too. Obviously it's not an option they'd want to exercise frequently, but it could be devastating to individual targets.
(ofc this is a risk with the Wayback Machine, who also has a policy for honoring takedown request. But the Internet Archive's board and executives are known people with reputations)
Until somebody invents a solution for bypassing paywalls at scale, they are not going away. It's like people asking "why don't AI companies release their training data".
Archive.today = archive.is - which is added via comment on a huge percentage of posts on HN.
Link to comment explaining the discovery:
https://old.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.
From historical posts on HN:
Archive.today is directing a DDoS attack against my blog https://news.ycombinator.com/item?id=46624740 (9 months ago, 140 points, 71 comments)
Version that doesn't require login: https://reddit.com/r/Seattle/comments/1xhf6qp/archivetoday_l...
I'm confused though, it says the site injected malware into its archived form. But the HN title says archive.today injected the malware.
You said the same thing twice. “The site” == archive.today
The claim is that archive.today is injecting malware into archived pages. Given some of the past behavior, this is not hard to believe.
The archive.today site is the one injecting the malware, not the site being archived.
3 replies →
TIL; I always thought it was part of archive.org and I never understood why people hated it. Now I get it
Looks like ClickFix impersonating GitHub
https://en.wikipedia.org/wiki/ClickFix
no one can view old.reddit.com w/o being authorized. idk if you're aware, but it lost a lot of appeal as such. what i'm saying is, folks can view reddit.com w/o logging in, but not old.reddit.com
Thanks for the reminder. Theoretically, I know this, but it’s a really hard habit to get out of.
you used to be able to set the redesign_optout cookie to true, but that doesnt seem to work anymore as of like a day ago for me
Hmmm... any other day I'd think that I need archive.today to get past reddit's login wall to read that.
Not sure what to believe here. Wouldn't it be possible to create a site that has some js embedded that is able to be aware of archive's process so that the archived page renders a different page than the original? Could that secondary page be what is trying to deliver the malware, using archive as an unwitting laundry? That matches the MO of malware delivery via other services, no? I'm baffled as to why the mods don't provide any details whatsoever. There are more links to the controversy between the blogger who sought archive's webmasters identity than details of this incident. The mods in this subreddit are doubling down on not sharing details under the guise of "not our job to be infosec". Perhaps a write up is in due time but at the moment this feels like a sketchy of the aforementioned drama
It looks like the some reddit mods on a power trip. Zero actual evidence presented.
Is it a power trip stemming from a technical misunderstanding (archive.today exploited to deliver malware =/= archive.today attempting to deliver malware) or is it something else? In any case, reading the comments on reddit, seems like the mods are going out of their way to appeal to hysterics.
Unbelievable that the comment asking for evidence sits at -24 upvotes in that thread as of now. https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
I think it's a shame that copyright laws don't allow us to host a non shady alternative to this. The only reason people use such dubious sites is that there's no other way to share a link to a news site without risking that the text will be altered later or hidden behind a paywall.
They really need to show some evidence for this! Just this suggestion means I won't ever use it again
That sucks I guess but until there’s an alternative I don’t really care.
The writing had been on the wall for a while. Hopefully this'll finally drive the usage of the site down.
What are the alternatives besides the IA?
Surprised that using visitors for DDoS attacks wasn't enough already.
Residential proxies DDoSing half the internet is standard operating procedure this decade and yet everyone still buys connected garbage and monetizes their apps this way.
not sure why this is downvoted. they modified their captcha so that visitors contributed to a ddos against a blog, on top of a handful of other threats, tampering of archived data, etc.
they are not great people.
2 replies →
There's been quite a lot of people still defending the site. Basically "who cares about DDoS attacks and altering archived sites' content when it allows bypassing paywalls?"
2 replies →
Disappointing but not that surprising; it's been banned from Wikipedia for months because it was enlisting viewers' computers in a DDoS against an investigative journalist for trying to figure out who was behind it. But it's the only way I've found to access a lot of information that is otherwise lost. So, what do we do?
for anyone interested, here's a writeup of the DDoS story: https://web.archive.org/web/20260203073744/https://gyrovague...
Weren't they also caught modifying their "archived" content?
That's been my nagging fear about them too. Obviously it's not an option they'd want to exercise frequently, but it could be devastating to individual targets.
(ofc this is a risk with the Wayback Machine, who also has a policy for honoring takedown request. But the Internet Archive's board and executives are known people with reputations)
On modifying bits, see perhaps this comment from a discussion ~8 months ago:
* https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-a...
1 reply →
You keep using it as normal and if it tells you to copy and paste commands into your terminal you DO NOT do it?
tbh yeah, this isn't my first time visiting a sketchy website and won't be my last
Until somebody invents a solution for bypassing paywalls at scale, they are not going away. It's like people asking "why don't AI companies release their training data".
[flagged]
[dead]
[dead]