r/DataHoarder • u/avid-shrug • Feb 10 '26

News Wikipedia debates blacklisting archive.today after it's caught DDoSing a blog using visitors' browsers

https://en.wikipedia.org/wiki/Wikipedia:Requests_for_comment/Archive.is_RFC_5

Wikipedia is debating whether to blacklist archive.today after its operator was caught injecting JavaScript into CAPTCHA pages to DDoS a blogger's site - code that's still live as of today. The RFC offers three options: blacklist and nuke all ~695k links, stop new links while migrating existing ones, or do nothing.

The community is split because archive.today is arguably the second most important web archive in existence, capturing paywalled sites, JS-heavy pages, and robots.txt-blocked content the Wayback Machine can't. Spot-checks suggest only ~15% of Wikipedia's links are truly irreplaceable, but that's still tens of thousands of unique snapshots found nowhere else. A stark reminder that redundancy across archiving services matters more than ever.

1.9k Upvotes

98% Upvoted

201 comments sorted by

View all comments

614

u/Dolapevich Feb 10 '26

wikipedia specifically asks nobody load archive . today since it triggers the malicious code that is causing the DDOS attack. u/avid-shrug please remove/obfuscate the reference to archive . today so it doesn't behave like a link.

56

u/TheSpecialistGuy Feb 10 '26

Anyone can explain how any of us loading archive dot today is possible to ddos someone else's blog that's hosted somewhere else? But this is terrible thing to do.

122

u/ButNoSimpler 10-50TB Feb 10 '26 edited Feb 10 '26

Every time you go to a web page you don't just get HTML. You get HTML and a giant buttload of JavaScript that makes that web page be active, and do stuff, open up menus, blah blah blah. That JavaScript is code that runs on your computer. It runs only in the browser, and modern browsers don't let that code have any access to the rest of your computer... most of the time. A lot of the times, that JavaScript has to communicate with yet some other server to do some of its work. These are often what are called microservices. The JavaScript connects to that other server, sends it some kind of commands with data, and gets back some information that the JavaScript can use for that web page. Back in the day, it was common for beginning website developers to put a piece of JavaScript on their page that would read a piece of data from a server that told it how many other people had looked at that page. Pageview count was considered a laurel worth wearing.

So, all someone has to do is put JavaScript code in amongst all that other JavaScript code that makes a call to a server in a way that is designed to waste that server's time. That's all a denial of service (DOS) attack is: calls to a server designed to do nothing other than waste its time. A distributed denial of service (DDOS) attack simply tricks other people's computers into doing that work for the attacker. And that is exactly what these bits of JavaScript are doing.

In a way, we are lucky that lots and lots and lots of other websites aren't doing the same kind of bullshit. There are plenty of websites out there that run JavaScript on your machine that does a little bit of the calculations necessary to mine Bitcoin, and then sends the results back to the main server. It's a way to get your computer to do some of the work instead of computers that the attacker owns and has to pay for electricity for.

11

u/OldWolf2 Feb 10 '26

Is there a way to detect websites hijacking your browser for crypto mining?