edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.
no one can view old.reddit.com w/o being authorized. idk if you're aware, but it lost a lot of appeal as such. what i'm saying is, folks can view reddit.com w/o logging in, but not old.reddit.com
Personally, as scummy as archive.today is at times, I can generally trust them to have an honest archive about, say, someone’s drunk post before said drunk deletes the post.
Not sure what to believe here. Wouldn't it be possible to create a site that has some js embedded that is able to be aware of archive's process so that the archived page renders a different page than the original? Could that secondary page be what is trying to deliver the malware, using archive as an unwitting laundry? That matches the MO of malware delivery via other services, no? I'm baffled as to why the mods don't provide any details whatsoever. There are more links to the controversy between the blogger who sought archive's webmasters identity than details of this incident. The mods in this subreddit are doubling down on not sharing details under the guise of "not our job to be infosec". Perhaps a write up is in due time but at the moment this feels like a sketchy extension of the aforementioned drama
Seems unlikely to be the case here if what one of the mods said is true:
> We verified this isn't just us or just this source (it's a link in a NYT article to a PDF anyway, about the most safe combo I can think of)
Might be able to find the article in question by looking for NYT links posted to the subreddit recently (if the presumably-deleted archive link was posted separately as a reply).
Perhaps, but it could also just be "take our word for it" devolving into more "take our extended word for it". Being prepared to make an alarming enough claim that it sparks discussion outside of the sub but being unwilling to provide evidence remains suspicious.
That suspicion becomes more grounded when the conversation with the subreddits mod regarding why the claim was made without a willingness to provide evidence looks like this:
>If you're going to make an allegation like this, it's necessary to be specific. Specifically, what is the malware, and what is the evidence that it was "injected"? This is "consult a security researcher" and "speak to the media" territory, not "mod announcement" territory.
>>No it's not. These archive sites are a legal gray area anyway. We don't have to consult anyone to decide not to allow the links. No we are not talking to the media, we're not providing research, or a proof. I'm not calling the mayor. We are reddit mods . This is purely about community management.
Is it a power trip stemming from a technical misunderstanding (archive.today exploited to deliver malware =/= archive.today attempting to deliver malware) or is it something else? In any case, reading the comments on reddit, seems like the mods are going out of their way to appeal to hysterics.
I think the moderators just don't know what's going on and are blacklisting it out of abundance of caution. Cause whether the malware comes from the archived site or the archiver itself, it means the archiver isn't safe in a way. Which is fine. It's just ridiculous that someone is asking for details and getting ostracized as a result.
I read through the comment thread there. There's almost no explanation of what's going on, not even the offending URL. When someone asked, he got downvoted a bunch and ridiculed, which reminds me of why I don't have a Reddit account. I don't trust archive.today because of its track record but don't trust this particular allegation either. The news is simply that a subreddit moderator blacklisted archive.today.
I think it's a shame that copyright laws don't allow us to host a non shady alternative to this. The only reason people use such dubious sites is that there's no other way to share a link to a news site without risking that the text will be altered later or hidden behind a paywall.
One legal way to share news stories which generate controversy is to have an AI make a summary of the article, rewording it to remove any copyright from the article (this legal trick only works when the news site in question is reporting on factual events, since facts can’t be copied as per Feist vs. Rural 1991, and I make sure that the summary has “a different sequence, pace, and setting than the original article” as per legal judgments on whether an AI summary of factual events as reported by a news source is subject to copyright).
not sure why this is downvoted. they modified their captcha so that visitors contributed to a ddos against a blog, on top of a handful of other threats, tampering of archived data, etc.
As a personal vendetta against Jani Patokallio (a Finnish cybersecurity blogger) who was trying to unmask the person who ran the site - which goes back to 2023.
I don't really care about that though, because trying to dox someone and get them killed isn't a good or moral thing to do. You could easily just not do that. You have to really go out of your way to try and hunt someone down, and at any point you could just not do it. For the targeted person to want revenge is just an inevitability.
There's been quite a lot of people still defending the site. Basically "who cares about DDoS attacks and altering archived sites' content when it allows bypassing paywalls?"
Setting my user-agent to Googlebot in a private window bypasses most paywalls just fine. Surprised at how many sites aren't checking against the published IP ranges.
Residential proxies DDoSing half the internet is standard operating procedure this decade and yet everyone still buys connected garbage and monetizes their apps this way.
Disappointing but not that surprising; it's been banned from Wikipedia for months because it was enlisting viewers' computers in a DDoS against an investigative journalist for trying to figure out who was behind it. But it's the only way I've found to access a lot of information that is otherwise lost. So, what do we do?
That's been my nagging fear about them too. Obviously it's not an option they'd want to exercise frequently, but it could be devastating to individual targets.
(ofc this is a risk with the Wayback Machine, who also has a policy for honoring takedown request. But the Internet Archive's board and executives are known people with reputations)
Until somebody invents a solution for bypassing paywalls at scale, they are not going away. It's like people asking "why don't AI companies release their training data".
Link to comment explaining the discovery:
https://old.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.
I'm confused though, it says the site injected malware into its archived form. But the HN title says archive.today injected the malware.
The claim is that archive.today is injecting malware into archived pages. Given some of the past behavior, this is not hard to believe.
Idk, maybe this is just a typo, but grammatically this is saying the article injected the links.
(To be fair, that isn't the only redirect so you might need to click it a few times.)
Archive.today is directing a DDoS attack against my blog https://news.ycombinator.com/item?id=46843805 (8 months ago, 366 points, 178 comments)
Ask HN: Weird archive.today behavior? https://news.ycombinator.com/item?id=46624740 (9 months ago, 140 points, 71 comments)
https://en.wikipedia.org/wiki/ClickFix
https://archive.ph/HcOq2 (This is a link to the post for this article)
(If one’s ISP can’t access archive.today, I find that Firefox’s built in free VPN can usually access them)
Or, you can use on of the various Reddit scrapers, e.g:
https://redlib.catsarch.com/r/Seattle/comments/1xhf6qp/archi...
Here’s a list of Reddit scrapers:
https://github.com/redlib-org/redlib-instances/blob/main/ins...
Personally, as scummy as archive.today is at times, I can generally trust them to have an honest archive about, say, someone’s drunk post before said drunk deletes the post.
Previous HN thread:
https://news.ycombinator.com/item?id=46624740
> We verified this isn't just us or just this source (it's a link in a NYT article to a PDF anyway, about the most safe combo I can think of)
Might be able to find the article in question by looking for NYT links posted to the subreddit recently (if the presumably-deleted archive link was posted separately as a reply).
That suspicion becomes more grounded when the conversation with the subreddits mod regarding why the claim was made without a willingness to provide evidence looks like this:
>If you're going to make an allegation like this, it's necessary to be specific. Specifically, what is the malware, and what is the evidence that it was "injected"? This is "consult a security researcher" and "speak to the media" territory, not "mod announcement" territory.
>>No it's not. These archive sites are a legal gray area anyway. We don't have to consult anyone to decide not to allow the links. No we are not talking to the media, we're not providing research, or a proof. I'm not calling the mayor. We are reddit mods . This is purely about community management.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Unbelievable that the comment asking for evidence sits at -24 upvotes in that thread as of now. https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
they are not great people.
I think there is a confusion of blogger with a registered journalist, who must follow journalist's (ethic) rules.
(ofc this is a risk with the Wayback Machine, who also has a policy for honoring takedown request. But the Internet Archive's board and executives are known people with reputations)
* https://news.ycombinator.com/item?id=47092006#47100204
* https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-a...