search

wordpressenginetracker / wordpressenginetracker.github.io

A single-page website to publicly track the number of sites migrating away from WP Engine
15 stars 15 forks source link

Domain removal from the CSV? #20

Open simplistik opened 1 week ago

simplistik commented 1 week ago

Are we able to put in some sort of request that removes our clients or domains we own to be removed from that CSV?

Whether the request is private or public or maybe even creating an appropriate pull request, whatever the method doesn't matter to me.

Respectfully

scottlee commented 6 days ago

It can be safely assumed that several of these sites are for internal use only. Not that any malicious actor couldn't monitor domain registrations, but still, I'd like a mechanism for removing URLs.

simplistik commented 5 days ago

It does actively expose staging and development URLs which many people assume should be hard-ish to discover. A lot of people also don't put these URLs behind any type of protection for simplicity for their client(s).

image

Daniel15 commented 4 days ago

many people assume should be hard-ish to discover

@simplistik For what it's worth, the domains are likely already visible in certificate transparency logs. Every TLS certificate that's issued is logged, and there's several sites to search these logs. For example, you can use this search to find all active certificates for subdomains of .github.com: https://crt.sh/?Identity=%25.github.com&exclude=expired. The only way to avoid that is by using a wildcard certificate (e.g. if you have a certificate for *.staging.example.com and use a subdomain for every client's staging site).

simplistik commented 4 days ago

@Daniel15 yup I know and agree, but this is “curated”.