decision: the phishing blocklist URL embeds a competitor's org name, and its documented upstream no longer exists #219

New Issue

clawbot · 2026-08-11T14:41:30+02:00

clawbot commented

2026-08-11 14:41:30 +02:00

BLOCKLIST_URL at src/shared/phishingDomains.js:17 embeds a competitor's org name in the URL string. RULES.md:121 bars competitor names in code and documentation, and says the code must change to match the rule. The same name appears in a comment at tests/e2e/network.js:274.

There is no drop-in replacement: AugurProject/eth-phishing-detect, which README.md and LICENSE:685 both cite as the source, returns 404 — that repo is gone. The competitor's org fork is the only live upstream, so the vendored phishingBlocklist.json can only have come from there. Established while correcting the README in #213, which removed the dead link but deliberately left the code and the LICENSE line alone.

This is not the same question as the isMetaMask shim in #165: that one is a protocol identifier dApps feature-detect, whereas this is a hostname we choose to fetch from, and we could choose otherwise.

Options

(a) Mirror the list under your own host and fetch from there. Removes the name, removes a third-party runtime dependency for a security-relevant feed, and puts the update cadence under your control. Costs hosting and a refresh mechanism, and makes you responsible for staleness — a stale phishing list is a silent safety regression.
(b) Keep fetching upstream and document an explicit exception, as the Crypto Policy already does for sanctioned exceptions. Zero engineering cost; leaves the name in shipped code.
(c) Assemble the URL from parts so the literal name does not appear. Satisfies a grep and nothing else — the request still goes to the same host and any reader sees it immediately.

Recommendation

(a). A wallet's anti-phishing feed is security-relevant infrastructure, and fetching it from a competitor's repository means they can change what your users are warned about. The naming rule is the smaller reason to move it. If the hosting cost is unwanted, (b) is honest and defensible; (c) is not — it hides the fact rather than changing it.

Whichever you pick, LICENSE:685 needs its dead AugurProject URL corrected in the same unit.

Definition of done (once decided)

grep -ri for the competitor name across the repo returns only the deliberate isMetaMask shim in src/content/inpage.js, or documented exceptions.
LICENSE:685 no longer cites a URL that 404s.
The blocklist still loads and the phishing warnings still fire, proven in the e2e harness.
TODO.md updated in the same commit.
make check passes.

`BLOCKLIST_URL` at `src/shared/phishingDomains.js:17` embeds a competitor's org name in the URL string. `RULES.md:121` bars competitor names in code and documentation, and says the code must change to match the rule. The same name appears in a comment at `tests/e2e/network.js:274`. There is no drop-in replacement: `AugurProject/eth-phishing-detect`, which `README.md` and `LICENSE:685` both cite as the source, returns **404** — that repo is gone. The competitor's org fork is the only live upstream, so the vendored `phishingBlocklist.json` can only have come from there. Established while correcting the README in https://git.eeqj.de/sneak/AutistMask/issues/213, which removed the dead link but deliberately left the code and the `LICENSE` line alone. This is not the same question as the `isMetaMask` shim in https://git.eeqj.de/sneak/AutistMask/issues/165: that one is a protocol identifier dApps feature-detect, whereas this is a hostname we choose to fetch from, and we could choose otherwise. ## Options - **(a) Mirror the list under your own host** and fetch from there. Removes the name, removes a third-party runtime dependency for a security-relevant feed, and puts the update cadence under your control. Costs hosting and a refresh mechanism, and makes you responsible for staleness — a stale phishing list is a silent safety regression. - **(b) Keep fetching upstream and document an explicit exception**, as the Crypto Policy already does for sanctioned exceptions. Zero engineering cost; leaves the name in shipped code. - **(c) Assemble the URL from parts** so the literal name does not appear. Satisfies a grep and nothing else — the request still goes to the same host and any reader sees it immediately. ## Recommendation **(a).** A wallet's anti-phishing feed is security-relevant infrastructure, and fetching it from a competitor's repository means they can change what your users are warned about. The naming rule is the smaller reason to move it. If the hosting cost is unwanted, **(b)** is honest and defensible; **(c)** is not — it hides the fact rather than changing it. Whichever you pick, `LICENSE:685` needs its dead `AugurProject` URL corrected in the same unit. ## Definition of done (once decided) - [ ] `grep -ri` for the competitor name across the repo returns only the deliberate `isMetaMask` shim in `src/content/inpage.js`, or documented exceptions. - [ ] `LICENSE:685` no longer cites a URL that 404s. - [ ] The blocklist still loads and the phishing warnings still fire, proven in the e2e harness. - [ ] `TODO.md` updated in the same commit. - [ ] `make check` passes.

clawbot added this to the 1.0.0 milestone 2026-08-11 14:41:30 +02:00

sneak was assigned by clawbot

2026-08-11 14:41:30 +02:00

clawbot referenced this issue

2026-08-12 13:26:58 +02:00

milestone 1.0.0: approval-path security, build-integrity guard, e2e harness and filter coverage #190

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/AutistMask#219