Cool stuff but odd that Ireland has results for all but 3 counties and one of the ones missing data is Co Dublin...
I've added it to the backlog. We're also missing several other regions, but Ireland is the most obvious.
SecurityBaseline.eu
41–50 of 112 posts
Re: SecurityBaseline.eu
#42Can we start using a comma as a thousands separator instead of a period?
Re: SecurityBaseline.eu
#43Today we launch SecurityBaseline: monitoring 67.000 governments and 200.000 sites. Headlines: 3.000 governmental sites use tracking cookies illegally, over 1.000 database management interfaces are publicly reachable, 99% of governmental email is poorly encrypted.
Q: would you mark google.com with any "high risk" findings?
there are quite a few like this, that on close inspection, are just fine
Re: SecurityBaseline.eu
#44Can we start using a comma as a thousands separator instead of a period?
In most (all?) European countries comma is the decimal separator
Re: SecurityBaseline.eu
#45I hate consent banners more than tracking cookies.
Re: SecurityBaseline.eu
#46There should be a metric for sites hosting malicious content! https[:]//erasmus-plus.ec.europa.eu/sites/default/files/2026-05/mortal-kombat-2-cs.pdf
Might be worth enclosing that URL in quotes or using [dot] in the URL instead, so people don't accidentally click on that "mortal-kombat-2-cs.pdf" file that Europa.EU is hosting. VirusTotal claims the PDF file is clean, but I don't think I'd fully trust it anyway. If you do find malicious content, could be worth submitting the URLs to VirusTotal so that the domain is flagged by browsers (eg Google SafeBrowsing) and p…
The domain is legitimate though.
Re: SecurityBaseline.eu
#47I checked Warsaw, Poland.
It has 3 HIGH RISK issues because
- DNSSEC is not configured
- Few cookies are send and (ALERT!) Google marketing cookie
- Missing ROA
I get it, it's aggregator but showing red maps is at leals sensationalists
Seems that results are taken from internet.nl, which has WAY better UI than page posted.
Re: SecurityBaseline.eu
#48Might this be because any kind of genuine pentesting, unless it's explicitly been paid for, is highly illegal in countries like Germany (§ 202c StGB, § 202a StGB, etc.)? For example, I'd be more than happy to pentest some govt websites here in Germany, if the very act of visiting them with a non-standard browser couldn't somehow already be misconstrued as breaking various hacking laws. No thanks! Keep your security v…
Yeah.
And I do think that security research should have some regulation about it, but it should be more about responsible handling of the privileged access you gained, or a responsibility to disclose found vulnerabilities in private and/or to a government entity. You know, "If you have gained access to a system, and you saw a button and you pressed it, you are on the hook for the damages". That is common practice with paid pentesters already.
But we're at a point where a court had do decide if discovering an endpoint on an API without authorization is a "circumvention of a security boundary" or not. Luckily, we now have a ruling that accessing API endpoints without authorization logic is no circumvention of a security boundary, due to a lack of a security boundary like authorization.
That's the level we are at. I don't want to know what happens if foreign nation state actors start acting on this seriously.
Re: SecurityBaseline.eu
#49Cool stuff but odd that Ireland has results for all but 3 counties and one of the ones missing data is Co Dublin...
Could be that you have four councils: Dublin City Council, Dun Laoghaire/Rathdown, South Dublin, and Fingal
Re: SecurityBaseline.eu
#50Can we start using a comma as a thousands separator instead of a period?
Period is the thousands separator and comma is the decimal separator in almost all European countries.