Security SQL: final queries

[tomvangoethem]

Progress on #906

[tomvangoethem]

I'm guessing that the failed checks are unrelated to this particular pull request? The reported error is:

Error: Unable to process command '::add-path::/opt/hostedtoolcache/node/12.19.0/x64/bin' successfully.
Error: The `add-path` command is disabled. Please upgrade to using Environment Files or opt into unsecure command execution by setting the `ACTIONS_ALLOW_UNSECURE_COMMANDS` environment variable to `true`. For more information see: https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/

[tunetheweb]

Just merged a fix (#1535) into main. Can you update your branch?

[tomvangoethem]

Yep, that fixed it 👍

[rviscomi]

@tomvangoethem please see @bazzadp's feedback. We should merge this ASAP.

[tomvangoethem]

Will fix it tomorrow!

[tomvangoethem]

Updated cryptominer query. However, as @bazzadp mentioned, the number looks very low. Looking into that right now.

[tomvangoethem]

Coinhive: shut down
CoinImp: potentially outdated URL pattern in Wappalyzer. Based on the documentation, it should be ^https://www\.hostingcloud\.racing/.+\.(js|wasm) - I get 167 pages with this for desktop; Wappalyzer reports 175 (sets could be mutually exclusive though)
WebMinePool: some 67 desktop pages include https://webminepool.com/lib/base.js - not considered by Wappalyzer
JSECoin: shut down in April 2020

From the paper "Is Cryptojacking Dead after Coinhive Shutdown?":

The results revealed that 99% of sites no longer continue cryptojacking.

So it seems that cryptojacking is not financially viable any more (because of hard fork that caused a 50+% drop in hash rate, and the drop in value of XMR), which makes me think that the results are more or less representative

[tunetheweb]

LGTM. A few very minor nits.

This good to merge?

[tomvangoethem]

Yep, good to merge I think. That should be it for Security SQL 🥳

[tunetheweb]

Great stuff. Now just to write the thing 😁