SurfPatrol

» see surfpatrol.ru as it lived, on the wayback machine

~ the obit ~

Positive Technologies announced SurfPatrol on 10 September 2010. It was one page in Moscow that you opened in whichever browser you were worried about, and it told you which of your plugins could be turned against you. Free, no registration, Russian and English with the language picked automatically. Sergey Gordeychik, the company's technical director, said the technique had been sitting inside their penetration tests since 2006 and that they had published a technology preview of it in early 2009 before turning it into a public service.

The engine came out of MaxPatrol, the company's commercial scanner, and the vulnerability data came out of its research lab. What SurfPatrol did with that data was the part worth remembering. Most tools of the period asked whether an update had been installed. SurfPatrol matched the version it detected against its own list of known holes instead, which produces a different answer. A fully current plugin came back red if a hole in it had no fix yet, and something badly out of date passed if nobody had ever found anything in it. Zero days got their own warning, above the ordinary red.

Coverage was wide for a free page. Internet Explorer from version 6, Safari from 3, every Firefox and every Chrome, Opera from 9.5. Windows, macOS, iOS and Android were all in scope, with Ubuntu promised and never shipped. There were extensions for Chrome and Opera that ran the scan when the browser started and turned the toolbar icon red with a count on it, blue when you were clean. Site owners could paste in a banner that offered their visitors the same check. In September 2012 the whole thing got a redesign, accounts and a forum, which is the point at which a utility starts trying to be a destination.

Russian Wikipedia's own criticism section is unkind and mostly correct. The method was primitive: it read the user agent string rather than asking the browser anything, so it could be lied to by a single header, and it never enumerated everything you actually had installed. You also had to open the site again in every browser you cared about, one at a time, because the page could only see the one that had requested it.

~ the rap sheet ~

~ the number ~

Positive Technologies published the 2011 aggregate on Habr in April 2012 and it is the only real statistic the service ever produced. Eighty nine percent of surfers arrived with at least one vulnerability somewhere in the browser and plugin stack. Nearly half had more than three. Broken out by browser alone: Internet Explorer 62 percent, Chrome 30, Firefox 22, Safari 21, Opera 17. Once plugins were counted the numbers stopped flattering anybody, with Windows Chrome at 75 percent and Windows Internet Explorer at 79.

That is the whole argument of the plugin era in one table. The browser was being patched on a schedule by people who cared, and the things bolted into it were not. No user count, install count or check count was ever published, and the absence of public scan statistics is listed on the Russian article as one of the service's shortcomings, which is a fair thing to hold against a project whose only output was statistics.

~ the distance ~

By 2010 I had been on TTNet broadband for four years and the thing I was nervous about was exactly what this page measured. Flash and Java sat inside the page holding the permissions of a local program, and updating them was a manual chore you did when something broke. The versions of this idea I would have run into were Mozilla's plugin check page and the Secunia inspector, in English, in a browser pointed at the English web. SurfPatrol was the same product built for people who read Russian, from a vendor whose name did not mean anything outside its own market for another decade, until Positive Technologies turned up on a United States sanctions list in 2021 and became internationally legible for entirely different reasons.

~ how it went dark ~

There is no closure announcement. Not from the company, not on Habr, not on any of the Russian security outlets that had covered it for seven years. The date on Wikipedia was added in May 2025 by an editor who wrote plainly in the edit summary that he had gone by the last web archive snapshot, and that guess lands a few days early. The homepage's final capture is 23 January 2018, but the report page itself was still working and still being crawled on 26 January, with the application's own error page captured twice on the 25th in between. Compare the December 2017 homepage against the January 2018 one and the only difference is the copyright year rolling over on its own.

So it looked completely healthy until the week it was not there. The domain is still registered to Positive Technologies, still paid up, still resolving to an address inside the company's own network block in Moscow, with nothing listening on either port. The Chrome extension has been delisted and the Opera add-on page returns a 404. Eight years of a vendor quietly renewing a domain for a thing it switched off without telling anyone.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »