GCHQ's Boiling Frogs paper on software development • Hacker News Board

Re: GCHQ's Boiling Frogs paper on software development

#11

Post by jjp » Mon, May 16, 2016, 9:02 AM UTC

cm3 wrote: post #5

Wait, the GCHQ has a GitHub profile where they share a Graph Database engine. Interesting.

Think it was announced a few months ago - https://news.ycombinator.com/item?id=10732609

Re: GCHQ's Boiling Frogs paper on software development

#12

Post by tomelders » Mon, May 16, 2016, 9:02 AM UTC

matthewmacleod wrote: post #10

cyberpunk wrote: post #3

Hah a PDF! Nice try, folks...

You know that PDFs aren't unsafe, right?

This is a PDF from GCHQ we're talking about.

Re: GCHQ's Boiling Frogs paper on software development

#13

Post by kinai » Mon, May 16, 2016, 9:03 AM UTC

when I just opened the pdf my xorg died (OOM) - I kid you not, first time that ever happend. funny coincidence..or is it? I figure now I got a reason to setup that new distro I was playing with burn all them compromised stuff

Re: GCHQ's Boiling Frogs paper on software development

#14

Post by tragomaskhalos » Mon, May 16, 2016, 9:04 AM UTC

dotemacs wrote: post #8

I like how all the members of that GitHub organisation have secret usernames: https://github.com/orgs/GovernmentCommunicationsHeadquarters...

Unfortunately, Q saying "Now pay attention a09631" doesn't quite have the same ring to it.

(pedants: yes I know it's not the same organisation).

Re: GCHQ's Boiling Frogs paper on software development

#15

Post by coroxout » Mon, May 16, 2016, 9:04 AM UTC

cantagi wrote: post #7

cm3 wrote: post #4

Earlier quoted context omitted.

It might be dangerous to click on it, is there a tl;dr or text extract of it?

It's OK - Github converts it to HTML. However, GCHQ could politely ask the NSA to force Github to give them the usernames and IP addresses that viewed the repo. Maybe use Tor?

It didn't convert it for me. Oops.

Well, they know who I am anyway. Hi again!

(Edit: If you click on it from the repo file list at the top it converts it; don't do what I did and click on the link to download at the bottom of the readme)

Re: GCHQ's Boiling Frogs paper on software development

#16

Post by tomelders » Mon, May 16, 2016, 9:06 AM UTC

The only thing coming out of GCHQ that I want to read is all the stuff GCHQ won't let anyone read.

Re: GCHQ's Boiling Frogs paper on software development

#17

Post by th0br0 » Mon, May 16, 2016, 9:07 AM UTC

cm3 wrote: post #5

Wait, the GCHQ has a GitHub profile where they share a Graph Database engine. Interesting.

The sad thing is that they seem to be developing Gaffer on Windows. At least most files in the repo have the +x bit set...

Re: GCHQ's Boiling Frogs paper on software development

#18

Post by pjc50 » Mon, May 16, 2016, 9:10 AM UTC

matthewmacleod wrote: post #10

cyberpunk wrote: post #3

Hah a PDF! Nice try, folks...

You know that PDFs aren't unsafe, right?

http://www.malwaretracker.com/pdfthreat.php

http://security.stackexchange.com/questions/64052/can-a-pdf-...

Re: GCHQ's Boiling Frogs paper on software development

#19

Post by us0r » Mon, May 16, 2016, 9:11 AM UTC

tomelders wrote: post #12

matthewmacleod wrote: post #10

Earlier quoted context omitted.

You know that PDFs aren't unsafe, right?

This is a PDF from GCHQ we're talking about.

Use the github viewer?

Re: GCHQ's Boiling Frogs paper on software development

#20

Post by dkopi » Mon, May 16, 2016, 9:17 AM UTC

cyberpunk wrote: post #3

Hah a PDF! Nice try, folks...

Assuming they have a zero day vulnerability in acrobat (or other PDF readers), they wouldn't risk losing it by uploading a file with an exploit, using their own name, and in a wide distribution.

When the GCHQ wants to hack you, it won't be on GitHub. It will be a file served specifically to your computer, with content relevant specifically for you, from someone you trust and don't suspect.