Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GCHQ's Boiling Frogs paper on software development

github.com

Post reply on HN
Print view View original

31–40 of 85 posts

Re: GCHQ's Boiling Frogs paper on software development

#31

Post by rasz_pl »

dkopi wrote: post #20
cyberpunk wrote: post #3

Hah a PDF! Nice try, folks...

Assuming they have a zero day vulnerability in acrobat (or other PDF readers), they wouldn't risk losing it by uploading a file with an exploit, using their own name, and in a wide distribution. When the GCHQ wants to hack you, it won't be on GitHub. It will be a file served specifically to your computer, with content relevant specifically for you, from someone you trust and don't suspect.

For example datasheet pdf with mitm injected payload you just downloaded from alldatasheets. They tap cables and sit in bridge routers for a reason.

Re: GCHQ's Boiling Frogs paper on software development

#33

Post by ianpurton »

rplnt wrote: post #32
wyzellak wrote: post #28

http://imgur.com/a/pbazB Contents of this PDF, page by page, in JPGs.

My question is, why?

It's a PDF from GCHQ. It's almost certainly loaded with a surveillance payload.

Probably even some sort of of brainwave scanner.

Re: GCHQ's Boiling Frogs paper on software development

#34

Post by chinathrow »

mseebach wrote: post #27
cantagi wrote: post #7

Earlier quoted context omitted.

It's OK - Github converts it to HTML. However, GCHQ could politely ask the NSA to force Github to give them the usernames and IP addresses that viewed the repo. Maybe use Tor?

I don't understand why everybody assumes GCHQ and NSA are completely inept amateurs. Getting a list of usernames and IP addresses from GitHub would have an insane signal to noise ratio - after all, there are plenty of perfectly legitimate reasons to want to read this document. It's much easier to go to HN and grab the usernames and IPs of people you can see taking a rebellious position in discussions about these orga…

> Getting a list of usernames and IP addresses from GitHub would have an insane signal to noise ratio

Or you could assume that they have that information already. Which I deem highly likely - private repos are a must-target for any intelligence service out there.

Re: GCHQ's Boiling Frogs paper on software development

#36

Post by knorker »

sievebrain wrote: post #22
bshimmin wrote: post #9

Earlier quoted context omitted.

"Gaffer's Accumulo Store is optimised for: Ingesting large amounts of data efficiently." For some reason that made me feel slightly nervous.

Well it's not a secret anymore why GCHQ/NSA need large graph databases.

When was it?

Re: GCHQ's Boiling Frogs paper on software development

#39

Post by nxzero »

mseebach wrote: post #27
cantagi wrote: post #7

Earlier quoted context omitted.

It's OK - Github converts it to HTML. However, GCHQ could politely ask the NSA to force Github to give them the usernames and IP addresses that viewed the repo. Maybe use Tor?

I don't understand why everybody assumes GCHQ and NSA are completely inept amateurs. Getting a list of usernames and IP addresses from GitHub would have an insane signal to noise ratio - after all, there are plenty of perfectly legitimate reasons to want to read this document. It's much easier to go to HN and grab the usernames and IPs of people you can see taking a rebellious position in discussions about these orga…

>> ..."GCHQ and NSA are completely inept amateurs."

Assuming anyone is inept is inept, since even the inept get lucky.

Re: GCHQ's Boiling Frogs paper on software development

#40

Post by vidarh »

dotemacs wrote: post #8

I like how all the members of that GitHub organisation have secret usernames: https://github.com/orgs/GovernmentCommunicationsHeadquarters...

Even so, I wonder how much information they accidentally leak this way. And how much effort they go through to keep such information leakage at acceptable levels.
Post reply on HN