Maybe it's now time to change your license to be more "unfree". Like adding contact or usage restrictions for psychopaths or warfarer. One does not need to deal with this.
“I will slaughter you”
211–220 of 265 posts
Re: “I will slaughter you”
#212After reading it a few times, I think it's not about some script kiddie using curl to hack into his system. Although I condemn Al Nocai's method, I feel for him and I am inclined to adopt the contrarian opinion that he probably got screwed because of the bad quality of curl. Curl had some remote exploit last year, and curl is used everywhere as the author reminds (often as libcurl). https://daniel.haxx.se/blog/2020/0…
> When some open-source project has some level of reach there needs to be quality requirements and regular security audits. (like they (last?) did in 2016, https://daniel.haxx.se/blog/2016/11/23/curl-security-audit/ ) I think the key question with that is: It all sounds nice, but who is realistically going to pay for it. _especially_ repeatedly.
That's indeed the failure of the system : something sensitive used by billions not being able to pay for a regular audit.
If no one wants to pay for it to have the required quality, why not make it a public utility properly funded by tax, as a public service ; instead of later paying the costs in various form of the consequences of the vulnerabilities.
Re: “I will slaughter you”
#213Earlier quoted context omitted.
We are dealing with a person with mental illness, because nothing is coherent. It's all made up. That's why you don't answer that kind of mail, the goal is to trigger a reaction from you.
> It's all made up. I think its the opposite, I think its an unqualified contractor writing code he doesn't understand for complex systems and was subsequently hacked. I see this a lot with people bidding on contracts then hiring staff/developers after it's awarded to duct tape a system together that barely works and is full of holes.
This. The world is full of incompetent people winging it, and the competent ones are busy putting out the fires they left behind. It takes 3000 years to build a Ming-vase, but only a kid playing soccer to destroy it.
Making a mess is a low effort endeavour.
Cleaning it up, might as well be 1/99 of your lifetime. Tech projects are asymmetric warfare between the business side supporting the "cheapest" project approach and engineers allowed to clean it up properly only after the sunken cost fallacy trapped the clueless.
Re: “I will slaughter you”
#214Earlier quoted context omitted.
And Formula 1 cars don’t have keys...
The analogy to Formula 1 isn't apt either. It can be the wheel, the engine or the steer. But it's no way a whole "car".
A better analogy is a screwdriver. He made a screwdriver. Screwdrivers have millions of legitimate and essential uses. How would you build anything without one? But a criminal could also use the screwdriver to open stuff he's not supposed to. Blaming the screwdriver manufacturer for that is pointless.
Re: “I will slaughter you”
#215Earlier quoted context omitted.
Not by choice. I'm usually auto-flagged/shadow-banned/banned after one or two comments, so I make a new account to join the discussion when necessary. I would prefer to use the same account but it's out of my hands. The mod warned me that using a new name each time could be interpreted as deceptive so I've been using the same name (with an incremented suffix) for a little while now to not obscure my identity.
> I'm usually auto-flagged/shadow-banned/banned after one or two comments, Maybe there is a reason? I had my comments downvoted, but thinking about this, it was deserved, those comments were really not constructive and severely lacking in empathy. No one normal likes reading such things and HN is a place where it matters. It's not a place to just vent.
No one 'normal' in my world would like most of the popular comments here (except to laugh at them). That's subjective.
I don't believe that I should be excluded from participating in good faith because of my race or political views. HN should be a place that welcomes diversity of thought, be it from a BLM activist or a White nationalist.
People are welcome to hit the disagree button. I don't care about that. I don't even mind much if I'm brash and the comment is flagged, as above.
I do care when my civil comments are flagged for wrongthink, and I do care when they are immediately censored. Then it's time for a new account.
Re: “I will slaughter you”
#216Earlier quoted context omitted.
Yeah, I have a seriously hard time believing someone responsible for a multibillion dollar defence project writes that shit.
I have a hard time believing that they only spent $15k on a prototype for a multimillion dollar defense project.
It might be he did, or was planning to do, a bid on a government project that wouldn't have stood a chance in hell, but he already imagined he was going to win that bid. And then stuff happened and he felt cheated out of his chance.
Re: “I will slaughter you”
#217The general demeanor of that person, some of the lingo used like "rooting" or "federal server hijacking", the fact that in the screenshot he's using some text editor with ads in it to browse the offending code combined with the fact that he doesn't know what Curl is (if he did he wouldn't have sent this e-mail) screams "script kiddie" to me. I'm not sure whether this person is actually responsible for a multi-million…
We are dealing with a person with mental illness, because nothing is coherent. It's all made up. That's why you don't answer that kind of mail, the goal is to trigger a reaction from you.
^--- This. Every word of it.
Two words went through my head reading the response. "Crystal Meth".
Likely not, really, but having more-or-less lost an old friend to meth I can't help but compare the similarities (... the "identicalities" actually):
- the desperation and paranoia
- a solid (but wildly misplaced) basis in reality
- the overwhelming externalization of blame
- the need to lash out and draw someone else in
- the completely nonsensical evidence
Bottom line is regardless of the reason, "Al" is extremely unstable. I agree that the lesson here is to not engage these types.
Re: “I will slaughter you”
#218Many comments rush to label this guy as "mentally ill". Being an entitled asshole with misdirected anger is not necessarily a medical condition. And there are plenty of people with actual mental health problems who are not aggressive at all (statistically, mentally ill people are more likely to be victims of violence). Health issues are a thing that happens to people, and they don't have control over it, which absolv…
You're drawing a brighter line between mental illness and being an asshole than I would. There may be more grey area between absolution and being held responsible than you're allowing.
I'm not implying we shouldn't hold trolls responsible when they know better. From an outside perspective it would suck to have a brain that releases dopamine when causing others to suffer.
Re: “I will slaughter you”
#219Some context: Daniel is the primary maintainer of curl (the ubiquitous utility and library for HTTP requests) [1] His name often shows up in the licensing disclosures/attributions of applications that include curl. The general opaqueness of modern software leads people to latch onto him and his email for all manner of things, and for non developers to attribute to him all sorts of bad motives ("You hacked me!"). This…
I wonder if Daniel would have received less unwanted correspondence if he had set up some kind of a foundation/shell for curl's IP from an early stage.
Re: “I will slaughter you”
#220After reading it a few times, I think it's not about some script kiddie using curl to hack into his system. Although I condemn Al Nocai's method, I feel for him and I am inclined to adopt the contrarian opinion that he probably got screwed because of the bad quality of curl. Curl had some remote exploit last year, and curl is used everywhere as the author reminds (often as libcurl). https://daniel.haxx.se/blog/2020/0…
If he's the one using cURL, does that mean that he is one of the kids in the phrase 'You built a formula 1 race car and tossed the keys to kids with ego problems.'?
cURL is a complex beast, it handles plenty of various network protocols, and does it in low-level c, therefore has a lot of potential for exploits if there is a bug like wrongly formatted strings, or buffer overflows. It's a nest for zero-days.
The code is available to anyone to look for such bugs, even the kids with ego problems (aka the hackers). Hackers like curl because it's a nice tool that indeed help them a lot.
Everyone uses curl, willingly or not, embedded by another library which needs some network protocol. Pass a filename that starts with "protocol://... " to any buggy program that will try to open it, and then one branch somewhere inside libcurl will get called. If you give the right magic string, you get a remote shell.