Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing Go's Infrastructure

reverse.put.as

Post reply on HN
Print view View original

31–40 of 80 posts

Re: Abusing Go's Infrastructure

#31

Post by fred256 »

howenterprisey wrote: post #29
liquidgecka wrote: post #25

Earlier quoted context omitted.

And Gmail and Google groups, and Google drive, and Gchat, on and on. The data you store doesn't even have to be public. With Gmail they would distribute credentials to log in and read attachments that they uploaded via imap. (I am a former Google SAD-SRE [Spam, Abuse, Delivery])

Just curious, "Delivery" doesn't seem to be the same sort of thing as "Spam" and "Abuse": why are the three grouped?

No inside information, but presumably this means Delivery to other organizations, which, among other things, includes maintaining outbound IP reputation, which is closely related to Spam and Abuse.

Re: Abusing Go's Infrastructure

#33

Post by kccqzy »

zepolen wrote: post #30
liquidgecka wrote: post #25

Earlier quoted context omitted.

And Gmail and Google groups, and Google drive, and Gchat, on and on. The data you store doesn't even have to be public. With Gmail they would distribute credentials to log in and read attachments that they uploaded via imap. (I am a former Google SAD-SRE [Spam, Abuse, Delivery])

Question, how would you know without invading the user's privacy?

An algorithm that processes private user data is by itself not invading anyone's privacy. It's clear to me that invasion of privacy only happens when humans look at private user data directly, or look at user data that's not sufficiently processed by an algorithm.

Otherwise, something as simple as a spell checker would be an invasion of privacy because it literally looks at every word in an email you write. That's absurd.

Re: Abusing Go's Infrastructure

#34

Post by Too »

IshKebab wrote: post #19
rfoo wrote: post #7

Earlier quoted context omitted.

pip install cmake or even proprietary binaries, pip install nvidia-cudnn-cu12

Yeah I copied CMake's idea of using PyPI and I also use it to distribute some pure Rust CLI tools using Maturin. It works really well. Pip is... well it's about on par with most other package managers, i.e. not great, not terrible, but it has some pretty huge advantages over any other software distribution method on Linux: * Very likely to be installed already on Linux and probably Mac too. * Doesn't require root to…

Some of those arguments are becoming more and more difficult as pip and distros are pushing for use of venvs and now requires a scary --break-system-packages argument if you were to use the pre installed launcher.

Re: Abusing Go's Infrastructure

#35

Post by gnfargbl »

IshKebab wrote: post #20

Maybe I'm being stupid but what exactly is the issue here? It's probably a bit wasteful of the proxy to cache non-Go repos, but even if it didn't you could make it store arbitrary data just by having it cache a Go repo surely? Sounds like a complete non-issue unless I've missed something.

I don't think you've missed anything. The news here appears to be that a unsecured public proxy is willing to proxy things and make them available to the public in an unsecured fashion.

The article does make the point that some monitored networks might trust golang proxy URLs more than arbitrary web URLs and that this could be used for bypassing reputation filters etc -- but there are already several ways to do that, and this one doesn't seem particularly special.

Re: Abusing Go's Infrastructure

#36

Post by nerdponx »

miki123211 wrote: post #11

Any online service that lets users upload material that is then publicly visible will eventually be used for command-and-control, copyright infringement and hosting CSAM. This is especially true for services that have other important uses besides file hosting and hence are hard to block. This already happened to Twitter[1], Telegram[2], and even the PGP key infrastructure[3], not to mention obvious suspects like GitH…

It seems like it would be pretty easy to use PyPI for this, because packages can contain arbitrary non-Python files. And you can also do things like base 64 encoding your files in strings in Python code.

Re: Abusing Go's Infrastructure

#37

Post by mort96 »

8organicbits wrote: post #4

I know pypi has some non-python projects as well. Python needs the ability to distribute wheels, which are compiled binaries, as the user may not be able to compile library code. Lots of that code is written in C, but Golang[1] is also possible. I can't find an example, but I believe I've seen this used for distributing applications (not libraries) as well. It's kinda cool to write some app in C, upload to pypi, and…

I guess that was much more useful as a use case before pip started requiring you to be in a venv/virtualenv/pipenv/pyenv/whatever to download packages

Re: Abusing Go's Infrastructure

#38

Post by gloryjulio »

liquidgecka wrote: post #25
miki123211 wrote: post #11

Any online service that lets users upload material that is then publicly visible will eventually be used for command-and-control, copyright infringement and hosting CSAM. This is especially true for services that have other important uses besides file hosting and hence are hard to block. This already happened to Twitter[1], Telegram[2], and even the PGP key infrastructure[3], not to mention obvious suspects like GitH…

And Gmail and Google groups, and Google drive, and Gchat, on and on. The data you store doesn't even have to be public. With Gmail they would distribute credentials to log in and read attachments that they uploaded via imap. (I am a former Google SAD-SRE [Spam, Abuse, Delivery])

Just a side note, I found the name sad sre funny and blursed at the same time

Re: Abusing Go's Infrastructure

#39

Post by mynameisvlad »

skybrian wrote: post #27
arccy wrote: post #12

Earlier quoted context omitted.

sounds convoluted. If you just want a public transparency log, the public rekor instance under the sigstore project is much more appropriate for that. https://www.sigstore.dev/ https://docs.sigstore.dev/logging/overview/

Interesting! Looks like it's being used by some npm packages [1] and soon homebrew will be using it [2]. Any other interesting usage? As a user, the npm usage doesn't seem very prominent. On an npm's web page, there's a checkmark next to the version number on the right side that I hadn't paid any attention to before, with more information at the very bottom of the page. Here's an example. [3] [1] https://blog.sigstor…

It’s at the bottom of the page on mobile. On desktop, that’s the first thing on the right hand side of the screen IIRC.

Re: Abusing Go's Infrastructure

#40

Post by palata »

That's maybe naive, but... how is that different than just pushing files to e.g. a GitHub repository? Is it just the fact that you need to create an account for GitHub? Because I can store arbitrary data there, too. Without the 500M limit...
Post reply on HN