Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing Go's Infrastructure

reverse.put.as

Post reply on HN
Print view View original

61–70 of 80 posts

Re: Abusing Go's Infrastructure

#61

Post by miki123211 »

weinzierl wrote: post #42
miki123211 wrote: post #11

Any online service that lets users upload material that is then publicly visible will eventually be used for command-and-control, copyright infringement and hosting CSAM. This is especially true for services that have other important uses besides file hosting and hence are hard to block. This already happened to Twitter[1], Telegram[2], and even the PGP key infrastructure[3], not to mention obvious suspects like GitH…

Not sure if it has already happened, but the not so obvious one is HuggingFace.

No idea if it's used for CSAM or malware, but copyright infringement on a massive scale? https://huggingface.co/datasets/EleutherAI/pile

Re: Abusing Go's Infrastructure

#62

Post by iainmerrick »

arccy wrote: post #56
lmz wrote: post #53

Earlier quoted context omitted.

In general there's no way to ensure the cache hasn't tampered with the contents (e.g. ISP proxy ad injection on non HTTPS sites). For software downloads usually there are signatures and checksums. Arbitrary content, not so much.

There was HTTP SXG (signed exchanges) but it never seemed to get any traction https://web.dev/articles/signed-exchanges

Even if the content is signed, there’s still the issue that the proxy gets to see everything you read, right?

Re: Abusing Go's Infrastructure

#63

Post by _trampeltier »

zepolen wrote: post #30
liquidgecka wrote: post #25

Earlier quoted context omitted.

And Gmail and Google groups, and Google drive, and Gchat, on and on. The data you store doesn't even have to be public. With Gmail they would distribute credentials to log in and read attachments that they uploaded via imap. (I am a former Google SAD-SRE [Spam, Abuse, Delivery])

Question, how would you know without invading the user's privacy?

I think there was a case, where several people loged in the same Gmail account and shared data not by sending mails, just by write and read drafts.

Re: Abusing Go's Infrastructure

#64

Post by infogulch »

verdverm wrote: post #26
dgellow wrote: post #24

Earlier quoted context omitted.

What does that have to do with the linked article?

The CUE team worked with the Go team on the module system. From these interactions, and community input, they decided against using a proxy like Go has. The "exploit" in the article was one of the reasons they made this decision, and chose to use OCI registries instead. The V1 proposal actually proposed using the same Go proxy servers as a stopgap, which received significant pushback from the community (I was probabl…

One thing that the Go module system solves that seems to be unaddressed in CUE's design based on OCI is the sum database / transparency log.

I could add a "Statement that we might wish to make for a module M" to the "Module contents assurance" section:

- The content of module M is the same content that everyone else sees for the same `$path@$version`.

Though I guess users can utilize existing solutions like https://github.com/sigstore/cosign or rekor (mentioned elsewhere itt).

Re: Abusing Go's Infrastructure

#65

Post by blt »

8organicbits wrote: post #4

I know pypi has some non-python projects as well. Python needs the ability to distribute wheels, which are compiled binaries, as the user may not be able to compile library code. Lots of that code is written in C, but Golang[1] is also possible. I can't find an example, but I believe I've seen this used for distributing applications (not libraries) as well. It's kinda cool to write some app in C, upload to pypi, and…

been using PyPI a lot recently for non-Python stuff such as FFmpeg and Eigen. Part of the reason why I have been able to ditch Homebrew entirely!

Re: Abusing Go's Infrastructure

#66

Post by _trampeltier »

toast0 wrote: post #54
carom wrote: post #46

Earlier quoted context omitted.

Companies are legally obligated to scan for CSAM in the US.

I don't think that's accurate... Do you have a link? I do think there is an obligation to report if any is found, but I don't think they need to look.

https://www.theguardian.com/technology/2022/aug/22/google-cs...

Re: Abusing Go's Infrastructure

#67

Post by j16sdiz »

_trampeltier wrote: post #66
toast0 wrote: post #54

Earlier quoted context omitted.

I don't think that's accurate... Do you have a link? I do think there is an obligation to report if any is found, but I don't think they need to look.

https://www.theguardian.com/technology/2022/aug/22/google-cs...

I dont think that's a hard legal requirement to scan. Just some law around what to do once they are known, and some executive arrangements

Re: Abusing Go's Infrastructure

#68

Post by ants_everywhere »

kccqzy wrote: post #33
zepolen wrote: post #30

Earlier quoted context omitted.

Question, how would you know without invading the user's privacy?

An algorithm that processes private user data is by itself not invading anyone's privacy. It's clear to me that invasion of privacy only happens when humans look at private user data directly, or look at user data that's not sufficiently processed by an algorithm. Otherwise, something as simple as a spell checker would be an invasion of privacy because it literally looks at every word in an email you write. That's ab…

If an algorithm is looking through private stuff and making a decision based on it or is sending signals where the signal depends on the private stuff, then it's pretty much by definition leaking private information.

An algorithm that leaked no private information would not be useful to a business. It would do a bunch of computation and then throw it away. So realistically anything that looks at private information is privacy-relevant.

That includes even just the email headers. To quote the former head of the NSA "We Kill People Based on Metadata" https://abcnews.go.com/blogs/headlines/2014/05/ex-nsa-chief-...

You can have debates about how much private information should be leaked and for what purposes. But I don't think having a threshold like "it's all private unless another human reads it" is a good way to think about the issue.

Re: Abusing Go's Infrastructure

#69

Post by bottom999mottob »

_trampeltier wrote: post #63
zepolen wrote: post #30

Earlier quoted context omitted.

Question, how would you know without invading the user's privacy?

I think there was a case, where several people loged in the same Gmail account and shared data not by sending mails, just by write and read drafts.

You might be thinking of the General David Patraeus case, a national security leak that was slightly worse than Snowden's, but with little repurcussions :)

Re: Abusing Go's Infrastructure

#70

Post by _heimdall »

imachine1980_ wrote: post #52
_heimdall wrote: post #41

Earlier quoted context omitted.

At least in my opinion, there's a big difference with where the data lives and where the checking algorithm is run. I don't think a spell checker would fall into what I'd consider a privacy concern as long as the spell checker is running locally on my device.

I don't work in the area of email nor Google but I see two problems. 1) you need to constantly update the spell checker so each time you say this is word or something like that most likely the data is send the problem is part of the data, I assume Google do something similar whit data send to span and mark as not spam. This is full email redirect and analysis not partial like old word processing. 2)I feel ai make thi…

We've had spell/grammar checkers in word processors that worked totally offline for a long time now. They definitely can be improved with a hosted service but that's by no means necessary and comes with tradeoffs like latency and offline support.
Post reply on HN