Please write your own blog posts rather than asking us to read LLM slop.
Just curious, on what grounds do you call this slop?
I thought it was a perfectly cromulent article making a perfectly reasonable point.
Someone used my open source project to phish people
31–40 of 64 posts
Re: Someone used my open source project to phish people
#32Earlier quoted context omitted.
GP is right. This paragraph is a major tell. If you have read enough ChatGPT output that hasn’t been humanized, you start to instantly notice it: “ The attacker hadn’t broken into anything. They’d just noticed something I hadn’t: I had a verified email-sending domain attached to open, unverified signup, and that’s a useful primitive if you don’t care what you send.”
Yes, instead he should have written: "The attacka didn broke into nuffin bruv. They jus noticing sometin I aint, yeh?" Instant betterness.
I would rather read an email the sender actually wrote even if it looked like your example, as opposed to AI-written. In that sense it is "better" to me.
Re: Someone used my open source project to phish people
#33[flagged]
Why do you think this is LLM-generated? Reads perfectly fine to me.
"There was no exploit. No vulnerability disclosure. No CVE for me to write. The attacker filled out my signup form 942 times, made 942 workspaces, sent 942 batches of about a hundred invitations each, and stopped. They used my tool exactly as designed. The design was just bad enough that the tool was good for phishing."
Re: Someone used my open source project to phish people
#34[flagged]
Thought the same. And also, this whole piece might just be a nicely obfuscated ad for the service in question.
Plus the "guardian sales angels" in the comment threads protecting their product:
"why, I thought it read really smoothly?"
"how sad of you to see only the bad things in life"
"need to get outside more?"
What has this all become. What have I become.
Re: Someone used my open source project to phish people
#35Re: Someone used my open source project to phish people
#36[flagged]
I think the problem here is that they used their server (that is running a demo of the project).
Re: Someone used my open source project to phish people
#37Please write your own blog posts rather than asking us to read LLM slop.
Just curious, on what grounds do you call this slop? I thought it was a perfectly cromulent article making a perfectly reasonable point.
Re: Someone used my open source project to phish people
#38I guess the author learned a hard lesson about preventing abuse of a web service, especially a service that is capable of sending emails.
I have a few small projects that I would love to serve publicly from my VPS. But I have put them behind strict logins (no signup) or put them in read-only mode, with (likely premature) rate limiting, fail2ban and cloudflare, for fear that a month of bandwidth gets used within minutes by an attacker. For the same reason, sometimes I only shared the source on github and let people deploy it themselves if they are interested.
Re: Someone used my open source project to phish people
#39Captcha here will only harm your real users' experience and won't protect against this kind of abuse, since it comes from real scammers, not fully automated bots.
I've dealt with these and similar issues over the last 8 years, which led our team to develop a security tool 5 years ago that is now open-sourced.
Re: Someone used my open source project to phish people
#40This kind of thing has happened to me.
I designed something that was "too open," and that "openness" was abused.
Sadly, spammers are why we can't have nice things; but that's been the case for decades. The incident I mentioned, happened in the 1990s.
The good news is, is that once this happens to you, you learn your lesson.