211–220 of 268 posts
Earlier quoted context omitted.
Political manipulation is a problem, but I don't think it's nearly as profitable as pushing scams and gambling.
You'd be surprised as how there's individuals and organizations willing to pay a lot of money to do political manipulation / influencing.
Like what, parties campaigning?
Earlier quoted context omitted.
You'd be surprised as how there's individuals and organizations willing to pay a lot of money to do political manipulation / influencing.
> ... and organizations willing to pay a lot of money to do political manipulation / influencing. Like what, parties campaigning?
> I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results Side story, this kind of thing is what made me stop using Bing. I had been using it as the default for searches (it sucks, but it's at least not Google), until I landed on a phishing page for my bank (I haven't committed it to memory yet). The pag…
>I never see Google return phishing pages or typo squatters in the first page Our company constantly has phishing copies of our real pages as first results in Google. We have no ability to get them taken down. It costs us serious money every year, and hurts our customers who get swindled because Google lets some brand new domain registered yesterday come before the company that has existed for 20 years. If you haven'…
> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…
Earlier quoted context omitted.
You'd be surprised as how there's individuals and organizations willing to pay a lot of money to do political manipulation / influencing.
> ... and organizations willing to pay a lot of money to do political manipulation / influencing. Like what, parties campaigning?
> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…
2 is full on speculation. It can be any kind of purpose.
Earlier quoted context omitted.
> Neither SELinux not AppArmor allows to show a question "would you like to allow program N to access your microphone" Permissions on microphone device would work, build your own UI / virtual device or generate one with claude if you really want popups. > "would you like to let the program connect to github.com? (Yes) (No) (With decrypting SSL traffic)"." I actually have something for this. Firewall everything blocke…
How do you sandbox /proc by the way? So that the app doesn't crash due to missing /proc/self/exe link or /proc/ID/stat file, but cannot read my private information (like /proc/cmdline, /proc/mounts etc)? Things like bind mounts do not work on /proc. I ended up with writing a FUSE-based emulation in Python, but there are lot of issues with permissions and namespaces: - I could run my /proc emulator in the same PID nam…
I'm saying other OSs are worse for sandboxing.
How would you achieve what you want on MacOS or Windows? (or others?), what do you think goes on behind the scenes?
I would set up a VM if i were that paranoid btw. Qemu, docker, deploy the container to it, vnc or gpu access.
Also, one question for you, since you brought up microphone, how do you defend from Microsoft/Google/Apple deciding to spy on you and access the microphone? (secret court order or who knows why in the future)
Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…
A password manager is a single point of failure and should be avoided. I've heard other sad stories about someone who's pw manager was compromised and they lost everything.
I think the bigger problem is using your pw manager for 2FA too.
It happened a few times to me that I'd find some very well constructed scam scheme (cryptocurrency washing systems, web platform/phishing scams), then I'd research deeper into it to see how it worked, just to ultimately feel powerless not knowing what to do with the information.
Years ago, a friend of mine fell victim to a romance scam. Damage ~€3k. It involved fake websites of non-existing logistics companies, a fake banking site where victim could 'help' a person 'transfer funds' for them, a long chat history (over Viber or something like that, initiated through Facebook), etc.
This being a good friend, I put in some legwork, saved local copies of sites, etc. Some findings:
# It's easy to find copies of sites of the one(s) used to defraud victim. In this case, ~50. And compile a list, what's the hoster of each & where domains are registered.
# Fake banking sites are easy to determine since legitimate banks are recorded in per-country registries. Legitimate: website's security certificate (extended validation etc) indicates [bank_X], bank_X listed as such in registry of country it operates in. Not? -> fake.
For non-banking fake sites it's more difficult to tell.
# Hosting companies & domain registrars do take action. As long as you provide correct & detailed info, in such a way that it's easy for them to act on. Professional companies don't like having legal / financial liabilities sit around.
# If there's security certificates involved, informing issuer of that can remove "secure connection" from a whole batch of sites in 1 go. Makes it harder to convince future victims. (no lock icon on a banking site?!?)
# An official request could be filed with this victim's bank (passed on to recipient's bank), that would give holder of recipient account 2 options: a) return the funds, or b) have their personal details revealed to victim - for use in legal proceedings etc.
This was within EU area. Likely, recipient would be a money mule & not respond. But then you'd get money mule's full name/contact info etc (home address?)
# Police / fraud orgs etc rarely have time for this. You need to do the legwork yourself.
Ultimately, my friend decided not to pursue the matter. But in the mean time, I had caused >2/3 of those fake sites to be deleted (and all the fake banking sites I'd found), and some security certificates to be revoked. Obviously that disrupts scammer's operations to some degree (and costs them time, $$, potential victims dropped etc). So it's not like you can't do anything.