Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I almost got hacked by a 'job interview'

blog.daviddodda.com

Post reply on HN
Print view View original

101–110 of 534 posts

Re: I almost got hacked by a 'job interview'

#101

Post by ryandrake »

jstanley wrote: post #74
ryandrake wrote: post #63

Earlier quoted context omitted.

Of course. A malware-infected dependency has motivation to pay for GitHub stars and fake repo activity. I would never trust any metric that measures public "user activity". It can all be bought by bad actors.

Then what do you do instead?

Would totally depend on the project and what kinds of risks were appropriate to take given the nature of the project. But as a general principal, for all kinds of development: "Bringing in a new dependency should be A Big Deal." Whether you are writing a toy project or space flight avionics, you should not bring in unknown code casually. The level of vetting required will depend on the project, but you have to vet it.

Re: I almost got hacked by a 'job interview'

#102

Post by dylan604 »

Aurornis wrote: post #51
zahlman wrote: post #43

Earlier quoted context omitted.

How am I supposed to become a real, trustable person on LinkedIn if I'm not already there?

Create an account and let it age. Seasoned accounts are a positive heuristic in many domains, not just LinkedIn. For example, I some times use web.archive.org to check a company's domain to see how far back they've been on the web. Even here on HN, young accounts (green text) are more likely to be griefing, trolling, or spreading misinformation at a higher rate than someone who has been here for years.

This is why aged yet rarely used accounts are so valuable for hackers to gain control.

Re: I almost got hacked by a 'job interview'

#103

Post by marcosdumay »

Aurornis wrote: post #51
zahlman wrote: post #43

Earlier quoted context omitted.

How am I supposed to become a real, trustable person on LinkedIn if I'm not already there?

Create an account and let it age. Seasoned accounts are a positive heuristic in many domains, not just LinkedIn. For example, I some times use web.archive.org to check a company's domain to see how far back they've been on the web. Even here on HN, young accounts (green text) are more likely to be griefing, trolling, or spreading misinformation at a higher rate than someone who has been here for years.

> Create an account and let it age.

So, just hire one of those "account aging" services?

Because if you expect people to go there keeping everything up to date, posting new stuff, tracking interactions for 3 years and only after that they can hope to get any gain from the account... That's not reasonable.

Re: I almost got hacked by a 'job interview'

#104

Post by imglorp »

theptip wrote: post #47
ryandrake wrote: post #6

> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…

Is there a market for a distributed audit infra with attestations? If I can have ChatGPT audit a file (content hash) with a known-good prompt, and then share the link as proof of the full conversation, would this be useful evidence to de-risk? If each developer can audit some portion of their dep tree and reuse prior cached audits, maybe it’s tractable to actually get “eyeballs” on every bit of code? Not as good as h…

I think there is, definitely, and that will be a solid route out of this supply chain debacle we find ourselves in.

It will have to involve identity (public key), reputation (white list?), and signing their commits and releases (private key). All the various package managers will need to be validating this stuff before installing anything.

Then your attestation can be a manifest "here is everything that went into my product, and all of those components are also okay.

See SLSA/SBOM -> https://slsa.dev

Re: I almost got hacked by a 'job interview'

#106

Post by ishouldbework »

DavidDodda wrote: post #68
nubg wrote: post #9

This article was written by an LLM. I get that the author might be self-conscious about his English writing skills, but I would still much rather read the original prompt that the author put into ChatGPT, instead of the slop that came out. The story - if true - is very interesting of course. Big bummer therefore that the author decided to sloppify it. David, could you share as a response to this comment the original…

thanks for the feedback. just fyi - this went though 11 different versions before reaching this point. so I am not able to share the full chat because i used Claude with google docs integration. but hears the google doc i started with https://docs.google.com/document/d/1of_uWXw-CppnFtWoehIrr1ir... this and the following prompt ``` 'help me turn this into a blog post. keep things interesting, also make sure you take a…

So, uh, this part "Here's the kicker: the URL died exactly 24 hours later. These guys weren't messing around - they had their infrastructure set up to burn evidence fast." was completely made up by the AI or did you provide the "exactly 24 hours later" information out of band in some chat with the AI?

Re: I almost got hacked by a 'job interview'

#107

Post by jatins »

nubg wrote: post #9

This article was written by an LLM. I get that the author might be self-conscious about his English writing skills, but I would still much rather read the original prompt that the author put into ChatGPT, instead of the slop that came out. The story - if true - is very interesting of course. Big bummer therefore that the author decided to sloppify it. David, could you share as a response to this comment the original…

100%, it was hard to take it seriously once you see usual ChatGPT-ism

What's HN policy on obviously LLM written content -- Is it considered kosher?

Re: I almost got hacked by a 'job interview'

#109

Post by labrador »

perching_aix wrote: post #82
labrador wrote: post #71

As a retired graybeard, it's weird to me that people run unsecured JavaScript on Nodejs all day without a second thought. Powershell scripts have to be signed or explicitly trusted. But JavaScript on Node... nada.

Why? It's no different than any other code. That's the whole point - the cover story is that it's a take-home coding test with some sample code provided.

The issue is trust
Post reply on HN