111–120 of 534 posts
I got so tired of python venvs and craziness that I ended up moving my whole dev environment into docker containers. Guess I've accidentally protected myself against some of these attacks.
> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…
> Most of us don't sandbox every single thing. And I do sandbox everything, but its complicated Many of these projects are set to compile only on the latest OS' which makes sandboxing even more difficult and impossible on VM, which is actually the red flag So I sandbox but I don't get to the place of being able to run it so they can just assume I'm incompetent and I can avoid having my computer and crypto messed up
I develop everything on Linux VMs, it has desktop, editors, build tools... It simplifies backups and management a lot. Host OS does not even have Browser or PDF viewer.
Storage and memory is cheap!
> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…
> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…
Is there a market for a distributed audit infra with attestations? If I can have ChatGPT audit a file (content hash) with a known-good prompt, and then share the link as proof of the full conversation, would this be useful evidence to de-risk? If each developer can audit some portion of their dep tree and reuse prior cached audits, maybe it’s tractable to actually get “eyeballs” on every bit of code? Not as good as h…
You can't, end of story. ChatGPT is nothing more than an unreliable sniff test even if there were no other problems with this idea.
Secondly, if you re-analyzed the same malicious script over and over again it would eventually pass inspection, and it only needs to pass once.
Earlier quoted context omitted.
It looks like the LinkedIn account and site are really the same person to me, just keep in mind it's not uncommon for Indian IT workers to adopt an anglicized name in this kind of context.
> It looks like the LinkedIn account and site are really the same person to me, just keep in mind it's not uncommon for Indian IT workers to adopt an anglicized name in this kind of context. I've never encountered an Indian IT worker who does that, but I'd say a majority of Chinese IT workers go by an English name.
Earlier quoted context omitted.
Create an account and let it age. Seasoned accounts are a positive heuristic in many domains, not just LinkedIn. For example, I some times use web.archive.org to check a company's domain to see how far back they've been on the web. Even here on HN, young accounts (green text) are more likely to be griefing, trolling, or spreading misinformation at a higher rate than someone who has been here for years.
> Create an account and let it age. So, just hire one of those "account aging" services? Because if you expect people to go there keeping everything up to date, posting new stuff, tracking interactions for 3 years and only after that they can hope to get any gain from the account... That's not reasonable.
What?
You only need to create an account once.
Update it when you're searching for a new job.
You don't need to log in or post regularly. Few people do that.
The pseudonym "Mykola Yanchii" on LinkedIn [1] doesn't look real at all. Click "More" button -> "About this profile", RED FLAGS ALL OVER. -> Joined May 2025 -> Contact information Updated less than 6 months ago -> Profile photo Updated less than 6 months ago Funny things, this profile has the LinkedIn Verified Checkmark and was verified by Persona ?!?! -> This might be a red flag for Persona service itself as it migh…
The pseudonym "Mykola Yanchii" on LinkedIn [1] doesn't look real at all. Click "More" button -> "About this profile", RED FLAGS ALL OVER. -> Joined May 2025 -> Contact information Updated less than 6 months ago -> Profile photo Updated less than 6 months ago Funny things, this profile has the LinkedIn Verified Checkmark and was verified by Persona ?!?! -> This might be a red flag for Persona service itself as it migh…
Whoever was operating that profile DFE'd. This is why you archive.
Earlier quoted context omitted.
Whoever was operating that profile DFE'd. This is why you archive.
what is dfe
DFE "deleted everything"