Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

theverge.com

Post reply on HN
Print view View original

131–140 of 140 posts

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#131

Post by xp84 »

solatic wrote: post #98
hennell wrote: post #90

Earlier quoted context omitted.

Limit usable characters, and just literally check the page doesn't resolve already before allowing the change. Customers will never be locked out and characters can't impersonate others. If you want to allow some symbols you can either whitelist or check if usernames are an appropriate levenshtein distance away from core names (like say slackbot) and either ban such things or flag to a human "hey this could be an iss…

> just literally check the page doesn't resolve already before allowing the change It's a wildcard DNS record, it always resolves, even if it's not saved in the system. There's a general rule of thumb: when someone on HN tells you to "just" do something, they generally underestimate the amount of effort involved in doing it properly.

It’s not hard to check, I did this recently for a script. I just resolve “(25 generated random chars).example.com” and if “interesting-subdomain.example.com” resolves to the same, then I know that the interesting one is actually only resolving because of a wildcard. If it resolves differently I know it’s taken by a real record.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#132

Post by xp84 »

HankB99 wrote: post #120
stefan_ wrote: post #95

Earlier quoted context omitted.

Lots of apps have helpfully started turning two dashes (—-) into some sort of Unicode long dash that is more aesthetically pleasing, while also breaking command line tools.

That's one of the reasons I abandoned Google Docs for keeping notes on administering my home computer lab. I use Linux so much of what I did involved typing commands in a terminal window. I would copy the text into document and later copy back to a terminal. It often didn't work due to the way Google transmogrified the text in ways not obvious to the eye. I now use Markdown (and store notes on a private server) so co…

I’m sad and annoyed that Google Docs somehow manages to disable the Mac text substitutions feature (which has custom entries I want to use for frequent, difficult to type things at work) when you’re typing into a document.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#133

Post by xp84 »

lostlogin wrote: post #92
brunosutic wrote: post #85

Replacing ascii with similar-looking unicode characters is an old trick. There's a bunch of these characters out there. You can use it in the code to prank your colleague developers - April 1st is nearing! I even made a vim plugin that highlights these "dangerous" characters: https://github.com/vim-utils/vim-troll-stopper I've never been pranked with unicode characters, but I've had a situation at work where a consul…

The accidental crap can go a long way. I recall someone using a superscript ‘O’ as a degrees symbol in a medical report. This then got converted to a non—superscript character and rather changed the meaning. Extra unhelpful was that they wrote the word ‘degrees’ after the attempt at the symbol too.

“patient’s temperature was approaching 100O degrees”

Very nice error :D

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#134

Post by xp84 »

bigyikes wrote: post #41
bongodongobob wrote: post #28

Earlier quoted context omitted.

Uh, it does allow that in the organization settings. Also the SAML/SSO comment below as well. If you can change names, IT admins are either non-existent or just being lazy.

My company allows name changes. It’s fun.

Mine does too, to allow people to copy their pronouns from the boring “pronouns” field into the most conspicuous possible place (inside their actual name), for maximum virtue signaling.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#135

Post by jonny_eh »

vanc_cefepime wrote: post #126
justanother wrote: post #10

I knew an ex-employee back in the day (not me I swear) who created a dialup/ISDN provisioning profile called 'Ringing' in the modem rack controller module (not the Radius server, that would be too obvious), such that a glance at the modem rack status page showed everyone who was connected, and one that was 'Ringing', just like any other incoming call that hadn't been picked up yet. It went completely undetected, yiel…

What’s the story about cfaa and boogers? My google-fu is failing me and can’t find a reference on it.

Simple exaggeration.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#136

Post by themoonisachees »

falserum wrote: post #87
konha wrote: post #79

Earlier quoted context omitted.

Why not use ssh certificates at that point?

I assume op’s system was to allow A to ssh to B, but not to C. (With lot of different As and Cs) Where “but not to C” is the reason for existence. How certificates simplify that part? (Never used them, but my understanding they are usefull when you want x1,x2,… ssh’ing into y1,y2,…; two uniform sets; if set sizes approach 1, then cert usefullness aproach zero)

I would have been a good use case, but unfortunately no, if your key was registered it would be left alone on all servers (though you had to place it, and access control was done by way of bastions).

Ssh certs weren't used because the system was put in place before they became commonplace.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#137

Post by lostlogin »

xp84 wrote: post #133
lostlogin wrote: post #92

Earlier quoted context omitted.

The accidental crap can go a long way. I recall someone using a superscript ‘O’ as a degrees symbol in a medical report. This then got converted to a non—superscript character and rather changed the meaning. Extra unhelpful was that they wrote the word ‘degrees’ after the attempt at the symbol too.

“patient’s temperature was approaching 100O degrees” Very nice error :D

It was a measurement of angle for an ortho surgeon. However as you point out, wrong by a x10 multiplier has the sanity checks kicking in.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#138

Post by compsciphd »

mikehollinger wrote: post #112
Prcmaker wrote: post #91

Earlier quoted context omitted.

My partners work has an employee named 'Admin'. IT struggles with what to do thee.

I’ve worked with someone named True, who, when I went to go add her to some event or another, something along the way helpfully changed it to “TRUE.” I also worked with a guy whose last name was Null. His email was null@ for a period of time.

he should have married an Indian and named a child Dev. :)

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#139

Post by solatic »

xp84 wrote: post #131
solatic wrote: post #98

Earlier quoted context omitted.

> just literally check the page doesn't resolve already before allowing the change It's a wildcard DNS record, it always resolves, even if it's not saved in the system. There's a general rule of thumb: when someone on HN tells you to "just" do something, they generally underestimate the amount of effort involved in doing it properly.

It’s not hard to check, I did this recently for a script. I just resolve “(25 generated random chars).example.com” and if “interesting-subdomain.example.com” resolves to the same, then I know that the interesting one is actually only resolving because of a wildcard. If it resolves differently I know it’s taken by a real record.

In this particular case, the wildcards all intentionally resolved to the same address, regardless of whether or not they were already taken. Business logic was handled by looking at the Host header.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#140

Post by Shocka1 »

dazbradbury wrote: post #14

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

This is a common issue with Discord as well, and is especially prevalent in the crypto space groups.
Post reply on HN