Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOGE worker’s code supports NLRB whistleblower

krebsonsecurity.com

Post reply on HN
Print view View original

241–250 of 586 posts

Re: DOGE worker’s code supports NLRB whistleblower

#241

Post by api »

twalkz wrote: post #8

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts. Feels like a pretty good Occa…

To allow dodgy offshore actors to snarf huge amounts of data on US citizens to prepare a huge propaganda assault for the next election?

Re: DOGE worker’s code supports NLRB whistleblower

#242

Post by timewizard »

marcusb wrote: post #212
alright2565 wrote: post #190

Earlier quoted context omitted.

x_forwarded_for = headers.get("X-Forwarded-For") if x_forwarded_for is None: x_forwarded_for = ipaddress.IPv4Address._string_from_ip_int( randint(0, MAX_IPV4) ) lol

The original author claims this is to prevent API gateway from leaking the true client IP.

To be fair the code actually creates a new API gateway server that acts as a proxy on to an already existing server and you're possibly meant to use this header with your own gateway service.

So, it's set as a header, sent to a user owned proxy, then to the actual external endpoint.

On the other hand I think the receiving API Gateway will be able to see and log your AWS account identifier when you do this. So your IP may not be the only identifying information that needs to be obscured for this to actually work.

Re: DOGE worker’s code supports NLRB whistleblower

#243

Post by Spivak »

rideontime wrote: post #65
nop_slide wrote: post #46

I find the following bizarre. Ignoring who this marko guy is, why would a random person post such a "take down" of the repo? I have never randomly passed by a repo and wanted to just dunk on it. Also this critique reeks of being AI generated. > On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundament…

It's only "bizarre" if you "ignore who this marko guy is." It's not a coincidence, it's somebody pointing out that DOGE's "cracked coders" are wearing no clothes.

Well yeah they're junior developers. By all account from good schools but literally everyone here has dealt with junior developer brain.

I would say that Elmo picked a bunch of junior devs because they don't have enough maturity to talk back and will do anything they're asked but I think that's too charitable. I think he actually went this route because Elmo is a sad man in his 50s who is desperately trying to pretend that he is, and has not matured beyond, his 20s.

Re: DOGE worker’s code supports NLRB whistleblower

#244

Post by derektank »

sterlind wrote: post #87
dboreham wrote: post #64

Earlier quoted context omitted.

Time to remove the pardon powder. Has it achieved anything productive in the last 100 years?

it's written into the Constitution very explicitly. and it's a really bad time to hold a Constitutional Convention.

I'm not actually convinced that now would be a terrible time to hold a constitutional convention. Yes, it would be messy, but the nature of the ratification requirements (3/4 of all states) means that nothing could make it through without essentially unanimous consent of the country as a whole.

Re: DOGE worker’s code supports NLRB whistleblower

#245

Post by ziddoap »

Alupis wrote: post #231
ziddoap wrote: post #202

Earlier quoted context omitted.

> "Tenant-admin" isn't such a radical thing Admin accounts without logs is extremely radical. I have literally never seen it, or had anyone request it, in my decade+ of consulting in security. Unless you think the whistleblower, Krebs, and everyone else reporting are lying. Which, in that case, nothing anyone says is going to change your opinion (and you should just say that, if it's what you think, to save us all ti…

[flagged]

Like two lines up from your quote:

"He specifically was told that there were to be no logs or records made of the accounts created for DOGE employees"

That sure sounds like no logs.

If you don't believe the whistleblower, just say that, and skip the insulting me part (and I'll know to skip the replying to you part).

Re: DOGE worker’s code supports NLRB whistleblower

#247

Post by timewizard »

wmf wrote: post #75
twalkz wrote: post #8

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts. Feels like a pretty good Occa…

[flagged]

> Now imagine you're a DOGE bro

What does any of this data have to do with making the department more efficient? I can't imagine doing _any_ of this if that was my actual goal.

> and so do the DOGE bros.

When I believe my actions are "fully justified" then that is _precisely_ when I want logging enabled. So no one on Earth could dispute that.

Re: DOGE worker’s code supports NLRB whistleblower

#248

Post by 0x_rs »

progbits wrote: post #45

> Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially. As it happens, there is a newer version of this project that was derived or “forked” from Ge0rg3’s code — called “async-ip-rotator” — and it was committed to GitHub in January 2025 by DOGE captain Marko Elez. Original code: https://github.com/Ge0rg3/requests-ip-rotator Forked: https://github.com/markoelez/async-ip-rotator Code…

The repository has been deleted. In addition, 26 other repos have been removed from the account. This is in line with DOGE members' quick response scrubbing data whenever put into spotlight, as previously seen with another "teen hacker". [0]

Archived repo page: https://archive.ph/LI7tt; archived previous repo count: https://archive.ph/tgkg5

0. https://arstechnica.com/tech-policy/2025/04/i-no-longer-hack...

Re: DOGE worker’s code supports NLRB whistleblower

#249

Post by frumplestlatz »

bdangubic wrote: post #230
frumplestlatz wrote: post #182

Earlier quoted context omitted.

What could they possibly hope to accomplish with a threatening note and drone photos other than to provide fodder for his complaint? Why would drone photos even be necessary when you’ve already demonstrated that you know where they live? What possible purpose does such a threat serve?

not sure if this is a serious question…? what would it accomplish if you were the whistleblower? if it was me, my family would be on the first flight out of the country

It would convince me that whoever I was whistleblowing on was so remarkably stupid as to engage in a felonious criminal conspiracy while leaving behind physical evidence thereof.

I hope that the threatening note and photos have been turned over to the police, where they can be analyzed for fingerprints, printer microdots, et al, and the police can canvas the neighborhood for security camera footage.

As a tactical move, this kind of threat makes zero sense for anyone in the government to carry out if they are even a semi-rational actor.

Re: DOGE worker’s code supports NLRB whistleblower

#250

Post by heelix »

michaelt wrote: post #210
pan69 wrote: post #40

Earlier quoted context omitted.

> all-powerful “tenant admin” accounts that were to be exempted from network logging activity Is this normal to build this sort of functionality into a software system? Especially software systems that heavily rely on auditability?

Sometimes, depending on the situation. My company retains all e-mails for at least 5 years, for audit purposes. But if some troublemaker were to e-mail child porn to an employee, we'd need to remove that from the audit records, because the laws against possessing child porn don't have an exception for corporate audit records. So there's essentially always some account with the power to erase things from the audit rec…

Ah man... back in the day I worked for a company that built out records management software. One of the big things on the side of the cereal box was that not even an admin could delete something flagged as a record within its retention plan. Fast forward to a company doing that for emails, messing up spam filters, and getting a blast of 'normal' porn that was all flagged as records. I believe they ended up creating security groups for those files that help keep those who were using it .. safe for work.
Post reply on HN