271–280 of 331 posts
Hm, the url returns a png. Did he obscure the actual url? Couldn't get it to send me json or js... Update: found a clone of the repo on github and got the payload, all you have to do is add a header `bearrtoken: logo` It's obfuscated, I will feed it to qwen to see what can be gleaned.
Earlier quoted context omitted.
>I finally got it solved by buying drinks for a buddy of mine that works for LinkedIn I'd like people to understand that this is a form of corruption. We've normalized many like it. LI knows that the only way to force them to fix the issue is to go through a drawn-out legal process, save a spate of bad press (RIP 60 Minutes), so of course they won't.
[flagged]
So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.
Earlier quoted context omitted.
>These tools with arbitrary code execution when trying to download some code have got to stop But you still end up with the code on your machine and risk it being ran. Bigger issue is giant, inscrutible dependency trees. In this example, if they tried to run the test suite or application, they'd have been in the same boat. Afaik all or most languages have some way to run arbitrary code at install time but it seems no…
Claude Code regularly installs dependencies using (p)npm after I e.g. pull a company main branch to get in sync with my teammates. That happens often . So I pull, Claude edits some code as you requested and it should pass because Claude did alright, but your local box has out-of-date deps. So then Claude runs (p)npm i and now we have automatic exploitation of this gaping hole in npm given extremely common and current…
If pulling down your company repo and running `npm install` can lead to a compromise, something has went terribly wrong with your company's security setup.
Earlier quoted context omitted.
With a company-managed list of owned domains where real employees have their work email addresses (unrelated to website domains).
And using DNS to prove that a domain is actually owned by this organization
- a startup with legacy personal email addresses from one or two universities
- a spin-off sharing the email domain (and the whole IT infrastructure) of the parent company
- cheapskates using six approved free email services
Job candidates keep facing a lot of hurdles, including scams, Trojan horses like the one presented here, ghosting, wasting candidates' time, nepotism, etc. As a candidate you can easily spend more than 8 hours a day looking for opportunities, switching stacks, studying, doing take-home projects, etc, for absolutely nothing. Life is precious and shouldn't be burned like that!
Very true. I remember when I was job hunting fot 2 years post-graduation, that these time sinks started to take meaning away from life and induced cynicism and depression (to an extent).
It's easy to forget all that once you end up getting a job, but remember to always be human and show empathy if a person cold-reaches out to you.
Earlier quoted context omitted.
LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tr…
I wonder if a cease and desist to their legal department would work better?
I assume you mean the LinkedIn legal dept. The problem there is that these companies are so big that a 'complaint' or 'cease & desist' to them would be like a mosquito bite, if that, & most likely get lost in the 10s of thousands of other complaints.
It's the same with FB & Insta, etc. One of my daughters had a FB acct taken over that she had accumulated quite a following (~100k plus) with her custom hand drawn artwork. It was impossible to get any acknowledgement of the issue let alone get a suitable solution. And, unfortunately these large companies do not care. Sometime makes you wonder if LinkedIn & the like are even worth it
Earlier quoted context omitted.
Number spoofing is not a solved problem because some carriers, which appear legitimate in all other respects, make a business out of routing your traffic over TDM trunks that don't support caller ID verification, and will claim it's extremely expensive to upgrade these to VOIP.
Fuck 'em? That's not a insurmountable problem in the slightest. Google or Apple could probably solve this problem themselves by simply not ringing the phone for any call that doesn't meet ID verification.