Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOGE worker’s code supports NLRB whistleblower

krebsonsecurity.com

Post reply on HN
Print view View original

501–510 of 586 posts

Re: DOGE worker’s code supports NLRB whistleblower

#501

Post by chongli »

drusepth wrote: post #461
captainkrtek wrote: post #445

Earlier quoted context omitted.

I’m not arguing that it’s unusual for humans to write in this manner, but when you use something like chatgpt with some frequency and see that as a common response template it’s an obvious pattern..

People say emdashes are a signal that something's from chatgpt also — yet people forget that the cliches or patterns of LLMs are learned from real-world patterns. What is common in something like ChatGPT has a good chance to also be common outside of it, and _lots_ of false positives (and false negatives) are bound to creep up frequently when trying to do any sort of pattern-based "detection" here.

Yes, emdashes are inserted automatically by iOS when a user inputs a double dash: —

Re: DOGE worker’s code supports NLRB whistleblower

#502

Post by xorcist »

jiggawatts wrote: post #492
watwut wrote: post #483

Earlier quoted context omitted.

>This is the prison guards flipping the mattress looking for contraband. No its not. These prison searches in fact do tend to find knives and what not and do in fact have some role in managing prison violence. This is not about anything like that at all.

It’s an analogy about established civilised audit procedure versus whatever DOGE is doing, which is… not that. It’s not about literal shivs. Speaking of finding things under the mattress, they did find corruption and waste, which they feel justifies their approach. In my opinion the tiny amount of “waste” they uncovered is arguably not worth the damage and risk done, but that’s my opinion, not theirs. Again: the dama…

To what extent has those findings been verified? I know the was a lot of noise about things that turned out to be mostly imaginary.

Re: DOGE worker’s code supports NLRB whistleblower

#503

Post by xoa »

efnx wrote: post #485
JumpCrisscross wrote: post #473

Earlier quoted context omitted.

> They work for Trump so they'll never be held to account, even if a Democrat wins the next election Why? If Democrats take the House in the midterms, which looks more likely the longer Navarro and Musk have West Wing access, they can basically turn these folks' lives into a living hell of back-to-back hearings (and contempt charges down the road). And if Democrats win the next election, they'll presumably put someon…

I think Trump could simply pardon them, unfortunately.

>I think Trump could simply pardon them, unfortunately.

FWIW I think you're not correct here, or rather, it's not merely irrelevant but would actually harm them. The pardon power protects against criminal prosecution by the federal government. But it doesn't protect against mere embarrassment, nor against new actions performed after the pardon. Congress isn't prosecution, their inquiries are just about information finding, and while they can result in information on crimes surfacing, whether or not the USDOJ decides to pursue that or not is completely up to them. The reason a pardon might flat out hurt in such a scenario is that there is an argument it would eliminate any claim of 5th Amendment privileges. That's commonly referred to the right to be silent, and normally that's effectively what it is, but the actual right is the right against self incrimination [0]. If you've been pardoned for something purely federal then by definition it's impossible to incriminate yourself regarding that, because no criminal case can be brought against you. So there'd be no right to refuse to cooperate with a congressional inquiry, and if you didn't that could be treated as contempt which would not be covered by any pardon for the underlying actions.

So yes if a future Administration wanted to pursue criminal prosecutions for crimes that were undertaken by the current Trump Administration, Trump's pardons could certainly put a stop to that. But in terms of "they can basically turn these folks' lives into a living hell of back-to-back hearings", pardons don't help with that one. And if the Democrats just wanted to thoroughly document exactly what went down and who was responsible to make it an indelible part of the history books, with any social consequences that'd come from that, pardons can't help with that either.

----

0: Text of the 5th Amendement: "...nor shall be compelled in any criminal case to be a witness against himself..."

Re: DOGE worker’s code supports NLRB whistleblower

#505

Post by aqme28 »

michaelt wrote: post #210
pan69 wrote: post #40

Earlier quoted context omitted.

> all-powerful “tenant admin” accounts that were to be exempted from network logging activity Is this normal to build this sort of functionality into a software system? Especially software systems that heavily rely on auditability?

Sometimes, depending on the situation. My company retains all e-mails for at least 5 years, for audit purposes. But if some troublemaker were to e-mail child porn to an employee, we'd need to remove that from the audit records, because the laws against possessing child porn don't have an exception for corporate audit records. So there's essentially always some account with the power to erase things from the audit rec…

I don't follow this example. You could still have an account delete the email while generating a record that an email was deleted. Why would you need an account that doesn't generate deletion records?

Re: DOGE worker’s code supports NLRB whistleblower

#506

Post by dragonwriter »

ahwelatif wrote: post #446
dragonwriter wrote: post #433

Earlier quoted context omitted.

It's uses a simple, purpose-focused template of a type that is a common recommendation for clear communication, outline numbering, and highlights keywords using monospaced text, as is common practice in technical writing. None of that is unusual for a human, especially writing something that they know is going to be high visibility, to do. Modestly competent presentation is now getting portrayed as an "AI tell".

I'm relatively confident this critique is AI-powered. The dead giveaways: 1. Verbosity. Developers are busy people and security researcher devs are busy even moreso. Someone so skilled wouldn't spend more than 2-3 sentences of time in critiquing this repo. 2. Hostility. Writing bug free code is hard, even impossible for most. Unless your name is Linus Torvalds, Richard Hipp, or maybe Dan Abramov, most devs are not co…

> Developers are busy people and security researcher devs are busy even moreso.

Neither the critique, the critiquer's profile, nor even the Krebs article says that the critique is a security researcher, and it definitely isn't the case that all devs are particularly "busy people". You yourself argue later, in fact, that the signs are that the author is not an experienced dev or security researcher, so it is nonsense (even more than assuming an average rules out an exception in the group) to argue that the code is AI-written based on the assumption that normally, a security researcher would be too busy to write it.

> Hostility. Writing bug free code is hard, even impossible for most. Unless your name is Linus Torvalds, Richard Hipp, or maybe Dan Abramov, most devs are not comfortable throwing stones while knowing they live in glass houses.

If you've been online more than about 5 minutes, you know that there is no shortage of hostility, and that even if it isn't most of any given community, its a highly visible subset of any community online.

> "Killshot" comments like this are only ever written by frustrated gatekeepers against weak PRs that would hurt "their baby". Nobody would get emotionally invested in other people's random utility projects.

The only reason we are talking about this on HN is that this isn't some random "other people's random utility project". The critique was posted while the author of the code being critiqued was a high profile figure in current news stories, and the critiquer posted a more explicitly political followup the day after the original critique addressing the author's highly-publicized resignation due to the news coverage.

> The author is still an aspiring developer. See their starred repo highlighting adherence to SOLID/DRY principles as a primary feature of their project.

That...doesn't support the critique being AI. In fact, it undercuts it because it provides a simpler explanation than AI as the explanation for your next bullet point, that the critique is wrong (especially, the SOLID/DRY focus is particularly consistent combined with the "aspiring dev" status you describe is particularly consistent with the specific things you focus on the critique being wrong about.) It also undercuts your first bullet point, as already discussed, which hinges on the assumption that the critique was written by an very busy experienced security researcher, and not an aspiring dev..

I mean, if excess verbosity, a more regularized format than is typical for the venue, and being wrong together are hallmarks of an AI written critique, then I'd say your post is at least as much AI-suspicious as the critique under discussion.

Re: DOGE worker’s code supports NLRB whistleblower

#507

Post by Larrikin »

BrenBarn wrote: post #458
Larrikin wrote: post #333

Earlier quoted context omitted.

Do you believe there should be criminal prosecution for state and local government officials currently refusing to to work with ICE in its current form in the Trump administration?

In a sense, yes. I lean more and more toward the idea that we're not going to get out of this mess without "hitting rock bottom", so to speak. That means we have to somehow confront people with the reality of the laws we actually have, not the imaginary ones we've convinced ourselves we have. If we had those kinds of criminal prosecutions we might get riots in the streets and revolutions that would result in changes…

Do you also support criminal convictions for those going around due process, not presenting badges or any identification, and supporting a foreign concentration camp that indefinitely jails people who have not been convicted of a crime, just accused?

Re: DOGE worker’s code supports NLRB whistleblower

#508

Post by avs733 »

Braxton1980 wrote: post #368
avs733 wrote: post #348

Earlier quoted context omitted.

The best outcome for them and other potential powerful forces is an America so roiled by internal conflict that it can’t now or ever do anything. Yeah Trump winning seems to help them in Ukraine but their need is disruption as much as different policy in the longer term.

While I'm just guessing I'd think it would be better to wait until Ukraine is done and trump is out of office. Creating mistrust in Doge only helps Democrats

No, the two sides live in different information spheres.

This story will percolate up to many democrats who will be furious that Russia is “helping” “doge”.

Separately, it won’t (or will be dismissed as “overreacting” or “lying”) by republicans. They will see the democrats as overreacting and having trump derangement syndrome.

Meanwhile, the next doge encounter with an agency now brings greater fear of illicit acts for internal IT people and more controls for doge to demand are turned off creating more conflict within government function.

The sides believe in the evil and stupidity of the other will be further ossified. Meanwhile, Russia is effectively able to do espionage in a way where getting caught doesn’t diminish the value of the espionage work they are engaged in.

Re: DOGE worker’s code supports NLRB whistleblower

#509

Post by fipar »

saagarjha wrote: post #396
fipar wrote: post #376

Earlier quoted context omitted.

Not without a reboot though, and while I haven’t done that, it should be possible to protect selinux ‘s config itself with a policy, requiring boot loader access to bypass, at which point you’re dealing with a different risk level. I’ll agree that Linux security is quite limited and primitive if compared with, say, a mainframe, but it can be made less bad with a reasonable amount of effort.

What would the mainframe be running that avoids this problem?

That’s a big rabbit hole, reading about RACF is a good place to start.

The short answer would be that mainframes come with RBAC from design, unlike Unix, which has a different security model from conception and then had rbac added on top of it in some cases (such as selinux).

Re: DOGE worker’s code supports NLRB whistleblower

#510

Post by lysp »

jppope wrote: post #198
dfedbeef wrote: post #111

The CEO of Tesla and Space-X; a self-proclaimed high IQ individual, an alleged programmer, has apparently hired a straight-up script kiddie to their elite delta force of technical government downsizers.

I agree with the script kiddies comment- which is basically what the reporting has shown... but in a way isn't that part of the point? That they can save billions of dollars just by having a couple of relatively normal comp sci kids (who can't even rent a car) review the most basic financial information of our government departments. These guys aren't supposed to be "delta force" they are supposed to be the interns.…

> I agree with the script kiddies comment- which is basically what the reporting has shown... but in a way isn't that part of the point?

I agree, but for a different point.

Generalising, but under the age of 25, most people don't have enough experience (business/government) to understand things such as business ethics, the consequences, auditing practises, privacy concerns, etc.

With professional experience, you develop a better understanding and build up that depth of knowledge of how things impact the wider "world" rather than the immediate task at hand. Meaning, you gain a better understanding of the ethical implications of what you're doing.

As an example - in law, it'd be easier to manipulate a law graduate than a lawyer with 20+ years experience, who would think outside the direct question or task that was asked.

Post reply on HN