As a retired graybeard, it's weird to me that people run unsecured JavaScript on Nodejs all day without a second thought. Powershell scripts have to be signed or explicitly trusted. But JavaScript on Node... nada.
I almost got hacked by a 'job interview'
71–80 of 534 posts
Re: I almost got hacked by a 'job interview'
#72The article never really addresses if it was a totally fake setup or a real crypto company scamming interviewees. Does "Symfa" exist? Does the "Chief Blockchain Officer"?
so I wrote this article a few weeks back, i reached out to the company on LinkedIn, even tried to connect with their leadership team. sent a few people from the org a draft of the article. I did not get any response at all. so, not really sure about this myself.
also, got blocked by the 'Chief Blockchain Officer' when I asked for a comment.
Re: I almost got hacked by a 'job interview'
#73what exactly are people doing to run un trusted code? You guys run npm run from docker? Do you have example? Do you use VM? Anyone have examples of their setup?
Re: I almost got hacked by a 'job interview'
#74Earlier quoted context omitted.
Popular, recent and active are each easily gameable no?
Of course. A malware-infected dependency has motivation to pay for GitHub stars and fake repo activity. I would never trust any metric that measures public "user activity". It can all be bought by bad actors.
Then what do you do instead?
Re: I almost got hacked by a 'job interview'
#75any web3 that sends you a test project is a scam and are super common on sites like upwork and linkedin
I think that can be simplified to just "web3 is a scam."
Re: I almost got hacked by a 'job interview'
#76why is this website `daviddodda` while the linkedin message mentions `arun`. This might be the forth or fifth time I've seen this type of post this week, is this now a new form of engagement farming?
so, David is like my middle name, when I started on LinkedIn i used my full name. but I could not get my domain with that name. but was able to snag https://daviddodda.com which sounds much smoother, more of a personal branding choice.
Re: I almost got hacked by a 'job interview'
#77> The Bitbucket repo
I haven't seen one of these in years (we used to run BB at my old job).
Re: I almost got hacked by a 'job interview'
#78> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…
I go to the repo and get a feel for how popular, how recent, and how active the project is. I then lock it and I only update dependencies annually or if I need to address a specific issue. Risk gets managed, not eliminated. There is no one "correct" approach as risk is a sliding scale that depends on your project's risk appetite.
None of those methods are even remotely reliable for filtering out bad code. See e.g. this excellent write up on how many methods there are to infect popular repos and bypass common security approaches [1] (including Github "screening"). The only thing that works nowadays is sandbox, sandbox, sandbox. Assume everything may be compromised one day. The only way to prevent your entire company (or personal life) from being taken over is if that system was never connected to anything it didn't absolutely require for running. That includes network access. And regarding separation, even docker is not really safe [2]. VM separation is a bit better. Bare metal is best.
[1] https://david-gilbertson.medium.com/im-harvesting-credit-car...
Re: I almost got hacked by a 'job interview'
#79This article was written by an LLM. I get that the author might be self-conscious about his English writing skills, but I would still much rather read the original prompt that the author put into ChatGPT, instead of the slop that came out. The story - if true - is very interesting of course. Big bummer therefore that the author decided to sloppify it. David, could you share as a response to this comment the original…
thanks for the feedback. just fyi - this went though 11 different versions before reaching this point. so I am not able to share the full chat because i used Claude with google docs integration. but hears the google doc i started with https://docs.google.com/document/d/1of_uWXw-CppnFtWoehIrr1ir... this and the following prompt ``` 'help me turn this into a blog post. keep things interesting, also make sure you take a…
holy wtf, there's no way this can be preferable to just writing, feel like i'm taking crazy pills
Re: I almost got hacked by a 'job interview'
#80pfft, id have balked at the google docs link in step 1... guys a nub, deserves to get hacked. and btw this is north korea its already been exposed before hows he think its news