Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I almost got hacked by a 'job interview'

blog.daviddodda.com

Post reply on HN
Print view View original

91–100 of 534 posts

Re: I almost got hacked by a 'job interview'

#91

Post by croes »

sigmoid10 wrote: post #78
Waterluvian wrote: post #58

Earlier quoted context omitted.

I go to the repo and get a feel for how popular, how recent, and how active the project is. I then lock it and I only update dependencies annually or if I need to address a specific issue. Risk gets managed, not eliminated. There is no one "correct" approach as risk is a sliding scale that depends on your project's risk appetite.

None of those methods are even remotely reliable for filtering out bad code. See e.g. this excellent write up on how many methods there are to infect popular repos and bypass common security approaches [1] (including Github "screening"). The only thing that works nowadays is sandbox, sandbox, sandbox. Assume everything may be compromised one day. The only way to prevent your entire company (or personal life) from bei…

Or writing everything by yourself.

Re: I almost got hacked by a 'job interview'

#92

Post by yieldcrv »

> Blockchain

Okay, I stopped reading here. This is a notorious vector in the web3 space for years.

Another way this occurs if you are in that space is you'll get DMs on X about testing out a game because of your experience in the space, or being eligible for an airdrop by being an earliest contributor, and its all about running some alpha code base.

Re: I almost got hacked by a 'job interview'

#93

Post by stavros »

yieldcrv wrote: post #88
ryandrake wrote: post #6

> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…

> Most of us don't sandbox every single thing. And I do sandbox everything, but its complicated Many of these projects are set to compile only on the latest OS' which makes sandboxing even more difficult and impossible on VM, which is actually the red flag So I sandbox but I don't get to the place of being able to run it so they can just assume I'm incompetent and I can avoid having my computer and crypto messed up

I wrote something small the other day to make commands that will run in Docker, maybe this will help you:

https://github.com/skorokithakis/dox

You could have a command like "python3.14" that will run that version of Python in a Docker container, mounting the current directory, and exposing whatever ports you want.

This way you can specify the version of the OS you want, which should let you run things a bit more easily. I think these attacks rely largely on how much friction it is to sandbox something (even remembering the cli flags for Docker, for example) over just running one command that will sandbox by default.

Re: I almost got hacked by a 'job interview'

#94

Post by nerdix »

rdiddly wrote: post #50

I get "job" notification emails from LinkedIn saying "[company] is hiring 45,000 [type of engineer I am]" and I'm always like "Sure they are" and delete it. It's sad really.

Sounds like a common 419 scammer tactic of making absurd claims in order to filter out people that might catch on to the scam.

Re: I almost got hacked by a 'job interview'

#95

Post by sigmoid10 »

croes wrote: post #91
sigmoid10 wrote: post #78

Earlier quoted context omitted.

None of those methods are even remotely reliable for filtering out bad code. See e.g. this excellent write up on how many methods there are to infect popular repos and bypass common security approaches [1] (including Github "screening"). The only thing that works nowadays is sandbox, sandbox, sandbox. Assume everything may be compromised one day. The only way to prevent your entire company (or personal life) from bei…

Or writing everything by yourself.

You'd have to write the standard libraries and OS as well. Not that it can't be done, but let's just say that people who tried that did not fare well in the mental health department.

Re: I almost got hacked by a 'job interview'

#97

Post by exe34 »

sigmoid10 wrote: post #95
croes wrote: post #91

Earlier quoted context omitted.

Or writing everything by yourself.

You'd have to write the standard libraries and OS as well. Not that it can't be done, but let's just say that people who tried that did not fare well in the mental health department.

you don't need to write the whole standard library - just the bits you need.

Re: I almost got hacked by a 'job interview'

#98

Post by dsr_ »

theptip wrote: post #47
ryandrake wrote: post #6

> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…

Is there a market for a distributed audit infra with attestations? If I can have ChatGPT audit a file (content hash) with a known-good prompt, and then share the link as proof of the full conversation, would this be useful evidence to de-risk? If each developer can audit some portion of their dep tree and reuse prior cached audits, maybe it’s tractable to actually get “eyeballs” on every bit of code? Not as good as h…

You want me to trust you to supply a file, a hash of the file, and a prompt?

No. That's not how this works.

Re: I almost got hacked by a 'job interview'

#99

Post by exe34 »

croes wrote: post #90
ryandrake wrote: post #6

> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…

Is it even possible to look at all dependencies and their dependencies and their dependencies…?

if you use simple c libraries that do one thing, yes, you don't have to go very far at all.

whether you'd be able to find the backdoor in those or not, might depend on your skills as a security expert.

Re: I almost got hacked by a 'job interview'

#100

Post by [deleted] »

DavidDodda wrote: post #68
nubg wrote: post #9

This article was written by an LLM. I get that the author might be self-conscious about his English writing skills, but I would still much rather read the original prompt that the author put into ChatGPT, instead of the slop that came out. The story - if true - is very interesting of course. Big bummer therefore that the author decided to sloppify it. David, could you share as a response to this comment the original…

thanks for the feedback. just fyi - this went though 11 different versions before reaching this point. so I am not able to share the full chat because i used Claude with google docs integration. but hears the google doc i started with https://docs.google.com/document/d/1of_uWXw-CppnFtWoehIrr1ir... this and the following prompt ``` 'help me turn this into a blog post. keep things interesting, also make sure you take a…

[deleted]
Post reply on HN