6 ms·
It's funny looking at some of the contributors to this. Some of the accounts seem to be vague, single-duty accounts made for the express purpose of contributing
by octosphere 7y ago
It's funny looking at some of the contributors to this. Some of the accounts seem to be vague, single-duty accounts made for the express purpose of contributing code to CyberChef and nothing else. I admire their OPSEC
(From: https://github.com/gchq/CyberChef/graphs/contributors https://github.com/gchq/CyberChef/graphs/contributors)
https://github.com/n1474335 https://github.com/n1474335
https://github.com/j433866 https://github.com/j433866
https://github.com/d98762625 https://github.com/d98762625
https://github.com/s2224834 https://github.com/s2224834
https://github.com/GCHQ77703 https://github.com/GCHQ77703
- Fnoord 7y agoMakes me wonder what GitHub can see (e-mail addresses, IP addresses). I also wonder if it is possible to use code analysis to figure out who these people are. Not that it is relevant for me, just curious...
- TAForObvReasons 7y agoGitHub can see what you send it. If you're concerned about leaking IP data, use a VPN and a remote box for git operations.
- justanotherhn 7y agoPerhaps OP is referring to traking based on the coding? I.E. if you had all the code repos from an individual and ran some sort of pattern reconition software to cross refrence thigs like folder structure, layout of the code, frequency and time of uploads, function & variable naming techniques, etc. This reminds me of a technique called eBiomentrics[0] [0] https://medium.com/datadriveninvestor/keystroke-dynamics-what-is-it-be396a263bf2 https://medium.com/datadriveninvestor/keystroke-dynamics-wha...
- Fnoord 7y agoYes that is what I was referring to. I forgot the exact name for it. It is akin to (hand)writing analysis, but for code.
- justanotherhn 7y agoCertainly an interesting idea, I suppose most of the things I listed can in fact be mitigated quite easily. Compilers and obfuscators exist even now that would totally destroy most distinguishable patterns. If anyone knows any case studies on this, please drop a link here.
- aspenmayer 7y agohttps://psal.cs.drexel.edu/index.php/JStylo-Anonymouth https://psal.cs.drexel.edu/index.php/JStylo-Anonymouth Edit: The main page of above site has a lot more publications referenced. Worth a look. https://psal.cs.drexel.edu/index.php/Main_Page https://psal.cs.drexel.edu/index.php/Main_Page https://evllabs.com/ https://evllabs.com/
- wakkaflokka 7y agoStylometry but for code.
- duxup 7y agoMy comment misspellings would give me away in a heartbeat.
- traviscj 7y agoThey probably use their sharklazers emails to sign up.
- artemisbot 7y agoNope, they all use gmail addresses - I contribute a bit to this project so I've sent a few emails back and forth.
- sixhobbits 7y agoLook up "authorship attribution" if you're interested in the identification part. There's quite a bit of research into identifying people by their unique habits. Some claim that this is possible even after your code has gone through compilation or other obfuscation processes, but academics have a habit of exaggerating claims based on small data sets. I spent around a year researching this and it's a really fun field - and no doubt the non-public research and technology is as always further advanced than what we can see.
- dmix 7y agoOne of them forked Mattermost. I wonder if GCHQ is using it internally instead of Slack since they can host it themselves?
- artemisbot 7y agoI've been contributing on and off to the project since it went open source (#4 on that page), it's an interesting experience communicating with blank faces that you can't know or find anything about. Unrelated: About a year in they sent me an award[0] for continued contributions, but there's a puzzle on it I'm yet to solve; if anyone runs across this I'd appreciate any input! [0] https://twitter.com/mattnotmitt/status/1031456040385236992 https://twitter.com/mattnotmitt/status/1031456040385236992