3 ms·

This was posted yesterday and flagged into oblivion. Unless new information has come out, there wasn't and still isn't any reason to believe this leak had anyth

by bulatb 6y ago

This was posted yesterday and flagged into oblivion. Unless new information has come out, there wasn't and still isn't any reason to believe this leak had anything to do with 2020's megabreach. Edit: To clarify, this version follows up the flagged post with a bit more information and a lot more speculation. It does a lot of work to "not" make claims while setting them up and basically making them. https://news.ycombinator.com/item?id=25419140 https://news.ycombinator.com/item?id=25419140

hackerpain 6y ago
There's some new information released which mentions the github repo name, and since when the vulnerability has existed.
- bulatb 6y ago
  Yeah, this is a less-but-still-misleading follow-up. The password might turn out to be related or might not, but I don't think the added details point either way. This security company's marketing blog is mixing up the facts with speculation. Let's especially be careful not to use it in the "nation state vs. kid in a basement" debate.
  - hackerpain 6y ago
    The researcher added there may be some certificates exposed in that repo which may have been used to sign the binaries. It's still a relevant update. Especially the information that the repo was archived by Web Archive back in 2018. It's not easy to know the "who" but the how can be speculated and investigated.
    - bulatb 6y ago
      I think I snuck an edit in while you were writing. Sorry! I see where the researcher says it's not impossible he missed a certificate, but not a reason to believe he actually did. The article is unfortunately full of leading questions and reaching speculation.
jjk166 6y ago
That post editorialized the title to imply that the leaked credentials were part of the breach. The article itself, and this post's title, just note the fact it was out there.

3 ms·

This was posted yesterday and flagged into oblivion. Unless new information has come out, there wasn't and still isn't any reason to believe this leak had anyth

by bulatb 6y ago

hackerpain 6y ago
There's some new information released which mentions the github repo name, and since when the vulnerability has existed.
- bulatb 6y ago
  Yeah, this is a less-but-still-misleading follow-up. The password might turn out to be related or might not, but I don't think the added details point either way. This security company's marketing blog is mixing up the facts with speculation. Let's especially be careful not to use it in the "nation state vs. kid in a basement" debate.
  - hackerpain 6y ago
    The researcher added there may be some certificates exposed in that repo which may have been used to sign the binaries. It's still a relevant update. Especially the information that the repo was archived by Web Archive back in 2018. It's not easy to know the "who" but the how can be speculated and investigated.
    - bulatb 6y ago
      I think I snuck an edit in while you were writing. Sorry! I see where the researcher says it's not impossible he missed a certificate, but not a reason to believe he actually did. The article is unfortunately full of leading questions and reaching speculation.
jjk166 6y ago
That post editorialized the title to imply that the leaked credentials were part of the breach. The article itself, and this post's title, just note the fact it was out there.