5 ms·

DISCLAIMER: I am not the developer, nor am in any way involved with ImageGlass. Wow, this thread is like 35 minutes old and people are already jumping to concl

DISCLAIMER: I am not the developer, nor am in any way involved with ImageGlass. Wow, this thread is like 35 minutes old and people are already jumping to conclusions, bashing the developer, bringing out the torches to burn them at stake. Really disappointed seeing this on HN... Perhaps the title itself is insinuating, and people are not patient enough to dig any deeper. Perhaps someone can add [quickly reverted] or something to the title? That being said, I really wonder why people 100% believe other people act in bad faith. Looking into that Github issue (https://github.com/d2phap/ImageGlass/issues/1252 https://github.com/d2phap/ImageGlass/issues/1252 ), it feels more like the dev was not aware of the issues with the bad actor in question, and was also very quick to revert the issue and pull the affected release from Github. This is the best someone can do under this situation, and I'm sure they must have felt quite stressful... Maybe they are, even now, feeling the stress if they stumble upon this thread. If the dev reads this: You did a great job fixing the issue, congrats! Toxicity like this kills many projects and dreams, by the way. EDIT: My argument rests on the assumption that the dev was acting in good faith. If it is proven to be otherwise, I will gladly retract my statement and apologize.

skeletron 5y ago
Why are you defending him? He infected potentially thousands of people with malware to make a quick buck. That he reluctantly reverted the change only when people noticed and called him out on it is not particularly honourable or worthy of praise.
- kevmo314 5y ago
  Because people make mistakes
  - kadoban 5y ago
    And those mistakes affect others. If your mistake was infecting people with malware, you're not going to be a popular person.
  - thrwn_frthr_awy 5y ago
    What was the mistake? Did they accidentally add the malware? Did they accidentally make the commit message "restructuring dlls"?
peanut_worm 5y ago
Why on earth would you be defending this? No one would ever add something like this in good faith.
- tethys 5y ago
  Do we know if this was enabled by default? The Spider.com SDK License [0] appears to not allow it. > Partner shall ensure that only Users who have expressly agreed to become nodes will actually be marked by Partner as such (…). [0] https://www.spider.com/sdk-license https://www.spider.com/sdk-license
  - olalonde 5y ago
    Didn't read the whole code but this makes me think it was: https://github.com/d2phap/ImageGlass/commit/31c1b918165c42deb296bad3ae01d7d272e7abfc#diff-59b2b48f6cd92a3c14779ad6e5b54c1ae932a6199aca37507fca4c3010317b79L315 https://github.com/d2phap/ImageGlass/commit/31c1b918165c42de...
  - dymk 5y ago
    The service was enabled by default. In a later commit he adds an option to opt-out of Spider being enabled.
- anaisbetts 5y ago
  If he was adding it in bad faith, why would he put it on GitHub for all to see, rather than building the binaries in a private fork? Seems like this is incompetence / naivete rather than malice.
  - dymk 5y ago
    He put the code in a commit titled "restructure external dlls" with no reference to what it did, and in other commits includes the string "Spider" (no description of _what_ that does in the title). These weren't added as pull requests where one might expect to review proposed changes, but as direct commits to ~master. It's not uncommon for people to put obfuscated malware into open source code See: hackers putting cryptominers and wallet stealers [0] into compromised NPM packages, or UoM campus being banned from contributing to Linux for backdooring the Linux kernel [1]. [0] https://www.trendmicro.com/vinfo/dk/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets https://www.trendmicro.com/vinfo/dk/security/news/cybercrime... [1] https://www.theverge.com/2021/4/30/22410164/linux-kernel-university-of-minnesota-banned-open-source https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...
sevagh 5y ago
"My users pushed back against malware I snuck onto their computers, they're so toxic and they're killing my dreams of successfully infecting them with malware!"
olalonde 5y ago
Not necessarily bad faith but bad judgment for sure. I could understand making this "opt in" for users who understand what it does and want to help out, but it definitely shouldn't have been loaded by default.
dymk 5y ago
Even if the author legitimately didn't mean to do harm, and was acting in good faith, he should never (or at least, for a very very long time) be trusted to contribute to software that isn't subject to someone else's review. He's shown such a fundamental misunderstanding of the trust that was placed in him. He knowingly merged _malware_ into his software and then did the minimum amount of plausible deniability (a discord poll that 99.99% of his users don't access, and an opt-out buried in a menu).
- indymike 5y ago
  > Even if the author legitimately didn't mean to do harm, and was acting in good faith, he should never (or at least, for a very very long time) be trusted I disagree. Let people learn from their mistakes. > ... to contribute to software that isn't subject to someone else's review. That's hard to do when it is the author's own software. This "someone else must be lord and master" solution often doesn't apply to reality. Also, I've seen entire companies full of bosses managing people who "are not to be trusted" to do the right thing eventually end up doing the worst possible evil. Let the author learn, and move on. > He knowingly merged _malware_ into his software and then did the minimum amount of plausible deniability Or he asked his most active users, and they said it was fine as long as I can turn it off. Who knows... To assign any intent other than to make some money would be assuming a lot of facts that are not in evidence. The good guys won on this. Let's move on to actual problems instead of punishing someone for learning.
  - roywiggins 5y ago
    Maybe the best way for the author to learn from his mistake is to get yelled at and the project forked away from him. Like, I dunno, but if someone decides to feed my dog a KitKat, I probably wouldn't trust them around my dog anymore, you know? Yeah, they've learned their lesson about dogs and chocolate, but what other stuff don't they realize?
    - indymike 5y ago
      > Maybe the best way for the author to learn from his mistake is to get yelled at and the project forked away from him. If you feel like that is appropriate, you could do that. I'm just glad the author removed the malware, and hope he's able to find a way to make money that doesn't involve a commercial botnet.
domador 5y ago
Without really knowing the author, it's hard to know whether they did what they did in bad faith or in good faith. Regardless of whether it's malice or naivete, either one makes it hard to trust such a developer again, at least right away. They'll have to work hard at earning that trust again and be careful to not make such glaring mistakes again.
thrwn_frthr_awy 5y ago
You are congratulating them on adding malware and then removing it. Actions have consequences and this is a natural consequence, not a punishment. Trust was broken and users are not bound to prove the dev was in bad faith. The dev broke the trust and they can try and prove adding malware was done in good-faith if they wish. If the dev didn't care or _understand_ the severity of this change, then I have no problem if the project dies, gets forked, or whatever.
vegetablepotpie 5y ago
It’s disingenuous to assume people are acting in bad faith. The developer tried to turn his users computers into a botnet. The thing that made him change course was that other people noticed and said something. Public criticism and not a sense that spider runs counter to his users interest is what people are objecting to. The idea that, at some point in the future, the developer will make a token effort to notify his user base before doing something against their interest is enough to make me not want to use this developers software.
kgeist 5y ago
I believe he acted in bad faith because the git commit message was "restructuring external dlls", as if it was a minor change which had nothing to do with botnets. He knew what he was doing was wrong, otherwise why not honestly say "integrated Spider service"? It reminded me of the PHP repo hack last year when a backdoor was added with a git commit message "fixed a typo".
flykespice 5y ago
The reason they reverted the commit as soon as they got _called_out_ is because bam they got CAUGHT!! They though they could be smart and slip in a malware quietly without anybody checking, which was pretty bad executed because literally anyone can see the commits. You don't just accidentally type in a full line introducing a malware that IS of common knowledge ("Oh sorry my fingers moved on my own! I didn't it was a malware!!"), that doesn't exist, there is no sugarcoating, this was absolutely evil intended, stop painting as clean innocent what is visibly dirty
jacquesm 5y ago
> My argument rests on the assumption that the dev was acting in good faith. There is no way this was a good faith move, you don't expose your users to liability like this without informing them clearly and making it opt-in.

skeletron 5y ago

Why are you defending him? He infected potentially thousands of people with malware to make a quick buck. That he reluctantly reverted the change only when people noticed and called him out on it is not particularly honourable or worthy of praise.

kevmo314 5y ago
Because people make mistakes
- kadoban 5y ago
  And those mistakes affect others. If your mistake was infecting people with malware, you're not going to be a popular person.
- thrwn_frthr_awy 5y ago
  What was the mistake? Did they accidentally add the malware? Did they accidentally make the commit message "restructuring dlls"?

peanut_worm 5y ago

Why on earth would you be defending this? No one would ever add something like this in good faith.

tethys 5y ago
Do we know if this was enabled by default? The Spider.com SDK License [0] appears to not allow it. > Partner shall ensure that only Users who have expressly agreed to become nodes will actually be marked by Partner as such (…). [0] https://www.spider.com/sdk-license https://www.spider.com/sdk-license
- olalonde 5y ago
  Didn't read the whole code but this makes me think it was: https://github.com/d2phap/ImageGlass/commit/31c1b918165c42deb296bad3ae01d7d272e7abfc#diff-59b2b48f6cd92a3c14779ad6e5b54c1ae932a6199aca37507fca4c3010317b79L315 https://github.com/d2phap/ImageGlass/commit/31c1b918165c42de...
- dymk 5y ago
  The service was enabled by default. In a later commit he adds an option to opt-out of Spider being enabled.
anaisbetts 5y ago
If he was adding it in bad faith, why would he put it on GitHub for all to see, rather than building the binaries in a private fork? Seems like this is incompetence / naivete rather than malice.
- dymk 5y ago
  He put the code in a commit titled "restructure external dlls" with no reference to what it did, and in other commits includes the string "Spider" (no description of _what_ that does in the title). These weren't added as pull requests where one might expect to review proposed changes, but as direct commits to ~master. It's not uncommon for people to put obfuscated malware into open source code See: hackers putting cryptominers and wallet stealers [0] into compromised NPM packages, or UoM campus being banned from contributing to Linux for backdooring the Linux kernel [1]. [0] https://www.trendmicro.com/vinfo/dk/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets https://www.trendmicro.com/vinfo/dk/security/news/cybercrime... [1] https://www.theverge.com/2021/4/30/22410164/linux-kernel-university-of-minnesota-banned-open-source https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...

sevagh 5y ago

"My users pushed back against malware I snuck onto their computers, they're so toxic and they're killing my dreams of successfully infecting them with malware!"

olalonde 5y ago

Not necessarily bad faith but bad judgment for sure. I could understand making this "opt in" for users who understand what it does and want to help out, but it definitely shouldn't have been loaded by default.

dymk 5y ago

Even if the author legitimately didn't mean to do harm, and was acting in good faith, he should never (or at least, for a very very long time) be trusted to contribute to software that isn't subject to someone else's review. He's shown such a fundamental misunderstanding of the trust that was placed in him. He knowingly merged _malware_ into his software and then did the minimum amount of plausible deniability (a discord poll that 99.99% of his users don't access, and an opt-out buried in a menu).

indymike 5y ago
> Even if the author legitimately didn't mean to do harm, and was acting in good faith, he should never (or at least, for a very very long time) be trusted I disagree. Let people learn from their mistakes. > ... to contribute to software that isn't subject to someone else's review. That's hard to do when it is the author's own software. This "someone else must be lord and master" solution often doesn't apply to reality. Also, I've seen entire companies full of bosses managing people who "are not to be trusted" to do the right thing eventually end up doing the worst possible evil. Let the author learn, and move on. > He knowingly merged _malware_ into his software and then did the minimum amount of plausible deniability Or he asked his most active users, and they said it was fine as long as I can turn it off. Who knows... To assign any intent other than to make some money would be assuming a lot of facts that are not in evidence. The good guys won on this. Let's move on to actual problems instead of punishing someone for learning.
- roywiggins 5y ago
  Maybe the best way for the author to learn from his mistake is to get yelled at and the project forked away from him. Like, I dunno, but if someone decides to feed my dog a KitKat, I probably wouldn't trust them around my dog anymore, you know? Yeah, they've learned their lesson about dogs and chocolate, but what other stuff don't they realize?
  - indymike 5y ago
    > Maybe the best way for the author to learn from his mistake is to get yelled at and the project forked away from him. If you feel like that is appropriate, you could do that. I'm just glad the author removed the malware, and hope he's able to find a way to make money that doesn't involve a commercial botnet.

domador 5y ago

Without really knowing the author, it's hard to know whether they did what they did in bad faith or in good faith. Regardless of whether it's malice or naivete, either one makes it hard to trust such a developer again, at least right away. They'll have to work hard at earning that trust again and be careful to not make such glaring mistakes again.

thrwn_frthr_awy 5y ago

You are congratulating them on adding malware and then removing it. Actions have consequences and this is a natural consequence, not a punishment. Trust was broken and users are not bound to prove the dev was in bad faith. The dev broke the trust and they can try and prove adding malware was done in good-faith if they wish. If the dev didn't care or _understand_ the severity of this change, then I have no problem if the project dies, gets forked, or whatever.

vegetablepotpie 5y ago

It’s disingenuous to assume people are acting in bad faith. The developer tried to turn his users computers into a botnet. The thing that made him change course was that other people noticed and said something. Public criticism and not a sense that spider runs counter to his users interest is what people are objecting to. The idea that, at some point in the future, the developer will make a token effort to notify his user base before doing something against their interest is enough to make me not want to use this developers software.

kgeist 5y ago

I believe he acted in bad faith because the git commit message was "restructuring external dlls", as if it was a minor change which had nothing to do with botnets. He knew what he was doing was wrong, otherwise why not honestly say "integrated Spider service"? It reminded me of the PHP repo hack last year when a backdoor was added with a git commit message "fixed a typo".

flykespice 5y ago

The reason they reverted the commit as soon as they got _called_out_ is because bam they got CAUGHT!! They though they could be smart and slip in a malware quietly without anybody checking, which was pretty bad executed because literally anyone can see the commits. You don't just accidentally type in a full line introducing a malware that IS of common knowledge ("Oh sorry my fingers moved on my own! I didn't it was a malware!!"), that doesn't exist, there is no sugarcoating, this was absolutely evil intended, stop painting as clean innocent what is visibly dirty

jacquesm 5y ago

> My argument rests on the assumption that the dev was acting in good faith. There is no way this was a good faith move, you don't expose your users to liability like this without informing them clearly and making it opt-in.