7 ms·

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Ric

I think Stallman just shot himself in the foot by even revealing that much. Unless a lot of people do the same thing, it's very easy to conclude that it was Richard Stallman who sent that WGET request, granted a few variables. The difficult part is perhaps tracking it back to its actual source, but I don't think Stallman is that hard to find. All this is of course extremely chilling. I'm sure a profile could be built up around WGET requests, and then employing some "likelihood machine" on it, to make educated guesses as to how likely it is that the WGET request was actually from Richard Stallman. I think we've just stumbled upon a new and "fun" Where's Wally game here!

BeefWellington 4y ago
WGET can be pretty trivially told to send custom headers.
- bigfudge 4y ago
  It would be a lot of work to make it mimic a common profile though.
  - justinclift 4y ago
    That work was probably done once, years ago. Might need a few string tweaks every few years, which could be automated.
    - bigfudge 4y ago
      No, because any “RMS” set of headers would only be shared by the small number of nerds who care, fingerprinting us more accurately again.
      - steve1977 4y ago
        Just setup a honey pot and use headers from there ;)
- no_time 4y ago
  Try to do that to a site with CF bot protection cranked up... Not happening without a custom build/custom ssl proxy that mimics the SSL fingerprint of Chrome.
  - harry8 4y ago
    CF blocks you hard simply for enabling "do not track" in settings. The discussion about how awful they are needs to be had.
  - mananaysiempre 4y ago
    I haven’t seen a custom build of Wget, but for Curl there is curl-impersonate[1]. [1] https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate
TylerE 4y ago
The GNU/Hurd in the IA didn’t already do it?
gabipurcaru 4y ago
I'm pretty sure wget has plenty more users in addition to Stallman
- Technotroll 4y ago
  I'm sure too! But there are some very important differences with Stallman's use and "my" use. Personally I use WGET all the time to get specific stuff, mainly downloads of binaries say for some UX system I'm setting up. I'm fairly certain that this is the most common use of WGET, so all that can easily be filtered out. This leaves Stallman's use case, and a few other secretive users, whom I'm sure can also be divided into separate categories, that can then be used to further identify each user's uniqueness. I'm not saying that it's easy, but I'm saying that he's got a higher chance of getting "caught" simply by revealing his rather unique use case.
- ehnto 4y ago
  Not to mention it's programmatic use by tools and applications.
GuB-42 4y ago
I actually did exactly that a while ago. Where I worked, we didn't have internet access but we had email access, so as a workaround, I made an email server on my home machine that fetched web pages for me. A coworker took it even further and made a proxy server that automated the process so you could actually browse the web, although very slowly. Just to say that Stallman is not the only one with this idea. It was in the early 2000, and smartphones weren't a thing. It also was a time where companies were paranoid into letting employees access the internet, but at the same time had abysmal security. By that I mean viruses ran free on shared folders, undetected because their antivirus software was years outdated. Very different times...
- chrismorgan 4y ago
  I recall one time in 2015 or 2016 when I had only a very weak 2G signal, but wanted to check a couple of pages (at least one of which was several hundred kilobytes). Connections always timed out in browsers, but I got it working by SSHing into my VPS, downloading the page with curl, then copying that down with scp. My recollection is that the file size would increase by 32KB every 15–30 seconds. Fun times!
  - anthk 4y ago
    Mosh works over 2.7 KBPS capped data plans. I connected to a tilde and just use lynx/links/edbrowse for light www/irc/jabber and gopher. It runs much faster than being connected natively to the inet. I can read everything and even answer in fora with Edbrowse.
- bsenftner 4y ago
  In the early 2000's I was working as an analyst for a VFX studio, and I had a meeting with the CFO first thing in the morning. At some point we needed to look at something on his computer, and he responds "we'll have to wait about 15 more minutes." "Why?" I ask, and he shows me every day when he turns his computer on the browser starts producing "pop under windows" at a rate of about 10 pr second, and that lasts for about 40 minutes. Shocked, I debate with him for a bit and he says they've tried every antivirus. I shake my head. When they stop popping windows he has a program that mass closes all of them and then he goes to work, using that same computer - and for studio finances. Blew my mind.
croes 4y ago
Maybe he's setting a false trail and using curl
- sltkr 4y ago
  Maybe the script does: wget --user-agent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" ... Nobody will suspect a thing!
boopmaster 4y ago
Are we losing the point, here? “Does not browse” When interacting with webmail- also does not browse directly, preferring CLI scripts to act as intermediary. Does wget execute .js or .css or execute anything it reads beyond a URL redirect? Is wget a huge attack surface like a browser?
m4jor 4y ago
There are so many bots sending wgets I dont think its a real issue.
nebula8804 4y ago
Stallman shot himself in the foot by having a text only blog that was easily searchable when it came time for the wolves to cancel him. A crappy proprietary blog or thousands of hours of ranting via Youtube videos ironically would have slowed down the haters and maybe even cause them to miss things with which to cancel him with. Its hilarious in an ironic way. Bonus points if the cancelers were running GNU software. :D
- user- 4y ago
  You make it sound like he said something mildly insensentive. He was "cancelled" for making pro-cp comments, and for literal decades of being a creep. https://twitter.com/_sagesharp_/status/1173637138413318144 https://twitter.com/_sagesharp_/status/1173637138413318144
  - A4ET8a8uTh0 4y ago
    And how does that invalidate his technical expertise? More importantly, was he charged and convicted with anything? I am getting really tired of this public opinion tribunal, where mere accusation is enough to get a person out of their position. This is not how this is supposed to work at all.
    - someotherperson 4y ago
      No you don't get it. He was a "creep" aka should be cancelled wholesale on everything /s The only questionable thing he did was try to rationalise pedophilia, which he has since changed his mind about. Given that he's clearly _not all there in the head_ (i.e neurodiverse) and assuming he hasn't tried to access child pornography or similar I couldn't care less. All of the other accusations against him are nonsense[0] and all center around unsubstantiated rumors of him being a "creep." People being anti-Stallman is insane to me considering how much he has contributed and advocates for not only free software but also gender equality. [0] https://stallmansupport.org/debunking-false-accusations-against-richard-stallman.html https://stallmansupport.org/debunking-false-accusations-agai...
anthk 4y ago
Wget can mask the User Agent and lots of variables.

BeefWellington 4y ago

WGET can be pretty trivially told to send custom headers.

bigfudge 4y ago
It would be a lot of work to make it mimic a common profile though.
- justinclift 4y ago
  That work was probably done once, years ago. Might need a few string tweaks every few years, which could be automated.
  - bigfudge 4y ago
    No, because any “RMS” set of headers would only be shared by the small number of nerds who care, fingerprinting us more accurately again.
    - steve1977 4y ago
      Just setup a honey pot and use headers from there ;)
no_time 4y ago
Try to do that to a site with CF bot protection cranked up... Not happening without a custom build/custom ssl proxy that mimics the SSL fingerprint of Chrome.
- harry8 4y ago
  CF blocks you hard simply for enabling "do not track" in settings. The discussion about how awful they are needs to be had.
- mananaysiempre 4y ago
  I haven’t seen a custom build of Wget, but for Curl there is curl-impersonate[1]. [1] https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate

TylerE 4y ago

The GNU/Hurd in the IA didn’t already do it?

gabipurcaru 4y ago

I'm pretty sure wget has plenty more users in addition to Stallman

Technotroll 4y ago
I'm sure too! But there are some very important differences with Stallman's use and "my" use. Personally I use WGET all the time to get specific stuff, mainly downloads of binaries say for some UX system I'm setting up. I'm fairly certain that this is the most common use of WGET, so all that can easily be filtered out. This leaves Stallman's use case, and a few other secretive users, whom I'm sure can also be divided into separate categories, that can then be used to further identify each user's uniqueness. I'm not saying that it's easy, but I'm saying that he's got a higher chance of getting "caught" simply by revealing his rather unique use case.
ehnto 4y ago
Not to mention it's programmatic use by tools and applications.

GuB-42 4y ago

I actually did exactly that a while ago. Where I worked, we didn't have internet access but we had email access, so as a workaround, I made an email server on my home machine that fetched web pages for me. A coworker took it even further and made a proxy server that automated the process so you could actually browse the web, although very slowly. Just to say that Stallman is not the only one with this idea. It was in the early 2000, and smartphones weren't a thing. It also was a time where companies were paranoid into letting employees access the internet, but at the same time had abysmal security. By that I mean viruses ran free on shared folders, undetected because their antivirus software was years outdated. Very different times...

chrismorgan 4y ago
I recall one time in 2015 or 2016 when I had only a very weak 2G signal, but wanted to check a couple of pages (at least one of which was several hundred kilobytes). Connections always timed out in browsers, but I got it working by SSHing into my VPS, downloading the page with curl, then copying that down with scp. My recollection is that the file size would increase by 32KB every 15–30 seconds. Fun times!
- anthk 4y ago
  Mosh works over 2.7 KBPS capped data plans. I connected to a tilde and just use lynx/links/edbrowse for light www/irc/jabber and gopher. It runs much faster than being connected natively to the inet. I can read everything and even answer in fora with Edbrowse.
bsenftner 4y ago
In the early 2000's I was working as an analyst for a VFX studio, and I had a meeting with the CFO first thing in the morning. At some point we needed to look at something on his computer, and he responds "we'll have to wait about 15 more minutes." "Why?" I ask, and he shows me every day when he turns his computer on the browser starts producing "pop under windows" at a rate of about 10 pr second, and that lasts for about 40 minutes. Shocked, I debate with him for a bit and he says they've tried every antivirus. I shake my head. When they stop popping windows he has a program that mass closes all of them and then he goes to work, using that same computer - and for studio finances. Blew my mind.

croes 4y ago

Maybe he's setting a false trail and using curl

sltkr 4y ago
Maybe the script does: wget --user-agent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" ... Nobody will suspect a thing!

boopmaster 4y ago

Are we losing the point, here? “Does not browse” When interacting with webmail- also does not browse directly, preferring CLI scripts to act as intermediary. Does wget execute .js or .css or execute anything it reads beyond a URL redirect? Is wget a huge attack surface like a browser?

m4jor 4y ago

There are so many bots sending wgets I dont think its a real issue.

nebula8804 4y ago

Stallman shot himself in the foot by having a text only blog that was easily searchable when it came time for the wolves to cancel him. A crappy proprietary blog or thousands of hours of ranting via Youtube videos ironically would have slowed down the haters and maybe even cause them to miss things with which to cancel him with. Its hilarious in an ironic way. Bonus points if the cancelers were running GNU software. :D

user- 4y ago
You make it sound like he said something mildly insensentive. He was "cancelled" for making pro-cp comments, and for literal decades of being a creep. https://twitter.com/_sagesharp_/status/1173637138413318144 https://twitter.com/_sagesharp_/status/1173637138413318144
- A4ET8a8uTh0 4y ago
  And how does that invalidate his technical expertise? More importantly, was he charged and convicted with anything? I am getting really tired of this public opinion tribunal, where mere accusation is enough to get a person out of their position. This is not how this is supposed to work at all.
  - someotherperson 4y ago
    No you don't get it. He was a "creep" aka should be cancelled wholesale on everything /s The only questionable thing he did was try to rationalise pedophilia, which he has since changed his mind about. Given that he's clearly _not all there in the head_ (i.e neurodiverse) and assuming he hasn't tried to access child pornography or similar I couldn't care less. All of the other accusations against him are nonsense[0] and all center around unsubstantiated rumors of him being a "creep." People being anti-Stallman is insane to me considering how much he has contributed and advocates for not only free software but also gender equality. [0] https://stallmansupport.org/debunking-false-accusations-against-richard-stallman.html https://stallmansupport.org/debunking-false-accusations-agai...

anthk 4y ago

Wget can mask the User Agent and lots of variables.