4 ms·
Literal FUD. It's a 300 line python script.
by quenix 3y ago
Literal FUD. It's a 300 line python script.
- tom_ 3y agoWritten by some people whose code you are getting paid to not run! On the plus side, since it's a 300 line Python script, you can read it (which does not involve running it), figure out what it's doing, explain it to somebody else in broad terms, and get them to write some equivalent code.
- annoyingnoob 3y agoI've committed to the US Government, in my own name, that I will not use or provide certain products. If you service a government contract that includes FAR 52.204 then you are agreeing not use Kaspersky products[0]. If you claim to be compliant and then have an incident where you've used prohibited products, the government can come after you with the False Claims Act[1]. There is no way I'm going to just download and run that script because I'm honest and I like not being in prison. [0] https://www.acquisition.gov/far/52.204-23 https://www.acquisition.gov/far/52.204-23 [1] https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-o-monaco-announces-new-civil-cyber-fraud-initiative https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-...
- seanhunter 3y ago....with some not-so-standard dependencies like plistlib that you would need to check ....containing magic numbers, their own timestamp conversion for some reason, classic obscure cryptographer variable names (A = R[0] etc), use of pack and unpack, which reads and decrypts various random files, writes tempfiles[1] and does other things that are not completely straightforward for even someone who knows what they're doing to fully assess. I mean it looks probably fine to me. But saying it's a 300 line python script is kind of begging the question. [1] using mkstemp but you need to check that stuff to make sure. You also need to check what it does with the things it AES decrypts (they're just pathnames so again, probably fine etc).