10 ms·

This sounds to me like you connected to a network on your laptop and cloned an "internal" repo that downloaded something (no different to. Pip or Npm do the sam

This sounds to me like you connected to a network on your laptop and cloned an "internal" repo that downloaded something (no different to. Pip or Npm do the same thing. And that your mail client saw a new IP and treated it as a new session? I think assuming you were hacked based on this is paranoid. > To proceed… with hacking? Or maybe, they didn't have a laptop for you to use (which is stupid, don't get me wrong) so they couldn't do the next stage unless you had a device. Given you had to use it for the first step, it doesn't seem unlikely. If they wanted to "hack" you, they didn't need to fly you out, they just needed you to clone the repo and run the script.

keepamovin 3y ago
Haha, yeah, I understand how you could have misread it like that, I'm sorry the original was not very clear! Let me try again: then didn't ask me to clone any repos of theirs. They only asked me to show them my private repo on GitHub so they could see some significant work I had done. I just picked some random nothing file and they were satisfied. Then I saw that this private repo had been cloned after that trip. Normally you can't see clone IPs on GitHub but for my install process the npm "postinstall" script pulled something off my web server. Basically I had a line buried in one of the scripts referenced in the postinstall script: wget --header="Authorization: Bearer $MY_ACCESS_TOKEN" https://api.myserver.com/data The only thing that ever pulled off that URL was that private repo postinstall script. After seeing my mail session at a random IP in that country, I thought oh that's probably me, but then I was already back home and I wondered why there was still a session there, so I then checked the logs of my server saw another IP from that country pulling that URL, from the day after I was there, when I hadn't made any servers there or run that script when there. What you say about the laptop was what I originally thought: Why do they want me to bring a laptop? Do they seriously believe I don't have a computer? Hahaha > If they wanted to "hack" you, they didn't need to fly you out, they just needed you to clone the repo and run the script. I agree it sounds implausible, right? It's probs nothing. Likely I'm just misreading it. I don't want to jump the gun and I think it's prudent to keep an open mind, I certainly don't want to spread a bs rumour, nor misrepresent a country with something had not been definitively proven with facts. That would totally lack integrity, be irresponsible, and would be undermining due process and ethics. It would also just be disgusting awful betrayal of everything good, so I don't want to jump the gun or name and shame. I was invited and travelled to many countries for these types of interviews back in the day, all over the world: Europe, USA, Asia, even one in Africa. Definitely had some weird vibes at different places, but never had the same feeling of "hacked" as above. But just wanted to clarify the facts. Does what I said make sense? Sorry it's late here.

keepamovin 3y ago

Haha, yeah, I understand how you could have misread it like that, I'm sorry the original was not very clear! Let me try again: then didn't ask me to clone any repos of theirs. They only asked me to show them my private repo on GitHub so they could see some significant work I had done. I just picked some random nothing file and they were satisfied. Then I saw that this private repo had been cloned after that trip. Normally you can't see clone IPs on GitHub but for my install process the npm "postinstall" script pulled something off my web server. Basically I had a line buried in one of the scripts referenced in the postinstall script: wget --header="Authorization: Bearer $MY_ACCESS_TOKEN" https://api.myserver.com/data The only thing that ever pulled off that URL was that private repo postinstall script. After seeing my mail session at a random IP in that country, I thought oh that's probably me, but then I was already back home and I wondered why there was still a session there, so I then checked the logs of my server saw another IP from that country pulling that URL, from the day after I was there, when I hadn't made any servers there or run that script when there. What you say about the laptop was what I originally thought: Why do they want me to bring a laptop? Do they seriously believe I don't have a computer? Hahaha > If they wanted to "hack" you, they didn't need to fly you out, they just needed you to clone the repo and run the script. I agree it sounds implausible, right? It's probs nothing. Likely I'm just misreading it. I don't want to jump the gun and I think it's prudent to keep an open mind, I certainly don't want to spread a bs rumour, nor misrepresent a country with something had not been definitively proven with facts. That would totally lack integrity, be irresponsible, and would be undermining due process and ethics. It would also just be disgusting awful betrayal of everything good, so I don't want to jump the gun or name and shame. I was invited and travelled to many countries for these types of interviews back in the day, all over the world: Europe, USA, Asia, even one in Africa. Definitely had some weird vibes at different places, but never had the same feeling of "hacked" as above. But just wanted to clarify the facts. Does what I said make sense? Sorry it's late here.