4 ms·

Wow, that's a lot of anonymous accounts adding comments there urging for a fast merge! And this "Hans Jansen" guy is apparently running around salsa.debian.org

by 0x0 3y ago

Wow, that's a lot of anonymous accounts adding comments there urging for a fast merge! And this "Hans Jansen" guy is apparently running around salsa.debian.org pushing for more updates in other projects as well: https://salsa.debian.org/users/hjansen/activity https://salsa.debian.org/users/hjansen/activity

matthews2 3y ago
> running around salsa.debian.org pushing for more updates in other projects as well This is quite common in most (all?) distributions. People are going through lists of outdated packages, updating them, testing them, and pushing them.
- mardifoufs 3y ago
  That account seems to be a contributor for xz though, you can see him interact a lot with the author of the backdoor on the GitHub repo. Some pull requests seem to be just the two of them discussing and merging stuff (which is normal but looks weird in this context)
deleted 3y ago
[deleted]
2OEH8eoCRo0 3y ago
And now we see why I don't trust anons, aliases, or anime characters to make contributions. My GitHub says exactly who I am!
- LtWorf 3y ago
  It has been on the agenda for years to identify FOSS contributors with an id… Wet dream for authoritarians like you. What would it solve when identity theft happens on a mass scale on a day to day basis? It'd just ruin the life of some random person whose identity got stolen to create the account…
  - deleted 3y ago
    [deleted]
- kgeist 3y ago
  You can quite easily generate a realistic photo, bio, even entire personal blogs and GitHub projects, using generative AI, to make it look like it's a real person.
  - isbvhodnvemrwvn 3y ago
    With close to zero OSS participation rate you can just pick a real living person and just keep in sync with their LinkedIn.
- kunagi7 3y ago
  Even if they have a "real" picture or a credible description that is not good enough. Instead of using an anime character a malicious actor could use an image generator [0], they could generate a few images, obtain something credible to most folks, and use that to get a few fake identities going. Sadly, trusting people to be the real thing and not a fake identity on the Internet is difficult now and it will get worse. [0] https://thispersondoesnotexist.com https://thispersondoesnotexist.com
ValdikSS 3y ago
>that's a lot of anonymous accounts Just FYI, krygorin4545@proton.me (the latest message before the upload) was created Tue Mar 26 18:30:02 UTC 2024, about an hour earlier than the message was posted. Proton generates PGP key upon creating the account, with the real datetime of the key (but the key does not include the timezone).

by 0x0 3y ago

matthews2 3y ago

> running around salsa.debian.org pushing for more updates in other projects as well This is quite common in most (all?) distributions. People are going through lists of outdated packages, updating them, testing them, and pushing them.

mardifoufs 3y ago
That account seems to be a contributor for xz though, you can see him interact a lot with the author of the backdoor on the GitHub repo. Some pull requests seem to be just the two of them discussing and merging stuff (which is normal but looks weird in this context)

deleted 3y ago

[deleted]

2OEH8eoCRo0 3y ago

And now we see why I don't trust anons, aliases, or anime characters to make contributions. My GitHub says exactly who I am!

LtWorf 3y ago
It has been on the agenda for years to identify FOSS contributors with an id… Wet dream for authoritarians like you. What would it solve when identity theft happens on a mass scale on a day to day basis? It'd just ruin the life of some random person whose identity got stolen to create the account…
- deleted 3y ago
  [deleted]
kgeist 3y ago
You can quite easily generate a realistic photo, bio, even entire personal blogs and GitHub projects, using generative AI, to make it look like it's a real person.
- isbvhodnvemrwvn 3y ago
  With close to zero OSS participation rate you can just pick a real living person and just keep in sync with their LinkedIn.
kunagi7 3y ago
Even if they have a "real" picture or a credible description that is not good enough. Instead of using an anime character a malicious actor could use an image generator [0], they could generate a few images, obtain something credible to most folks, and use that to get a few fake identities going. Sadly, trusting people to be the real thing and not a fake identity on the Internet is difficult now and it will get worse. [0] https://thispersondoesnotexist.com https://thispersondoesnotexist.com

ValdikSS 3y ago

>that's a lot of anonymous accounts Just FYI, krygorin4545@proton.me (the latest message before the upload) was created Tue Mar 26 18:30:02 UTC 2024, about an hour earlier than the message was posted. Proton generates PGP key upon creating the account, with the real datetime of the key (but the key does not include the timezone).