4 ms·

I don't think you need to worry about the C++ contribution: https://github.com/MicrosoftDocs/cpp-docs/commit/9a96311122acd6c6de1e2624cd0f95655fac6500 https://gi

by yorwba 3y ago

I don't think you need to worry about the C++ contribution: https://github.com/MicrosoftDocs/cpp-docs/commit/9a96311122acd6c6de1e2624cd0f95655fac6500 https://github.com/MicrosoftDocs/cpp-docs/commit/9a96311122a...

acdha 3y ago
This does make me wonder how much they made a deliberate effort to build an open source portfolio so they’d look more legitimate when time came to mount an attack. It seems expensive but it’s probably not really much at the scale of an intelligence agency.
- bombcar 3y ago
  If I were doing it, I'd have a number of these "burner committers" ready to go when needed. If I were doing it AND amoral, I'd also be willing to find and compromise committers in various ways.
- kube-system 3y ago
  What's the salary for a software engineer in urban China? 60-80k/yr USD? Two years of that salary is cheaper than a good single shoulder fired missile. Seems like a pretty cheap attack vector to me. A Javelin is a quarter million per pop and they can only hit one target.
  - acdha 3y ago
    Yeah, exactly - when your army is measured in the millions, picking n hundred with technical aptitude is basically a rounding error.
  - alwayslikethis 3y ago
    They are paid much less than that. However, American weapons are also far overpriced due to high labor costs, among other things. The Chinese probably have cheaper weapons.
  - catkitcourt 3y ago
    Unless the payment is performed by foreign entity (which means a US employer is hiring a Chinese hacker), it's not a wise choice to do currency exchange when measuring salary, because it would erase other facts affecting salary, like CPI or housing price. Apart from (both visible and invisible) taxes, I expect a senior programmer would earn ~500-700k CNY per year. Game programmers may reach up to 200k. For a team able to perform such attack, 1M/yr avg. might be reasonable. But if this is not a state-sponsored attack, I can't find enough interest. And, if this is state-backed...contractor or some dishonest officials would a huge part, so the real cost might be >2M/yr. Considering you can get nothing during 2 year's lurking I doubt if it's feasible enough.
hartator 3y ago
Until you figure there are very subtle unicode changes in the URL that don’t diff on GitHub. :)
deleted 3y ago
[deleted]

by yorwba 3y ago

acdha 3y ago

This does make me wonder how much they made a deliberate effort to build an open source portfolio so they’d look more legitimate when time came to mount an attack. It seems expensive but it’s probably not really much at the scale of an intelligence agency.

bombcar 3y ago
If I were doing it, I'd have a number of these "burner committers" ready to go when needed. If I were doing it AND amoral, I'd also be willing to find and compromise committers in various ways.
kube-system 3y ago
What's the salary for a software engineer in urban China? 60-80k/yr USD? Two years of that salary is cheaper than a good single shoulder fired missile. Seems like a pretty cheap attack vector to me. A Javelin is a quarter million per pop and they can only hit one target.
- acdha 3y ago
  Yeah, exactly - when your army is measured in the millions, picking n hundred with technical aptitude is basically a rounding error.
- alwayslikethis 3y ago
  They are paid much less than that. However, American weapons are also far overpriced due to high labor costs, among other things. The Chinese probably have cheaper weapons.
- catkitcourt 3y ago
  Unless the payment is performed by foreign entity (which means a US employer is hiring a Chinese hacker), it's not a wise choice to do currency exchange when measuring salary, because it would erase other facts affecting salary, like CPI or housing price. Apart from (both visible and invisible) taxes, I expect a senior programmer would earn ~500-700k CNY per year. Game programmers may reach up to 200k. For a team able to perform such attack, 1M/yr avg. might be reasonable. But if this is not a state-sponsored attack, I can't find enough interest. And, if this is state-backed...contractor or some dishonest officials would a huge part, so the real cost might be >2M/yr. Considering you can get nothing during 2 year's lurking I doubt if it's feasible enough.

hartator 3y ago

Until you figure there are very subtle unicode changes in the URL that don’t diff on GitHub. :)

deleted 3y ago

[deleted]