4 ms·
> Re the falsifying working hours, wouldn’t these boffins be able to automate Git commits at certain times or even pass instructions to another team who is work
by kuschku 3y ago
> Re the falsifying working hours, wouldn’t these boffins be able to automate Git commits at certain times or even pass instructions to another team who is working the late night shift to post these changes etc.
Is it possible? Definitely. But that's extremely rare, especially if you want to keep a relatively natural pattern for the commits and replies.
You'd basically have to have a team of devs working at really odd times and a queuing system that automatically queues all emails, github interactions, commits, etc to dispatch them at correctly distributed timestamps.
And you'd need a source pattern to base your distribution on, which is hard to correctly model as well.
e.g., if someone slept badly one night, the next morning their interactions shift slightly back and are more sparse in the morning. Their lunch break will also shift due to that. Such changes usually are most prominent in the days surrounding DST changes.
- sophacles 3y ago> Is it possible? Definitely. But that's extremely rare, especially if you want to keep a relatively natural pattern for the commits and replies. What sort of nonsense is this? Have you ever actually known any software developers? A huge number of them keep odd hours, moreso in the infosec sphere. They wouldn't need to automate anything, just start working hours that match the timezone that they're faking... If it really is a state actor, I imagine they'd be able to find someone willing to keep those hours.
- kuschku 3y agoI've spent a lot of time analysing activity patterns, it's not as simple as you think, especially once you combine IRC, GitHub interactions and commits themselves. These are my own hours for example (from a few years ago): https://i.k8r.eu/lgN3ug.png https://i.k8r.eu/lgN3ug.png
- MichaelZuo 3y agoI would have to agree with kushku, it’s a very very high bar to fake thousand of timestamps over several years in a consistent way that doesn’t attract suspicion under forensic scrutiny. Of course this is post facto so not that helpful until after something serious happens. If there was some sort of reputation system that could do this analysis automatically then that would be very useful.
- yogorenapan 3y agoI agree. I don’t follow the time zone of the country I live in as I work remote. Haven’t seen the sun in a while. Probably not healthy.