3 ms·

The point is that the existence of this code proves that remote access is possible, you just use any one of the many proven malware vectors to get the user to i

The point is that the existence of this code proves that remote access is possible, you just use any one of the many proven malware vectors to get the user to install a binary that does the same thing as this repo does but ships it over the network to your servers.

Dylan16807 2y ago
That seems like an unreasonably broad definition of remote access to me. If installing a local program that proxies data counts, then the only true way to make "remote access" impossible is by installing it in a secure room with no networking and where no other electronics are allowed in. How many people interpreted that claim as SCIF-equivalency?
- lolinder 2y ago
  > How many people interpreted that claim as SCIF-equivalency? Basically everyone who isn't employed in tech? This is what the BBC said [0]: > And it said a would-be hacker would need to gain physical access to your device, unlock it and sign in before they could access saved screenshots. Those of us here can readily see that this "physical access" claim is bunk, but that's what Microsoft represented to the BBC and what the BBC is telling the world. [0] https://www.bbc.com/news/articles/cpwwqp6nx14o https://www.bbc.com/news/articles/cpwwqp6nx14o
  - Dylan16807 2y ago
    If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. Also I don't think many people even saw or noticed that particular claim. They just saw the part about it saving everything you do to your computer and were rightfully worried.
    - pseudalopex 2y ago
      > If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever. > Also I don't think many people even saw or noticed that particular claim. Fewer people will see this repo. What is the correct number of people before misinformation should be corrected?
      - Dylan16807 2y ago
        > The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever. The repo overall makes it sound like it's a way bigger issue than that.
        pseudalopex 2y ago
        > The repo overall makes it sound like it's a way bigger issue than that. The repo overall contains a tool the author said 3x was simple or not rocket science, an explanation of what the tool does, and someone else's FAQ about the context.
        Dylan16807 2y ago
        It comes across as a rebuttal to any and all claims of security, not just the phrase "physical access".
        pseudalopex 2y ago
        The idea the FAQ and tool were created to rebut the physical access claim only was a straw man you created. You said the claim remote access is possible confused you. lolinder explained it. The repo demonstrated the FAQ's claims and gave people a tool to inspect the databases. Any other interpretation is your problem.

Dylan16807 2y ago

That seems like an unreasonably broad definition of remote access to me. If installing a local program that proxies data counts, then the only true way to make "remote access" impossible is by installing it in a secure room with no networking and where no other electronics are allowed in. How many people interpreted that claim as SCIF-equivalency?

lolinder 2y ago
> How many people interpreted that claim as SCIF-equivalency? Basically everyone who isn't employed in tech? This is what the BBC said [0]: > And it said a would-be hacker would need to gain physical access to your device, unlock it and sign in before they could access saved screenshots. Those of us here can readily see that this "physical access" claim is bunk, but that's what Microsoft represented to the BBC and what the BBC is telling the world. [0] https://www.bbc.com/news/articles/cpwwqp6nx14o https://www.bbc.com/news/articles/cpwwqp6nx14o
- Dylan16807 2y ago
  If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. Also I don't think many people even saw or noticed that particular claim. They just saw the part about it saving everything you do to your computer and were rightfully worried.
  - pseudalopex 2y ago
    > If it's just to prove those two words wrong, then this repo seems extremely overblown. "It works like every other program in the world" isn't very exploity. The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever. > Also I don't think many people even saw or noticed that particular claim. Fewer people will see this repo. What is the correct number of people before misinformation should be corrected?
    - Dylan16807 2y ago
      > The FAQ author explained it worked like every other program in the world. Some people doubted him because why wouldn't he show proof if it was so easy? The tool author called it a very simple tool and no rocket science whatsoever. The repo overall makes it sound like it's a way bigger issue than that.
      - pseudalopex 2y ago
        > The repo overall makes it sound like it's a way bigger issue than that. The repo overall contains a tool the author said 3x was simple or not rocket science, an explanation of what the tool does, and someone else's FAQ about the context.
        Dylan16807 2y ago
        It comes across as a rebuttal to any and all claims of security, not just the phrase "physical access".
        pseudalopex 2y ago
        The idea the FAQ and tool were created to rebut the physical access claim only was a straw man you created. You said the claim remote access is possible confused you. lolinder explained it. The repo demonstrated the FAQ's claims and gave people a tool to inspect the databases. Any other interpretation is your problem.