4 ms·
> When a community member inquired about how long it took for the funds to be drained, the Web3 founder responded that it took just two minutes for someone to w
by Sayrus 2y ago
> When a community member inquired about how long it took for the funds to be drained, the Web3 founder responded that it took just two minutes for someone to withdraw the funds.
The public events API is delayed by 5 minutes[1]. Unless someone was actively scraping his profile rather than doing large scans on GitHub, this is not possible.
[1] https://docs.github.com/en/rest/activity/events?apiVersion=2022-11-28#list-public-events https://docs.github.com/en/rest/activity/events?apiVersion=2...
- jsheard 2y agoThey don't need to proactively scan all of GitHub to exploit this kind of mistake, just active accounts that are known to be involved with cryptocurrency. GitHub even lets you find them easily: https://github.com/search?q=language%3ASolidity&type=users https://github.com/search?q=language%3ASolidity&type=users
- deleted 2y ago[deleted]
- koollman 2y ago"$40k became 'untraceable' while being reported as lost" /s
- Waterluvian 2y agoA delay or just that it polls every 5 minutes?
- Sayrus 2y agoIt's delayed. You can poll it continuously and you get live events "from 5 minutes ago".
- ben_w 2y agoGiven the obvious incentive, I expect multiple groups to be scraping simultaneously, out of sync with each other. Also, I expect anyone working on high-value systems to be under more targeted scraping.
- bravetraveler 2y agoThey're on Twitter with a crypto symbol in the username, you really think targeting is outlandish?
- tjoff 2y agoNote he didn't commit his keys by mistake, but rather made a private repo public. Don't know if that makes a difference.
- Ferret7446 2y agoCommitting keys is a mistake.
- tjoff 2y agoIn my mind yes, but he seems to have done it on purpose. At least he was aware of it.
- Timpy 2y agoI didn't read that to mean a literal two minutes. Based on his style of writing that was quoted in the article and the nature of his mistake I don't think he's reporting an in-depth postmortem on the situation, although I didn't bother going to twitter to take a closer look. He probably didn't even realize his mistake within two minutes.