4 ms·

But how would you know? The FSB (say) dont send you a bunch of flowers and a pull request from fsb.gov.ru. We saw from the xz situation that this class of atta

But how would you know? The FSB (say) dont send you a bunch of flowers and a pull request from fsb.gov.ru. We saw from the xz situation that this class of attacker can start out genuinely helpful and use sockpuppets and social engineering over a long period of time to infiltrate projects. For all we know, (put on tinfoil hat now) there could be committers in major projects now who have spent years acting "normally" to earn trust but are sleepers.

lelandfe 2y ago
Struggling to find it now, but one of the crazier scams I’ve seen was for an NFT company who was making, IIRC, cards. A person joined their Discord claiming to be a former Ubisoft 3D designer and was confirmed by other former coworkers. They began to ship actual, high quality 3D work as a contractor and earned the trust of the channel. …and then ultimately tried to drain their wallet at the end. Best they could guess was that the scammer(s) paid freelancers and then presented the work. Vetting people online is really hard.
- lproven 2y ago
  > Vetting people online is really hard. This may ultimately turn out to be a real valid reason for management's "back to the office" push, even if they don't know how to express it or quantify the benefits. Maybe a suitably talented person can assess strangers skilfully and well face-to-face, but whatever poorly-identified skills they use to do so, they can't do it via a video call or something. And this is without deepfakes and so on.
ChrisMarshallNY 2y ago
Fair point. Not so sure that I'd call it "tinfoil." Probably quite realistic. It's easy for me to say. I write software to support a fairly small, tight-knit, demographic. We all tend to know each other, so trust (or lack, thereof) is fairly established.
baq 2y ago
Yeah no tinfoil needed, xz was exactly that, except sloppy. We won’t hear about a second attempt for a long time after it’s happened.
- hnlmorg 2y ago
  For all we know, intelligence services might have already had multiple successful attempts prior to xz so they just got complacent on that particular one. The problem we have is you can’t prove the absence of something.

lelandfe 2y ago

Struggling to find it now, but one of the crazier scams I’ve seen was for an NFT company who was making, IIRC, cards. A person joined their Discord claiming to be a former Ubisoft 3D designer and was confirmed by other former coworkers. They began to ship actual, high quality 3D work as a contractor and earned the trust of the channel. …and then ultimately tried to drain their wallet at the end. Best they could guess was that the scammer(s) paid freelancers and then presented the work. Vetting people online is really hard.

lproven 2y ago
> Vetting people online is really hard. This may ultimately turn out to be a real valid reason for management's "back to the office" push, even if they don't know how to express it or quantify the benefits. Maybe a suitably talented person can assess strangers skilfully and well face-to-face, but whatever poorly-identified skills they use to do so, they can't do it via a video call or something. And this is without deepfakes and so on.

ChrisMarshallNY 2y ago

Fair point. Not so sure that I'd call it "tinfoil." Probably quite realistic. It's easy for me to say. I write software to support a fairly small, tight-knit, demographic. We all tend to know each other, so trust (or lack, thereof) is fairly established.

baq 2y ago

Yeah no tinfoil needed, xz was exactly that, except sloppy. We won’t hear about a second attempt for a long time after it’s happened.

hnlmorg 2y ago
For all we know, intelligence services might have already had multiple successful attempts prior to xz so they just got complacent on that particular one. The problem we have is you can’t prove the absence of something.