7 ms·

> Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially. As it happens, there is a newer version of this project that was der

> Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially. As it happens, there is a newer version of this project that was derived or “forked” from Ge0rg3’s code — called “async-ip-rotator” — and it was committed to GitHub in January 2025 by DOGE captain Marko Elez. Original code: https://github.com/Ge0rg3/requests-ip-rotator https://github.com/Ge0rg3/requests-ip-rotator Forked: https://github.com/markoelez/async-ip-rotator https://github.com/markoelez/async-ip-rotator Code is pretty much the same, with comments removed, some `async` sprinkled in and minor changes (I bet this was just pasted into LLM with prompt to make it async, but if that worked why not). Except... Original GPL3 license is gone. Obviously not something you would expect DOGE people to understand or respect.

nativeit 1y ago
> On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundamental engineering failure.” “If this were a side project, it would just be bad code,” the reviewer wrote. “But if this is representative of how you build production systems, then there are much larger concerns. This implementation is fundamentally broken, and if anything similar to this is deployed in an environment handling sensitive data, it should be audited immediately.”
- deepfriedrice 1y ago
  The "critique" is nuts. Surely AI generated. If I didn't trust the domain, I'd assume the author to be incredible for seriously referencing something like this. Look at the critique [0] and then look at the code [1]. [0] https://web.archive.org/web/20250423135719/https://github.com/markoelez/async-ip-rotator/issues/1 https://web.archive.org/web/20250423135719/https://github.co... [1] https://github.com/ricci/async-ip-rotator/blob/master/src/async_ip_rotator/__init__.py https://github.com/ricci/async-ip-rotator/blob/master/src/as...
  - krferriter 1y ago
    Lol that's so funny. Can't imagine writing that. (the critique, not the code).
  - captainkrtek 1y ago
    Yea clearly AI with the keyword bolding, numbered arguments, and so on. Feel like lots of AI produced content follow this structured response pattern.
    - dragonwriter 1y ago
      It's uses a simple, purpose-focused template of a type that is a common recommendation for clear communication, outline numbering, and highlights keywords using monospaced text, as is common practice in technical writing. None of that is unusual for a human, especially writing something that they know is going to be high visibility, to do. Modestly competent presentation is now getting portrayed as an "AI tell".
      - captainkrtek 1y ago
        I’m not arguing that it’s unusual for humans to write in this manner, but when you use something like chatgpt with some frequency and see that as a common response template it’s an obvious pattern..
        drusepth 1y ago
        People say emdashes are a signal that something's from chatgpt also — yet people forget that the cliches or patterns of LLMs are learned from real-world patterns. What is common in something like ChatGPT has a good chance to also be common outside of it, and _lots_ of false positives (and false negatives) are bound to creep up frequently when trying to do any sort of pattern-based "detection" here.
        chongli 1y ago
        Yes, emdashes are inserted automatically by iOS when a user inputs a double dash: —
- mquander 1y ago
  Seeing Krebs link to this downgrades my impression of how trustworthy his assessments are.
- dessimus 1y ago
  > it should be audited immediately. Certainly Elon made him print it out on paper to personally code review.
plandis 1y ago
GPLv3 requires the license to be kept. Seems reportable to the owner of the repo and or GitHub.
- DrillShopper 1y ago
  I'm sure the people who work for an administration that by and large flaunts court orders responsible for this will get right on that.....aaaand it's gone.
  - amake 1y ago
    flouts
- TheDong 1y ago
  The only person who has standing to say anything is the original author of the code, the holder of the copyright. It's possible, but very unlikely, the copyright license wasn't actually violated because, for example, the fork could have arranged a separate license. The best example of this is the Qt Project's code: https://www.qt.io/qt-licensing https://www.qt.io/qt-licensing You can get it under a GPL license for free. You can pay them money to get it under a Commercial license that would let you modify the code without releasing changes. So, while I doubt it happened, the person who forked it here could have contacted the original author, the copyright holder, and asked for an exemption from the GPL terms.
dijksterhuis 1y ago
FYI the Fork got hidden/deleted in the last minute or so -- did anyone manage to clone it before it disappeared?
- whalesalad 1y ago
  I did. It's essentially just a single .py file: https://gist.github.com/whalesalad/06804fd734efe6bd2e0c84906576594b https://gist.github.com/whalesalad/06804fd734efe6bd2e0c84906...
  - alright2565 1y ago
    x_forwarded_for = headers.get("X-Forwarded-For") if x_forwarded_for is None: x_forwarded_for = ipaddress.IPv4Address._string_from_ip_int( randint(0, MAX_IPV4) ) lol
    - marcusb 1y ago
      The original author claims this is to prevent API gateway from leaking the true client IP.
      - timewizard 1y ago
        To be fair the code actually creates a new API gateway server that acts as a proxy on to an already existing server and you're possibly meant to use this header with your own gateway service. So, it's set as a header, sent to a user owned proxy, then to the actual external endpoint. On the other hand I think the receiving API Gateway will be able to see and log your AWS account identifier when you do this. So your IP may not be the only identifying information that needs to be obscured for this to actually work.
        icedchai 1y ago
        The code seems like a "creative" use of API gateway to turn it into a proxy for other external sites (single site, really, since you need one per site.) Wouldn't it be simpler to send the requests through a lambda (with a function URL) and get better control of the outbound requests?
darknavi 1y ago
The fork has been deleted it seems.
- seejayjordan 1y ago
  posted above ^^
0x_rs 1y ago
The repository has been deleted. In addition, 26 other repos have been removed from the account. This is in line with DOGE members' quick response scrubbing data whenever put into spotlight, as previously seen with another "teen hacker". [0] Archived repo page: https://archive.ph/LI7tt https://archive.ph/LI7tt; archived previous repo count: https://archive.ph/tgkg5 https://archive.ph/tgkg5 0. https://arstechnica.com/tech-policy/2025/04/i-no-longer-hack-paypals-doge-staffers-hacker-past-raises-red-flags https://arstechnica.com/tech-policy/2025/04/i-no-longer-hack...
- grandempire 1y ago
  [flagged]
  - LiquidSky 1y ago
    These are government employees, you don't get to do that.
    - spauldo 1y ago
      Government software can't be copywrited, but the government is under no compulsion to share it. That's what FOIA requests are for.
      - godelski 1y ago
        Actually, they are. It's really more a question of with who and of course don't apply to classified material. But the SHARE IT act really helps formalize what was already happening. Most code is shared and made public. It's paid for by the public. Though it's usually not easily searchable as it's distributed via different platforms, means, and may even require submitting a freedom of information request first. But in more cases than not, there is obligation to share when requested. https://www.congress.gov/bill/118th-congress/house-bill/9566 https://www.congress.gov/bill/118th-congress/house-bill/9566
        1y ago
grepfru_it 1y ago
>not something you would expect DOGE people to understand or respect To be fair I see in my daily life folks who copy and paste from stack overflow or random GitHub repo and move on with their day. They ignore the Creative Commons Attribution-ShareAlike or whatever license is applied to the code they copied. I see on this very site people who will share copyrighted articles that are behind a paywall (just because it is on some archive site doesn’t make it right). Please don’t take this as support for DOGE and the headaches they are causing. To make a cheap jab at a group of people while ignoring the group that you associate with is bad form.
- mistrial9 1y ago
  < To be fair irony
- Braxton1980 1y ago
  >To make a cheap jab at a group of people while ignoring the group that you associate with is bad form. What group does the person who makes the comment associate with?
- godelski 1y ago
  I'd say it's wrong in both cases, but we shouldn't ignore degrees of wrongness. Copy pasting from stack overflow without attribution is wrong but it's also harder to claim "ownership" over single lines or small snippets. It depends how "obvious" they are. You definitely can't copyright trivial functions. There's a lot of gray here but yes attribution is always good. But things get a lot less murky when we're talking about forking a project. That's usually nontrivial and non obvious. I think what's most important is that removing a license is an active decision. Certainly that would make a critical difference in a court [0] Then there's further escalation by who is doing the action. The more power and influence you have the greater responsibilities. All men are not created equal. Men with more power can disproportionally do more damage and require higher accountability. So yeah, I care a fuck ton more about a government employee doing something bad especially while performing official duties more than some rando. The ability to do harm is very different. The reason I dislike your comment is because it's dismissive of the action. "Other people do it!" Is not a defense nor excuse. It is even worse by ignoring multiple points of context. [0] though protecting open source has been traditionally hard for many reasons. Specifically it's hard for small developers to take legal action, especially against larger bodies. But isn't this something we should want to be fixed? Credit for our own contributions?!
Ferret7446 1y ago
The GitHub part makes it... weird. You are only required to keep the GPL3 license if you re-distribute it. Putting it in a GitHub repo, is ambiguous whether or not it is re-distributing it, at least morally. If you want to delete the license in a personal copy, that is perfectly valid according to the license terms. If you then happen to upload that to a private GitHub repo, also perfectly valid. If you then happen to upload that to a public GitHub repo, because of, say, restrictions on free private repos, without intent to distribute, then what?
- throwaway290 1y ago
  > If you then happen to upload that to a public GitHub repo, because of, say, restrictions on free private repos, without intent to distribute, then what? Then you keep the license eh? Distributing without an intent to distribute is distributing. Git is free and open source. If you want version control and collaboration and NO unintended distribution completely for free you can just use Git. It even has a built in server to share with your work buddies.
- odo1242 1y ago
  Putting it on a GitHub repo IS redistributing it. By putting it on GitHub you agree in the ToS that you have the rights to distribute the code. Which you only have if you don’t violate the license.
77pt77 1y ago
> I bet this was just pasted into LLM with prompt to make it async, but if that worked why not Vibe coding > Original GPL3 license is gone. Obviously not something you would expect DOGE people to understand or respect. Why would they? They don't give a FF about courts.

nativeit 1y ago

> On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundamental engineering failure.” “If this were a side project, it would just be bad code,” the reviewer wrote. “But if this is representative of how you build production systems, then there are much larger concerns. This implementation is fundamentally broken, and if anything similar to this is deployed in an environment handling sensitive data, it should be audited immediately.”

deepfriedrice 1y ago
The "critique" is nuts. Surely AI generated. If I didn't trust the domain, I'd assume the author to be incredible for seriously referencing something like this. Look at the critique [0] and then look at the code [1]. [0] https://web.archive.org/web/20250423135719/https://github.com/markoelez/async-ip-rotator/issues/1 https://web.archive.org/web/20250423135719/https://github.co... [1] https://github.com/ricci/async-ip-rotator/blob/master/src/async_ip_rotator/__init__.py https://github.com/ricci/async-ip-rotator/blob/master/src/as...
- krferriter 1y ago
  Lol that's so funny. Can't imagine writing that. (the critique, not the code).
- captainkrtek 1y ago
  Yea clearly AI with the keyword bolding, numbered arguments, and so on. Feel like lots of AI produced content follow this structured response pattern.
  - dragonwriter 1y ago
    It's uses a simple, purpose-focused template of a type that is a common recommendation for clear communication, outline numbering, and highlights keywords using monospaced text, as is common practice in technical writing. None of that is unusual for a human, especially writing something that they know is going to be high visibility, to do. Modestly competent presentation is now getting portrayed as an "AI tell".
    - captainkrtek 1y ago
      I’m not arguing that it’s unusual for humans to write in this manner, but when you use something like chatgpt with some frequency and see that as a common response template it’s an obvious pattern..
      - drusepth 1y ago
        People say emdashes are a signal that something's from chatgpt also — yet people forget that the cliches or patterns of LLMs are learned from real-world patterns. What is common in something like ChatGPT has a good chance to also be common outside of it, and _lots_ of false positives (and false negatives) are bound to creep up frequently when trying to do any sort of pattern-based "detection" here.
        chongli 1y ago
        Yes, emdashes are inserted automatically by iOS when a user inputs a double dash: —
mquander 1y ago
Seeing Krebs link to this downgrades my impression of how trustworthy his assessments are.
dessimus 1y ago
> it should be audited immediately. Certainly Elon made him print it out on paper to personally code review.

plandis 1y ago

GPLv3 requires the license to be kept. Seems reportable to the owner of the repo and or GitHub.

DrillShopper 1y ago
I'm sure the people who work for an administration that by and large flaunts court orders responsible for this will get right on that.....aaaand it's gone.
- amake 1y ago
  flouts
TheDong 1y ago
The only person who has standing to say anything is the original author of the code, the holder of the copyright. It's possible, but very unlikely, the copyright license wasn't actually violated because, for example, the fork could have arranged a separate license. The best example of this is the Qt Project's code: https://www.qt.io/qt-licensing https://www.qt.io/qt-licensing You can get it under a GPL license for free. You can pay them money to get it under a Commercial license that would let you modify the code without releasing changes. So, while I doubt it happened, the person who forked it here could have contacted the original author, the copyright holder, and asked for an exemption from the GPL terms.

dijksterhuis 1y ago

FYI the Fork got hidden/deleted in the last minute or so -- did anyone manage to clone it before it disappeared?

whalesalad 1y ago
I did. It's essentially just a single .py file: https://gist.github.com/whalesalad/06804fd734efe6bd2e0c84906576594b https://gist.github.com/whalesalad/06804fd734efe6bd2e0c84906...
- alright2565 1y ago
  x_forwarded_for = headers.get("X-Forwarded-For") if x_forwarded_for is None: x_forwarded_for = ipaddress.IPv4Address._string_from_ip_int( randint(0, MAX_IPV4) ) lol
  - marcusb 1y ago
    The original author claims this is to prevent API gateway from leaking the true client IP.
    - timewizard 1y ago
      To be fair the code actually creates a new API gateway server that acts as a proxy on to an already existing server and you're possibly meant to use this header with your own gateway service. So, it's set as a header, sent to a user owned proxy, then to the actual external endpoint. On the other hand I think the receiving API Gateway will be able to see and log your AWS account identifier when you do this. So your IP may not be the only identifying information that needs to be obscured for this to actually work.
      - icedchai 1y ago
        The code seems like a "creative" use of API gateway to turn it into a proxy for other external sites (single site, really, since you need one per site.) Wouldn't it be simpler to send the requests through a lambda (with a function URL) and get better control of the outbound requests?

darknavi 1y ago

The fork has been deleted it seems.

seejayjordan 1y ago
posted above ^^

0x_rs 1y ago

The repository has been deleted. In addition, 26 other repos have been removed from the account. This is in line with DOGE members' quick response scrubbing data whenever put into spotlight, as previously seen with another "teen hacker". [0] Archived repo page: https://archive.ph/LI7tt https://archive.ph/LI7tt; archived previous repo count: https://archive.ph/tgkg5 https://archive.ph/tgkg5 0. https://arstechnica.com/tech-policy/2025/04/i-no-longer-hack-paypals-doge-staffers-hacker-past-raises-red-flags https://arstechnica.com/tech-policy/2025/04/i-no-longer-hack...

grandempire 1y ago
[flagged]
- LiquidSky 1y ago
  These are government employees, you don't get to do that.
  - spauldo 1y ago
    Government software can't be copywrited, but the government is under no compulsion to share it. That's what FOIA requests are for.
    - godelski 1y ago
      Actually, they are. It's really more a question of with who and of course don't apply to classified material. But the SHARE IT act really helps formalize what was already happening. Most code is shared and made public. It's paid for by the public. Though it's usually not easily searchable as it's distributed via different platforms, means, and may even require submitting a freedom of information request first. But in more cases than not, there is obligation to share when requested. https://www.congress.gov/bill/118th-congress/house-bill/9566 https://www.congress.gov/bill/118th-congress/house-bill/9566
      - 1y ago

grepfru_it 1y ago

>not something you would expect DOGE people to understand or respect To be fair I see in my daily life folks who copy and paste from stack overflow or random GitHub repo and move on with their day. They ignore the Creative Commons Attribution-ShareAlike or whatever license is applied to the code they copied. I see on this very site people who will share copyrighted articles that are behind a paywall (just because it is on some archive site doesn’t make it right). Please don’t take this as support for DOGE and the headaches they are causing. To make a cheap jab at a group of people while ignoring the group that you associate with is bad form.

mistrial9 1y ago
< To be fair irony
Braxton1980 1y ago
>To make a cheap jab at a group of people while ignoring the group that you associate with is bad form. What group does the person who makes the comment associate with?
godelski 1y ago
I'd say it's wrong in both cases, but we shouldn't ignore degrees of wrongness. Copy pasting from stack overflow without attribution is wrong but it's also harder to claim "ownership" over single lines or small snippets. It depends how "obvious" they are. You definitely can't copyright trivial functions. There's a lot of gray here but yes attribution is always good. But things get a lot less murky when we're talking about forking a project. That's usually nontrivial and non obvious. I think what's most important is that removing a license is an active decision. Certainly that would make a critical difference in a court [0] Then there's further escalation by who is doing the action. The more power and influence you have the greater responsibilities. All men are not created equal. Men with more power can disproportionally do more damage and require higher accountability. So yeah, I care a fuck ton more about a government employee doing something bad especially while performing official duties more than some rando. The ability to do harm is very different. The reason I dislike your comment is because it's dismissive of the action. "Other people do it!" Is not a defense nor excuse. It is even worse by ignoring multiple points of context. [0] though protecting open source has been traditionally hard for many reasons. Specifically it's hard for small developers to take legal action, especially against larger bodies. But isn't this something we should want to be fixed? Credit for our own contributions?!

Ferret7446 1y ago

The GitHub part makes it... weird. You are only required to keep the GPL3 license if you re-distribute it. Putting it in a GitHub repo, is ambiguous whether or not it is re-distributing it, at least morally. If you want to delete the license in a personal copy, that is perfectly valid according to the license terms. If you then happen to upload that to a private GitHub repo, also perfectly valid. If you then happen to upload that to a public GitHub repo, because of, say, restrictions on free private repos, without intent to distribute, then what?

throwaway290 1y ago
> If you then happen to upload that to a public GitHub repo, because of, say, restrictions on free private repos, without intent to distribute, then what? Then you keep the license eh? Distributing without an intent to distribute is distributing. Git is free and open source. If you want version control and collaboration and NO unintended distribution completely for free you can just use Git. It even has a built in server to share with your work buddies.
odo1242 1y ago
Putting it on a GitHub repo IS redistributing it. By putting it on GitHub you agree in the ToS that you have the rights to distribute the code. Which you only have if you don’t violate the license.

77pt77 1y ago

> I bet this was just pasted into LLM with prompt to make it async, but if that worked why not Vibe coding > Original GPL3 license is gone. Obviously not something you would expect DOGE people to understand or respect. Why would they? They don't give a FF about courts.