6 ms·

I think the paranoia and fear this kind of idea promotes is perhaps the point of all of it. Why this is being discussed publicly? It seems way more reasonable

I think the paranoia and fear this kind of idea promotes is perhaps the point of all of it. Why this is being discussed publicly? It seems way more reasonable to inform IT companies directly, or investigate it outside media attention. Also, we need steps towards reducing the possible tools that fake workers could leverage. These steps would put a strain on some recent technological developments. A strange and wild paradox.

markerz 1y ago
Why try to hide it? It’s like public disclosures of security vulnerabilities. You directly contact the few people who have actionable data and means to address the problem, then you tell the world that they’re impacted and should be aware that such a problem exists so we don’t repeat it.
- alganet 1y ago
  Private disclosures for more sensitive vulnerabilities are a recommended practice. In your analogy, that's why I aluded to. In such cases, you only share the sensitive vulnerability publicly once there is a fix. For this case, there seems to be no fix. One could think of it as a way to promote more scrutinized hiring processes, but it actually encourages widespread paranoia and fear. It seems your analogy is valid, but the conclusion is that it supports what I said.
brookst 1y ago
I’m not sure it’s good for anyone to keep SMB’s in the dark, as they have the most surface area and least expertise and budget to respond. It seems like a net benefit to publicize the issue and get every IT hiring manager thinking about it.
- alganet 1y ago
  Can you elaborate more? It seems that you disagree but I'm missing the rationale behind it.
  - brookst 1y ago
    Keeping it quiet and only disclosing to larger firms means that lots of small firms will hire these people, with the economic and IP harms they entails.
    - alganet 1y ago
      As you said, small businessess have less expertise and budget to deal with the problem. Telling your gramma she has a virus only makes her become afraid, she won't magically gain the ability to identify it. That's my whole reasoning here. It makes things worse.
nucleardog 1y ago
Inform what companies directly? If it's this pervasive, that's not going to be effective. I work at a small (~30 person) SaaS company. We interviewed what I took to be a case of this the other day (all the classic signs). Nobody would be keeping an eye on our hires or letting us know about this. And in the process of confirming that this was fishy, I contacted one of the past employers he claimed after doing my best to confirm _they_ weren't in any way part of the scam. They confirmed he had never worked there. I sent them his LinkedIn and portfolio site in case they wanted to chase down getting their name removed. They told me that this was super concerning because the screenshots in his portfolio of the app he worked on for them were real screenshots... for an unreleased app that was only available internally and had never even been demoed for clients. They'd already been breached and had god knows what exfiltrated. They found out because we caught an attempt to get hired at _our_ company and let them know. Nobody outside of a couple of technical staff at our company had even _heard_ of this. Nobody at the other company had. The fix, to me, seems to be making people involved in hiring more aware of this. If anything, it seems we should be talking about this _more_ and _more publicly_.
- alganet 1y ago
  Is your company involved in infrastructural or emerging tech in any way? Forgive my frankness, but these worries about infiltrators have priority in important, large companies. I am very sure agencies responsible for this can contact these handful of important companies directly. So, you're right. In the current age we live in, no one cares about your small SaaS company, and you're being used to spread unecessary paranoia and fear.
  - jjmarr 1y ago
    North Korea has a shortage of foreign currency. It's not just espionage. They need US dollars to pay for smugglers.
    - alganet 1y ago
      Greed meets greed. Companies hiring cheap labor, being exploited in several fronts. It was a decision for several companies to spread thin their offshore hiring. They practically invited infiltrators in. Keep focused. Small companies never mattered for nations, they are irrelevant. Spreading paranoia will not solve their over-reliance on this exploited offshore problem. It will likely lead them to bankrupcy. Ultimately, it doesn't invalidate what I said. It actually makes my comment more relevant.
NitpickLawyer 1y ago
> Why this is being discussed publicly? It seems way more reasonable to inform IT companies directly, or investigate it outside media attention. One key component for this scheme to work is to have local US persons act as intermediaries. While some may already know something shady is going on, and be complicit, some might not understand the entire scope of what they're being part of. Publicly discussing it might encourage some people to come forward / avoid being involved in the future.
- fuzzzerd 1y ago
  Living up to your screen name I see, but in all seriousness, I fully agree. The average person running the laptops in a spare bedroom may have no idea the scope of what they're involved with. Especially if they're being duped as well. Imagine a non technical person being told they're helping run an "edge data center, close to the users. Running our laptops helps Netflix/facebook/etc (insert big tech name of your choice) run faster for you and your neighbors and well pay you to do it." Easy to imagine a non technical person buying that lie.
  - alganet 1y ago
    I'm having a hard time understanding your imagined scenario. Can you please explain it better?
    - fuzzzerd 1y ago
      NK "fake employee" finds a non technical American to run their laptop farm by lying to them that running these laptops is helping make their access to some service faster.
      - alganet 1y ago
        Sounds very convoluted. I'm sure many, many countries have botnets. I have a bunch of those countries which I consider irresponsible and wreckless in my radar, not only north korea.

markerz 1y ago

Why try to hide it? It’s like public disclosures of security vulnerabilities. You directly contact the few people who have actionable data and means to address the problem, then you tell the world that they’re impacted and should be aware that such a problem exists so we don’t repeat it.

alganet 1y ago
Private disclosures for more sensitive vulnerabilities are a recommended practice. In your analogy, that's why I aluded to. In such cases, you only share the sensitive vulnerability publicly once there is a fix. For this case, there seems to be no fix. One could think of it as a way to promote more scrutinized hiring processes, but it actually encourages widespread paranoia and fear. It seems your analogy is valid, but the conclusion is that it supports what I said.

brookst 1y ago

I’m not sure it’s good for anyone to keep SMB’s in the dark, as they have the most surface area and least expertise and budget to respond. It seems like a net benefit to publicize the issue and get every IT hiring manager thinking about it.

alganet 1y ago
Can you elaborate more? It seems that you disagree but I'm missing the rationale behind it.
- brookst 1y ago
  Keeping it quiet and only disclosing to larger firms means that lots of small firms will hire these people, with the economic and IP harms they entails.
  - alganet 1y ago
    As you said, small businessess have less expertise and budget to deal with the problem. Telling your gramma she has a virus only makes her become afraid, she won't magically gain the ability to identify it. That's my whole reasoning here. It makes things worse.

nucleardog 1y ago

Inform what companies directly? If it's this pervasive, that's not going to be effective. I work at a small (~30 person) SaaS company. We interviewed what I took to be a case of this the other day (all the classic signs). Nobody would be keeping an eye on our hires or letting us know about this. And in the process of confirming that this was fishy, I contacted one of the past employers he claimed after doing my best to confirm _they_ weren't in any way part of the scam. They confirmed he had never worked there. I sent them his LinkedIn and portfolio site in case they wanted to chase down getting their name removed. They told me that this was super concerning because the screenshots in his portfolio of the app he worked on for them were real screenshots... for an unreleased app that was only available internally and had never even been demoed for clients. They'd already been breached and had god knows what exfiltrated. They found out because we caught an attempt to get hired at _our_ company and let them know. Nobody outside of a couple of technical staff at our company had even _heard_ of this. Nobody at the other company had. The fix, to me, seems to be making people involved in hiring more aware of this. If anything, it seems we should be talking about this _more_ and _more publicly_.

alganet 1y ago
Is your company involved in infrastructural or emerging tech in any way? Forgive my frankness, but these worries about infiltrators have priority in important, large companies. I am very sure agencies responsible for this can contact these handful of important companies directly. So, you're right. In the current age we live in, no one cares about your small SaaS company, and you're being used to spread unecessary paranoia and fear.
- jjmarr 1y ago
  North Korea has a shortage of foreign currency. It's not just espionage. They need US dollars to pay for smugglers.
  - alganet 1y ago
    Greed meets greed. Companies hiring cheap labor, being exploited in several fronts. It was a decision for several companies to spread thin their offshore hiring. They practically invited infiltrators in. Keep focused. Small companies never mattered for nations, they are irrelevant. Spreading paranoia will not solve their over-reliance on this exploited offshore problem. It will likely lead them to bankrupcy. Ultimately, it doesn't invalidate what I said. It actually makes my comment more relevant.

NitpickLawyer 1y ago

> Why this is being discussed publicly? It seems way more reasonable to inform IT companies directly, or investigate it outside media attention. One key component for this scheme to work is to have local US persons act as intermediaries. While some may already know something shady is going on, and be complicit, some might not understand the entire scope of what they're being part of. Publicly discussing it might encourage some people to come forward / avoid being involved in the future.

fuzzzerd 1y ago
Living up to your screen name I see, but in all seriousness, I fully agree. The average person running the laptops in a spare bedroom may have no idea the scope of what they're involved with. Especially if they're being duped as well. Imagine a non technical person being told they're helping run an "edge data center, close to the users. Running our laptops helps Netflix/facebook/etc (insert big tech name of your choice) run faster for you and your neighbors and well pay you to do it." Easy to imagine a non technical person buying that lie.
- alganet 1y ago
  I'm having a hard time understanding your imagined scenario. Can you please explain it better?
  - fuzzzerd 1y ago
    NK "fake employee" finds a non technical American to run their laptop farm by lying to them that running these laptops is helping make their access to some service faster.
    - alganet 1y ago
      Sounds very convoluted. I'm sure many, many countries have botnets. I have a bunch of those countries which I consider irresponsible and wreckless in my radar, not only north korea.