- Hired a journalist on some mid-size news company to tarnish the company’s reputation. I never imagined they would bother to do this, but I was wrong.
- Used an APT for hire but I don’t believe they did succeed , still it is quite insane. I was lucky enough to catch a targeted rootkit but issue was quickly remediated. I’ll eventually find a consultant to analyse the Win 11 rootkit. They were definitely not script kiddies.
- Some black hat SEO and shills for hire, but that is expected.
I’m really surprised by hired journalist / APT aspect. Something I never imagined would happen, but apparently it does happen.
On the other hand, my first self-funded startup got destroyed by a VC funded venture. They had a worse product but far better marketing and they used every dirty trick in book to tarnish my company’s reputation.
There is no way I’ll start another startup unless I receive backing from a huge VC company.
Current economic paradigm is more similar to centralised/controlled economies of USSR. Thus if you want to succeed, you will need friends with connections to central banks.
So was the company the best in their field? I sometimes see small / badly managed companies pull such interview processes and it is ridiculous. You would expect they would hire 100x engineers with these tasks but I wonder what they are exactly looking for.
It is just a precaution measure, some of the malware like DDOS Bots might persist more than 6 months.
Honestly, an immutable OS would be more ideal but it isn’t very realistic. If you are adventurous, it would also be possible to setup a system where host image gets rebuild every night and persistent data gets pulled from a git repo.
I also recommend manually reading/checking the the BIOS EEPROM and re-installing the OS from scratch at least every 6 months. This should mostly eliminate most of the advanced threats.
You can setup an ansible script to re-install everything so it can automated.
You should absolutely never release a commercial binary to public with debug symbols.
There are ways to convert symbol names on the crash report server, so the claim that you can get better crash report with debug symbols is not correct.
Why you shouldn’t release debug symbols:
* It helps patent/copyright trolls litigate you easier.
* Makes it easier to reverse engineer your binaries, which will help malicious actors and competitors.
* You might lose some trade secrets.
If you are a startup owner, please ensure to never release commercial/close-source binaries with debug symbols. You can thank me later.
How did they target the group though, did they just scan the internet traffic and said, oh wow there is a group of people who only talk through Signal, or were there another precedence?
YouTube is horrendous, I keep reporting couple of animal abuse videos but platform just keeps them.
Some of these videos especially with small animals like hamsters have millions of views, so I guess there is a monetary incentive for them to keep such videos.
Is it possible to build a system where nobody owns private property but is happy?
Very unlikely but theoretically possible.
Main problem is that current ruling class is mostly comprised of psychopaths and what they actually mean is that “We will own everything, you will own nothing, and you will be happy or else!”
I think “You will own nothing, and be happy” can be utopic but we will first need to eliminate genes that cause psychopathy first.
But you can just issue an identical certificate to an existing website's certificate via the private key, it doesn't even need to enter to CT logs, it will have 100% identical fingerprint to original certificate, no?
You can then intercept everything through the ISP gateway. It would be theoretically possible to fragment the entire internet this way via coordinating with the ISPs.
In my opinion, most of the governments must have obtained access to numerous Certificate Authority private keys by now. As a result, they would not only be logging DNS records but also the entire unencrypted data transfer.
I think lesson to be learned here is that centralized systems such as the internet, due to CAs (including Cloudflare) and ISPs, are unsuitable for private communications.
It is so sad that so many people won't experience late 1980s and early 1990s era of the internet, which was devoid of extensive surveillance and censorship.
Hopefully, humanity will somehow figure out a superior, decentralized communications platform to ensure privacy. However, the current internet offers no such guarantees.
My recommendation at this stage is to assume that government and supranational organizations control the entirety of the internet and act accordingly as if internet had no privacy.
I’m new to Linux kernel programming & eBPF (just started last week) and I’m having major troubles with eBPF verifier. I honestly feel like it would be easier for me to write a kernel module than eBPF code.
I do wonder if this is the case for many people. It seems verifier is a bit unpredictable and makes eBPF programming quite painful.