I've had this happen a few times getting interview requests from Indian recruiting firms. It sounded familiar. You go through a screening, then get passed onto the "code challenge" part. You have to download a GitHub file and then work on it, check it back in and push it so they can examine what you did.
Twice I scanned the file after downloading it to a sandbox and twice it found malware that would've been installed.
While this is by far the worst case of this happening, I've read at least a half dozen other accounts of recruiting companies attempting to install malware through the same process. I'm not saying the person should have known, but it's scary this is becoming more and more common.
This person definitely should have known. You don't download and run arbitrary binaries outside of a VM. At this point you don't even compile code from an untrusted source. This is the power user equivalent of falling for a phishing email.
If they did and didn't account for a simple scenario like this happening and built in roadblocks and friction to prevent it from happening? Then it would stand to reason their entire EIS team should be fired.
The fact nobody thought of this is pretty staggering.
He likely spent a few hundred dollars on the sign - sourcing the proper metal of that size, the reflectors, the masks, and so on.
As to the time investment:
> He spent more than three months preparing, researching the color and shape of the signs, mixing his own custom paint to get the colors just right, and applying a bit of faux patina to finish it off. Ankrom even spent time tracking down the button-shaped reflectors used on other legitimate signs and convincing the supplier to give him some. Once he was satisfied that it looked authentic, he came up with a plan to install it.
---
Caltrans has 15,000 miles of state highways that they have signage for. A single sign may only get reviewed once a decade because of that.
Doing single things in isolation is "easy" without going through the required public comments and such. Maintaining it for the entire state is much more challenging.
Caltrans is so frustrating how they do signage and freeway identification. N-S roads sometimes become referred to as E-W roads in signage sometimes simultaneously. Hardly ever showing exit numbers. Actually using the freeways formal longform name in signage. Outside of signs theres also the all too frequently seen deadly combo of zero left shoulder + lowest cement divider you’ve ever seen + modern headlights dazzling you in the opposite lane.
This is the old, "Easier to ask for forgiveness than to ask for permission"
A lot of these companies have taken this approach. Break laws until someone finally notices AND does something about it. The runway to a slap on the wrist is often times more financially beneficial to companies - there is no incentive to stop if you run a billion dollar company and breaking the law gets you a $50M dollar fine you make back in a single month.
I thought SOX (Sarbanes–Oxley Act) was supposed to prevent a lot of this, but I guess companies just continue to find loopholes to exploit.
>> Front end frameworks are usually pushed by developers, not management.
The last ten years I spent as a front-end "full stack" dev and every time there was some new shiny JS framework, all the devs would get out their tiki torches and pitchforks, go to management and tell them they should really really move to this new framework because blah blah blah.
In less than five years our department did this:
backbone -> angular -> react -> ember -> next -> vue -> svelte -> and finally back to angular/react which is what a majority of what we build with now.
Doing this insanity also created a way for mangers to make sure their year-end reviews looked good and polished. Every time an app that was built on a framework a few years old, suddenly a manager would declare it "dead" and needed to be re-built in record time (because the new framework allows devs to build Rome in a few days time). We would bust ass, usually hitting the deadline with something put together with duct tape and code no dev would willingly sign off on. Manager gets their raise and bonus at the expense of a host of devs running for the door.
Rinse, repeat. But 100% of the framework changes were always pushed the hardest by the devs.
Worked at a Fortune 200 company. Any govt project you worked on, you had have to have a basic civi security clearance. Any govt contract we got specifically stated you couldn't have off shore folks working on any of the code. Not sure how MS got around those requirements.
You gotta get to the Fortune 10 before the real leverage kicks in! On the other hand the fortune 200 company I worked for briefly had many signs of deep seated corruption. I couldn't stick around for a multitude of reasons, but the "follow the rules wink wink" attitude was flabbergasting, I'm sour on publicly traded companies ever since, how do you know you're not investing in Space Balls?
Finding an easy solution to making spare money keep up with inflation+ is the problem. The default investment solution is to put it into some mixed fund, but if you drill into the moral implication of that who knows what clownery I'm funding. How can I invest and have a better then average expectation that the money won't fund something corrupt.
burningChrome is broadly correct, but the devil is in the details.
There's quite a history of US federal programs encouraging critical federal systems to operate within private infrastructure. This once required very strict scrutiny, joint DoD/DHS/GSA reviews, and was generally a long/expensive process that created the perception that a few providers had a gotten a hold over various agencies through these outsourced operations, which, combined with a fresh "interest" in federal efficiency, influenced a recent national defense budget authorization to formalize a slew of processes with a few minor tweaks as the law of the land, with a tweak or two to allow new cloud operators and service providers to authorize quickly and operate efficiently, particularly for low-risk classes.
Today, this means SASS providers must find an engineer with clearance (not just authorization to work in the USA). This cleared programmer documents and authors a whole host of (typically new) procedures, such as authenticating against a "federal enclave" authorization directory, delivering changes authored upstream to a government-controlled CI/CD system, and working with the SASS provider and the Government Services Agency (GSA) to ensure the backend operates when running within something that could be compared to a special AWS AZ. Things change upstream, and our operator prepares a 'significant change' request, which is, if important, gated by a liaison from the GSA. No one is responsible for scrutinizing implementation details of these 'significant change' requests, nor are their authors required to provide any information about themselves or the code's provenance. Given that hundreds of programmers may have written code included in said change (which is typically already deployed upstream), this is often efficient and generally fine.
Easy. They hired Americans to be actual keyboard people but they didn’t know anything so they were basically a KVM. However Microsoft could say “Yes only Americans were making changes. “
Step 2. Copy it into your repo. Who cares what the license says, how would the authors of that code ever see it being misused, because the place it is being misused requires a security clearance?
Step 3. Deliver the code as yours.
Truly, how will the people who authored something on GitHub ever know? Any circumstance you describe would require someone without clearance to know implementation details of some software. Which is to say, either the thing I describe happens all the time, or security clearances are overblown.
I guess like that: “we are Microsoft, 95% of your things runs on us, you want to stick to the rules? - OK that’s additional 10% on each and every license you have with us. You are still here or are we done?”
You just tell them to pound sand and switch providers no matter how painful. Google Cloud exists and the product suite is better than Microsoft’s anyway. Never except extortion, doubly so for our government.
Believe it or not, Microsoft is more dependent on those government contracts than the other way around.
This looks like full blown criminal negligence on Microsoft's part. Charges should be filed.
But that's a fantasy.
No one will face any consequences whatsoever. Retraining staff and migrating to a new cloud provider is very expensive.
Personally I think Gov should run its own cloud , as in from the data center level up. Don't depend on consultants, actually hire full time federal employees to do this.
Won't ever happen though. No way to grease palms without contractors in the mix
>> I've long suspected Amazon's search is so crappy because it makes their ads necessary to actually surface a product.
I thought it was just because they were forcing third tier Chinese knockoffs for everything I searched for. After a few months, I gave up completely. I now look for product reviews on YT, THEN go back to Amazon and search for exactly what I'm looking for. Even then? The search results are still jammed with cheap knockoffs.
>> If I had to compile all the resources I had consulted for something like C programming, they wouldn't amount to a single shelf.
Serious question - with something like a programming language where there is a sort of finite information available about the language and how to use it. I've found once you start moving into areas where this isn't the case like metaphysics where there is a lot more ambiguity, does the sourcing and information then become more valuable? Or are we going to finally be ok with ambiguity as humans?
I can see what you're saying and agree, but are there areas where sourcing does in fact become more important?
Gaming laptops they've never competed at all. Windows laptops offer far more form factors with easily upgradeable hardware. One of the only places Apple has an advantage is their chipsets. However, Qualcomm’s Snapdragon X chips have significantly closed the gap on Apple's ARM based M-chips.
I just got a 16" MacBook Pro with an M5 pro chipset and its total pig compared to my 15.6" HP ZBook Power G8.
The only area I can see where Apple is still holding their own is their UI/UX has always been buttery smooth compared to Windows or Linux. Not a fan the new liquid glass, but its still a very smooth running UI regardless.
As a personal vendetta against Jani Patokallio (a Finnish cybersecurity blogger) who was trying to unmask the person who ran the site - which goes back to 2023.
I don't really care about that though, because trying to dox someone and get them killed isn't a good or moral thing to do. You could easily just not do that. You have to really go out of your way to try and hunt someone down, and at any point you could just not do it. For the targeted person to want revenge is just an inevitability.
Twice I scanned the file after downloading it to a sandbox and twice it found malware that would've been installed.
While this is by far the worst case of this happening, I've read at least a half dozen other accounts of recruiting companies attempting to install malware through the same process. I'm not saying the person should have known, but it's scary this is becoming more and more common.
reply