Diseased Open Source Software Community - it's about ethics in Code of Conducts

[James Q Wilson]

All it needs is the keygen which plays midi music.

Back in the golden age of piracy.

 

[Electric Pence]

If you're going to hack people, it would probably be prudent to do it with a dedicated computer in a remote warehouse or someplace far from where you live so if it goes south you don't lose everything. Same goes with using a dummy computer for downloading stuff that you suspect might contain a virus or ransomware so if it gets fucked up, you don't lose everything.

But that's just me. I don't know if someone else said what I said, but I don't feel like reading 50 pages worth of comments.

 

[NulWillBecomeTranny]

This thread isn't for discussing Jews fighting each other, why are you two sperging so hard

No one is sperging aside from you.

 

[Shovel Mech Pilot]

This is awesome. He spergs out, apparently injures nobody but innocent bystanders and plenty of people he didn't intend to target, and essentially destroys his career as an open source developer in the process. Really amazing how karma can work so quickly.

 

[Faggotdog Niggertail]

Fucking funny as shit the cunt had it put this text file full of the hippiest of shits in in all these languages saying we are all human and we shouldn't fight and the motherfucker had the audacity to then single out some humans merely for being in a country because 'Putin bad'! The fucking irony is beautiful, he deserves everything he gets.

 

[Knight of the Rope]

His weird sentences and intentionally bad spelling are probably a mix of irony and he's obviously losing his mind a bit

He looks like he's having a full breakdown.

His nonsense about the Hindenburg is also interesting. How does he think the situations are at all similar? And what does he think the solution is, exactly? His supply chain attack happened because he took the years of trust he'd built up as a Node developer (lol) and traded it all in for a chance to fuck everybody over. That's always going to be a risk in any organization of any size. The counterbalance to that is supposed to be that most people that have entrenched themselves as (literal) fixtures of a respected community aren't insane faggots willing to destroy their own reputation for Twitter asspats. (Or to use his weird Hindenburg metaphor, there's nothing anyone can really do if the Hindenburg's pilot, trusted with the controls, wants to suddenly drive it into the ground.)

 

[Terence Trent D'ARPA]

"Sorry about that malware I wrote and spread to millions of computers surreptitiously (possibly including yours) then lied about and mocked everyone for being upset about. Please install this other software I wrote (that I pinky-swear isn't also malware) to help you find potential malware and vulnerabilities in your other software."

Fuck this asshole.

I wonder if for his next trick whether he'll scan his employer's Active Directory and disable any account where the user's name has a Russian naming convention. It'll be just as accurate as what he did here, because he's going to hit American and Ukranian accounts as well. But he won't -- because this is too close to home, and they can find him in the parking lot.

His attempt to become the next Frank Abagnale, Jr. or Kevin Mitnick with the "supply chain security" claptrap is off the mark. Both Abagnale and Mitnick give security training, but there's a reason people listen to them and not to Brandon Nozaki Miller:

1) Abagnale and Mitnick didn't go after individuals not connected to them, and
2) They both became consultants after serving time. In short, they had paid for their mistakes.

Brandon Nozaki Miller has not paid for his mistakes. And no, having your Twitter hijacked does not count.

 

[Marvin]

I wonder if for his next trick whether he'll scan his employer's Active Directory and disable any account where the user's name has a Russian naming convention. It'll be just as accurate as what he did here, because he's going to hit American and Ukranian accounts as well. But he won't -- because this is too close to home, and they can find him in the parking lot.

His attempt to become the next Frank Abagnale, Jr. or Kevin Mitnick with the "supply chain security" claptrap is off the mark. Both Abagnale and Mitnick give security training, but there's a reason people listen to them and not to Brandon Nozaki Miller:

1) Abagnale and Mitnick didn't go after individuals not connected to them, and
2) They both became consultants after serving time. In short, they had paid for their mistakes.

Brandon Nozaki Miller has not paid for his mistakes. And no, having your Twitter hijacked does not count.

Well and probably more importantly, they'll probably be able to provide more profound insights than just "when you get work from other people, you trust them, and sometimes that trust can be misplaced", which is really all he's offering.

 

[Dylan]

This faggot deserves to be turned into a tranny.
With 800cc bolt on, full face lift, lip fillers like baboon ass, and most importantly penile inversion at rumer's.

 

[The Demon]

Mostly peaceful malware.

It was an isolated incident that in no way connected to anything he's done

 

[Anne I. O'Nick]

The browser project Pale Moon has developed (another) slapfight between the core maintainers/developers:
https://forum.palemoon.org/viewtopic.php?f=65&t=28003 (a). I don't know what specifically caused this falling out, but there's a lot of good milk in the Pale Moon project. In the meantime we can enjoy one maintainer whacking another on the forums, trying to pull down the project infrastructure, and getting banned.

Reports where that Tobin tried to delete the website, DNS zonefile, etc. Moonchild currently reports the damage following Tobin's flameout:

Well, as it stands, we now have:

• No extension website.
• Only a few themes that FranklinDM maintains. Tobin claimed ownership of a number of them initially created by Lootyhoof but that's clearly off the table now.
• No code cross-reference for development.
• Pale Moon in need of a hotfix update.
• Some problematic language packs (and once again, no extension site to help people give access to them when they upgrade)

While All of that can be solved over time, they do cause significant trouble for the project. I'll likely put up basic placeholder locations today for the language packs and perhaps a basic listing of the converted -fxguid extensions (if I actually have them available, that was all on the server that was yanked offline the instant I left IRC) so people can at least download what they need as an emergency measure.

With high priority I'll work on, in this order:

1. Getting Pale Moon 30.0.1 built with critical fixes
2. Get emergency services up so people can at least get langpacks and extensions for Pale Moon 30
3. Fix language packs that are breakingly problematic (japanese indicated they had trouble with blank portions of the UI).

It's a big deal all in all and the project is seriously damaged. Some users are calling it criminal damage and suggesting that charges be pressed.

Backstory:
Pale Moon is fork of Firefox, originally gaining popularity off of the tantrum when Mozilla announced they'd stop supporting XUL (an extension framework) for firefox in 2016 on account of it being an unmaintainable piece of shit. This would have broken many popular plugins, giving PM the userbase it needed.

Since then it's a continuous clusterfuck. In 2019 they had a major security breach where malware was inserted into every archived version of the browser.

Moonchild (M. C. Straver), the primary developer, has been known for tantrums relating to distribution: most open source software releases source tarballs which people can use to build the product, and allow people to follow along and contribute. Pale Moon is not like this, instead the only supported/official release is pre-compiled by the developer and offered as a compiled binary that is impossible to verify matches the source code. The ongoing development of the source code has also been closed, offering only snapshots at the same time as a new binary release. Moonchild is vociferously against anyone forking his project, despite itself being a fork.

Despite ragging on Mozilla about dropping XUL and winning the userbase that cared about that, Moonchild boldly has since decided to drop support for XUL as well in 2021: https://www.ghacks.net/2021/04/28/p...refox-extensions-anymore-that-are-not-ported/ . The appropriate drama ensued as you'd expect /g/ spends 5 years stanning a browser as superior in the way that /g/ does, only for the new developer to pull the exact same shit.

In 2021, the meme dream reached fever pitch and someone created Male Poon to rip the shit out of him, which has since been taken down but archived here: https://git.kiwifarms.net/KotJohansson/Male-Poon

There's a starter for 10, and I hope someone will put in the effort needed to whipping this up into a thread of it's own. They all deserve one.

 

[James Q Wilson]

I’m reasonably sure this’d fall under whatever cyber crimes statute the US has.

Yup, what you're looking at there is a big ole violation of the CFAA or The Computer Faud and Abuse Act of 1986. The feds will ass fuck him with it. Minimum of 10 years, maybe more, been a while since the feds have really dunked on someone to make a point.

 

[Phil The Thrill]

The browser project Pale Moon has developed (another) slapfight between the core maintainers/developers

We know.

There's a starter for 10, and I hope someone will put in the effort needed to whipping this up into a thread of it's own. They all deserve one.

There already is one. We even have Tobin himself posting there. Granted, your post is miles and away better than the OP there, but you still get an alarm clock.

 

[Hồ Chí Minh]

The browser project Pale Moon has developed (another) slapfight between the core maintainers/developers:
https://forum.palemoon.org/viewtopic.php?f=65&t=28003 (a). I don't know what specifically caused this falling out, but there's a lot of good milk in the Pale Moon project. In the meantime we can enjoy one maintainer whacking another on the forums, trying to pull down the project infrastructure, and getting banned.

Reports where that Tobin tried to delete the website, DNS zonefile, etc. Moonchild currently reports the damage following Tobin's flameout:

It's a big deal all in all and the project is seriously damaged. Some users are calling it criminal damage and suggesting that charges be pressed.

Backstory:
Pale Moon is fork of Firefox, originally gaining popularity off of the tantrum when Mozilla announced they'd stop supporting XUL (an extension framework) for firefox in 2016 on account of it being an unmaintainable piece of shit. This would have broken many popular plugins, giving PM the userbase it needed.

Since then it's a continuous clusterfuck. In 2019 they had a major security breach where malware was inserted into every archived version of the browser.

Moonchild (M. C. Straver), the primary developer, has been known for tantrums relating to distribution: most open source software releases source tarballs which people can use to build the product, and allow people to follow along and contribute. Pale Moon is not like this, instead the only supported/official release is pre-compiled by the developer and offered as a compiled binary that is impossible to verify matches the source code. The ongoing development of the source code has also been closed, offering only snapshots at the same time as a new binary release. Moonchild is vociferously against anyone forking his project, despite itself being a fork.

Despite ragging on Mozilla about dropping XUL and winning the userbase that cared about that, Moonchild boldly has since decided to drop support for XUL as well in 2021: https://www.ghacks.net/2021/04/28/p...refox-extensions-anymore-that-are-not-ported/ . The appropriate drama ensued as you'd expect /g/ spends 5 years stanning a browser as superior in the way that /g/ does, only for the new developer to pull the exact same shit.

In 2021, the meme dream reached fever pitch and someone created Male Poon to rip the shit out of him, which has since been taken down but archived here: https://git.kiwifarms.net/KotJohansson/Male-Poon

There's a starter for 10, and I hope someone will put in the effort needed to whipping this up into a thread of it's own. They all deserve one.

The run-in when the OpenBSD people tried to make a Pale Moon port is infamous and pretty funny. Note this is just a development/staging thing where some OpenBSD devs work on ports: it's not "in OpenBSD ports" or anything close to that. That Tobin guy just went full guns blazing from the first sentence.

More license drama: one, two, three. The concept of "asking nicely" seems foreign to these people. Tobin also banned that MyPal thing from their extension thingy. They ban quite a lot of stuff in there for some reason.

The Pale Moon forums is pretty hilarious; there's quite a few people who are pretty deep in to all sorts of conspiracy stuff, people always shouting at each other, discussions about the Pale Moon browser veer off in to all sorts of weird political (often conspiratorial) directions, etc. You see this here too with weird comments about "enemies" and whatnot. I used to have a list of funny threads I compiled after that OpenBSD issue, but I can't find it right now so I don't think I have it any more.

 

[Reverend]

The run-in when the OpenBSD people tried to make a Pale Moon port is infamous and pretty funny. Note this is just a development/staging thing where some OpenBSD devs work on ports: it's not "in OpenBSD ports" or anything close to that. That Tobin guy just went full guns blazing from the first sentence.

More license drama: one, two, three. The concept of "asking nicely" seems foreign to these people. Tobin also banned that MyPal thing from their extension thingy. They ban quite a lot of stuff in there for some reason.

The Pale Moon forums is pretty hilarious; there's quite a few people who are pretty deep in to all sorts of conspiracy stuff, people always shouting at each other, discussions about the Pale Moon browser veer off in to all sorts of weird political (often conspiratorial) directions, etc. You see this here too with weird comments about "enemies" and whatnot. I used to have a list of funny threads I compiled after that OpenBSD issue, but I can't find it right now so I don't think I have it any more.

He should have been HONORED that it's getting an OpenBSD port as it'll clean up the code base to be secure, clearly defined, and functional unlike the spaghetti mess of shit code that it is right now.

EDIT: Reading that DEMAND letter was fucking golden and Ibara sounded just like Patrick Tomlinson with his dismissal of "Go away petulant child"

 

[AnOminous]

The Pale Moon forums is pretty hilarious; there's quite a few people who are pretty deep in to all sorts of conspiracy stuff, people always shouting at each other, discussions about the Pale Moon browser veer off in to all sorts of weird political (often conspiratorial) directions, etc. You see this here too with weird comments about "enemies" and whatnot. I used to have a list of funny threads I compiled after that OpenBSD issue, but I can't find it right now so I don't think I have it any more.

I used to use this with a very old MacBook (in fact the very first one), because it was one of the few browsers still supported for 32 bit OSes, so would still work in Snow Leopard. I'm glad I didn't have to rely on it after the autism of the project began to affect the quality of the product.

It was pretty good for what it did.

 

[Anne I. O'Nick]

There already is one. We even have Tobin himself posting there. Granted, your post is miles and away better than the OP there, but you still get an alarm clock.

I'll take a late rate just so people don't have to read that thread. We need to stop letting the cows schiz out here.

 

[Druveer]

The real good stuff feels like a hidden treasure of the 2000s and early 2010s. Some of the old songs are so good they're even referenced or sampled today. The Sony Vegas 9.x keygen music was remixed for Deltarune, and RELOADED's Torchlight II tune has a cult following.

https://www.youtube.com/watch?v=cmdprbBOMT8

https://www.youtube.com/watch?v=p_hgRLp-y_s

In the mid 90s I downloaded something from really good midi music and have really beautiful full screen visualizers... that's all it was (as far as I know) no keygen, just that. Loved it. Wish I could find it or something like it again.

watashiwakichigai@yahoo.com is the single fucking cringiest thing I’ve read in my life. Pro tip: don’t ever use Japanese in your username unless you want to look like a retard and a weeb at the same time. That phrase you think sounds cool or neat? It really doesn’t. People who don’t know Japanese won’t understand it and, like in this case, you’ll end up with a name that will make Japanese people think you’re retarded.

It's pretty much the same issue when you see rich(ish) chinese people wearing shirts that say random english words.

 

[yourdadscumdumpster]

https://news.ycombinator.com/item?id=30762520

No real cows involved here but a shocking lack of security oversight. To understand how big of a fuck up this was/is - imagine that a user's SSO they use for ever service was compromised. Now, imagine that not only their entire company's entire set of SSO logins was compromised - but that EVERY SSO account managed by the SSO infrastructure provider was now available to be used by malicious actors.

This is what happened with Okta. An employee (or employees') account was made vulnerable to remote access, with all major privileges. Compounding the issue was the firm's steadfast denial for hours that the intrusion had occurred. Even now, having acknowledged it, the firm continues to downplay the significance.

https://news.ycombinator.com/item?id=30769537

In January 2022, Okta detected an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider. As part of our regular procedures, we alerted the provider to the situation, while simultaneously terminating the user’s active Okta sessions and suspending the individual’s account. Following those actions, we shared pertinent information (including suspicious IP addresses) to supplement their investigation, which was supported by a third-party forensics firm.

Following the completion of the service provider’s investigation, we received a report from the forensics firm this week. The report highlighted that there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop. This is consistent with the screenshots that we became aware of yesterday.

Their report contradicts itself directly within the first two paragraphs, making the rest of the laughable attempt at a "post mortem" difficult to put much stock in.

Unfortunately for corporate users, there's no much indication any other SSO infrastructure operators are much better. With no industry standard on auditing SSO platforms and with clients having little to no oversight on the security practices of their SSO providers, customers have to take it on a good faith basis that SSO infra providers are protecting their, and their clients', assets in an appropriate matter.

Sadly I expect this story to have little to no lasting impact and for these kind of glaring hijack exploits to continue to pop up from time to time. It'll take a massive abuse (i.e. a Colonial Pipeline situation) before the right parties wisen up and take the industry to task.

EDIT: Microsoft has done a far better job highlighting the modus operandi of these actors than Okta did - and revealed that Okta was just the tip of the iceberg. https://www.microsoft.com/security/...ations-for-data-exfiltration-and-destruction/

EDIT 2: https://www.okta.com/blog/2022/03/oktas-investigation-of-the-january-2022-compromise/ Okta has doubled down on their claim now that NO breach occurred despite Microsoft's independent verification of the threat actor's network and process. This is such a bad look and these guys are such massive beneficiaries of vendor lock-in and customer inertia.

 

[306h4Ge5eJUJ]

Giving a single company the ability to forge login credentials all over the place is such an amazingly retarded decision it boggles the mind. I hope saving the few bucks in administration costs was worth this disaster.