The answer is: Russians

Source: I'm the guy that built the antimiasma mitigation tool [1] and tracked their malware campaign iterations very closely.

Set LANG to ru_RU.* and the malware implant stops spreading itself, as with all APT28/29 malware.

[1] https://github.com/cookiengineer/antimiasma

[2] https://cookie.engineer/projects/cyber-defense/antimiasma.ht...

That's what I always say, but nobody listens to me :D

Assembler had the same kind of design flaw, and we didn't learn anything from it as evident by LLM bypasses.

Lots of servers online have a publicly exposed smtp port, where all kinds of script kiddies are just using a sendmail style email from another (not-owned) domain.

DKIM/DMARC tried to fix this (without success due to fakeable entries in the DNS records, spf=all is pretty much everywhere anyways nowadays). So my proposal for actual ownership of domain AND server infrastructure would be mutual TLS. Reverse IP lookups are broken almost always anyways, due to most hosting providers not offering real reverse DNS infrastructure that users can modify.

This way a compromised server can't send as another domain, and large-scale spamming relays that rotate ASNs would have indicators in the cert itself, which they run out of real quick due to limitations of how many IP/DNS subjects you can set in an SSL/TLS cert.

No faking and avoiding bad IP reputations by rotating ASNs anymore.

Additionally, I would probably guess correctly that almost all spam comes from rotating ASNs these days. Aka from companies that do "growth marketing" or other bullshit that isn't a valid business but just... spamming people.

A lot of the domains that fall through the cracks for single-spam-campaigns have been taken over by botnet campaigns, so the actual owners of said domains probably don't know that their website is spamming everyone else.

But the major providers are the culprit, too, here. Gmail, hotmail, microsoft o365, mailgun ... they all don't even enforce SSL from server to server, and let through "sendmail" like spam because the spammers are paying customers to them.

Source: I am maintaining antispam [1] which I am using to combat spam, phishing, and malware campaigns targeting my customer networks.

[1] https://github.com/cookiengineer/antispam

Comments URL: https://news.ycombinator.com/item?id=49064548

Points: 1

# Comments: 0

(I recommend reading and implementing the Attention is all you need paper. By hand. Otherwise you won't learn anything from it.)

working as a Redteamer/Purpleteamer, I read this as you physically planting a (listening) bug in the HR office to get that info :D

Apertus and Soofi, both open source (not only open weight) models:

[1] https://apertus.ai/en/apps/apertus-model/

[2] https://www.soofi.info/

For my current setup, the most efficient way is to use larger models for coordination, but a heretic'ed qwen 30B model for the implementations. If you build your agentic environment around specifications and test coverage tied to symbols, you can do a lot of parallelization of agent work.

If you then separate the filesystem and tool read/write access by agent roles and policies (e.g. coder not allowed to modify unit tests, tester not allowed to modify code files) then you can force them to use a centralized per symbol/per contract specification tool.

And then you can just let agents discuss issues, where the messaging threads are also tied to the same symbols.

[1] Exocomp, highly experimental: https://github.com/cookiengineer/exocomp

This is essentially DNS, every single step of the way. Hosting wouldn't be hard if ISPs weren't so hostile with carrier-grade NATs, if HTTP/S wouldn't rely on DNS primarily, if legitimization were using actually mTLS instead... and all of the things usually break because of DNS and (lack of) proper standardization.

DNS in its current form is such a shitshow of RFCs overriding RFCs overriding RFCs...and not a single moment was spent on the configuration of DNS, or a protocol to request a domain, or a protocol to authenticate a domain, or a protocol to host something for a domain, ...

/nerdrage

I'm analyzing golang malware for my dayjob most of the time and I was annoyed by the typical decompiler pipelines that always try to generate Pseudo C code instead of reusing the information of known symbols to try to reconstruct the actual source code in the actual language it was written in.

So I'm using ImHex a LOT because it's by far the best hex editor out there, and it uses a (custom) pattern description language which is really useful for container formats, binary formats, and finding things that "come after known byte headers". The pattern descriptors are useful because they can replace binwalk and similar tools if you know how to write the patterns for the file formats you're looking for.

Coming back to Go binaries: A lot of times the assembled binaries still contain useful symbol names or strings that you can use to reconstruct what the source code looked like, but most decompilers don't care about intelligent symbol matching, and they always focus on pure disassembly workflows which are kind of useless for any binary that's been compiled by a VM based programming language.

This decompiler tries to use pattern matching to reconstruct things that are part of the stdlib in Go. Theoretically, you can extend this pattern database with whatever standard libraries are the most common ones out there to get better results (gin, gorilla, etc?).

I have no idea about other VM based binaries like C#, but if there's a runtime-specific header in that binary, and if the symbol names aren't obfuscated, this project could be ported to those languages, too.

However, this is a prototype that's been written with a lot of LLM assistance.

I would have never had the months of time needed to just write those thousands of demo code programs, debug the headers in the symbol/hash tables, find out how the Plan9/Go assembler looks like, and then add the pattern matchers and end to end unit tests for those.

Thought I'd share this approach, might be useful for a lot of other VM-based languages that have their own stdlibs. For the next couple weeks I'm probably going to refactor this, and try to find more efficient ways to lookup/replace known matching symbols.

Comments URL: https://news.ycombinator.com/item?id=48963373

Points: 5

# Comments: 1

That was initially USR1 and USR2 as process signals, well, at least across binutils and coreutils.

I just wish that UNIX architecture or POSIX would have been modernized since then, like with JSONL based process communication or similar things.

In Go I usually end up building my own JSONL protocol to marshal/unmarshal states between long running processes. Wish that could've been a POSIX standard.

Microsoft decided to send Windows NT 10.0 in the User-Agent header even on Windows 11 for compatibility reasons. That's literally the reason why the Sec-CH-* headers say Windows 11 but the User-Agent says Windows 10.

And regarding your claims of vendor interests: Nope, you seemingly never had to use O365 crapware on Linux browsers. They make it as painful as possible, and even disable copy/paste functionality when your User-Agent and Sec-CH headers say Linux. Identical browser with an extension that overrides the fingerprinting headers and it works perfectly.

Also as an additional note: Cloudflare does TCP fingerprinting, because no cloudflare pages will work (and send you into an infinite loop of unsolvable captchas) when these headers mismatch with the tcp window and other options in the handshake frames.

Source: am maintaining my chromium-profiles tool that generates farbled profiles with a generated extension, so that I can use shitty Microsoft products because my customers are not really the smartest policy decision makers.

PS: I will never use a separate laptop with a separate OS to use a damn web app. That is a completely unjustified waste of hardware resources and should be illegal. But here we are. Wasting one laptop at a time for absolutely no reason.

[1] https://github.com/cookiengineer/chromium-profiles

That's the culprit, because LLMs tend to forget and remove a lot of branch logic in these kinds of tasks. If unit tests don't cover these specific if/elseif/else cases, then they'll just disappear.

They'll also disappear if the LLM is allowed to modify the unit tests, because they sure like to cheat their way around into greenlit test suites. The agentic environment must disallow write access to the unit test files for the agent that writes the code.

If you implement that in your tools, you'll see quickly how the models will try to rewrite the unit tests at all cost, no matter what kind of prompting you've done. Tool policies are the only boundary to successfully guarantee this.

Source: Am building my own agentic environment because of that behavior

Experienced Go devs that stay inside the ecosystem try to write their libraries as "pure go" libraries with zero dependencies other than the upstream core libraries (or golang.org/x if needbe), which results in a very low maintenance ecosystem. This combined with the strong toolchain makes it joyful to work with.

I still don't agree with a lot of design choices of the language, but I realize that I can be more efficient if I am setting aside my opinion.

And that's exactly the thing that somehow never happened in the Rust ecosystem. I always joke that the Rust ecosystem has more OpenGL bindings than developers, because there's just so many low quality bindings or wrappers out there that the ecosystem in result got too noisy to maintain.

I don't want to write more (verbose) code. I want to write less.

I kind of already know that my comment goes to shit in terms of downvotes, but that's what I expect while writing this. How dare I criticized Rust as a language? How dare I, a fulltime noob, do this? Rust is better, always!

...the Rust ecosystem is just so effing toxic. I am glad that I left it. I just got tired of being angry at random online things all the time. Go is my happy place where my annoyances are reduced to Cgo, maps, and the unsafe package <3

The latter licenses I choose now only for things I absolutely don't care about and won't spend any time on. Things that I care about I license under AGPL. If someone wants it fixed by paying development time, great, then just offer it dual-licensed AGPL/EULA.