Hacker News Reader

Comment by dcow | Hacker News Reader

Yep, while the downside is that it wastes maintainers’ time and they are rightfully annoyed, I find the overall topic fascinating not repulsive. This is a real world red team pen test on one of the highest profile software projects. There is a lot to learn here all around! Hope the UMN people didn't burn goodwill by being too annoying, though. Sounds like they may not be the best red team after all...

View on HN

A good red team pentest would have been to just stop after the first round of patches, not to try again and then cry foul when they get rightfully rejected. Unless, of course, social denunciation is part of the attack- and yes, it's admittedly a pretty good sidechannel- but that's a rather grisly social engineering attack, wouldn't you agree?

A real world red team?

Wouldn't the correct term for that be: malicious threat actor?

Red team penetration testing doesn't involve the element of surprise, and is pre-arranged.

Intentionally wasting peoples time, and then going further to claim you weren't, is a malicious act as it intends to do harm.

I agree though, it's fascinating but only in the true crime sense.

Totally agree. It is a threat, not pen testing. Pen testing would stop when it was obvious they would or had succeeded and notify the project so they could remedy the process and prevent it in the future. Reverting to name calling and outright manipulative behavior is immature and counterproductive in any case except where the action is malicious.

Reply on news.ycombinator.com