Hacker News Reader

Comment by EMIRELADERO | Hacker News Reader

Could any kind soul out there upload the repositories to a public git instance?

No? It's 44GB of data.

Magnet:

    magnet:?xt=urn:btih:7e0ac90b489baee8a823381792ec67d465488fef&dn=yandexarc&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce

Download at your own risk, comes from a brand new user on BreachForums

It's a joy seeing flags from all the world in the torrent peers. Special mention to Ukraine and Russia itself.

Hack the planet! ~

It's VPN.

I would not build it, but I am sure just looking at code won't be the end of the world ( cue some ridiculous end of world the scenario Family Guy style ). There are risks, but I am not sure those risks are legal risks in this case. They are more along the lines of.. you wouldn't download and build Ghidra without checking would you?

Who am I kidding.

>They are more along the lines of.. you wouldn’t download and build Ghidra without checking would you?

Ah, I think Ghidra is trustworthy now that it’s been OSS for years. I’ve heard it’s especially good for debugging performance issues with certain SCADA systems. Your centrifuges aren’t behaving? Better fire up Ghidra and figure it out!

> Download at your own risk

Baseless fear-mongering or is there some truth to this you can elaborate on?

There'd be no harm in poking around.

More like: might be illegal in your country to even download (don't know where the downloader is from, laws differ and bittorrent dht is easy to spy on) and I'm not the first-hand source of the torrent nor have I downloaded it myself, just forwarding a download link.

just means that given the nature of BitTorrent, you will be exposing your IP address to other peers and trackers

There are many attack vectors with a dump like this. Running any make, mvn, cargo build, ./configure, etc command can run arbitrary code on your system. These can be added by the anonymous uploader or yandex themselves (they could add a dependency to some tracking site to get your IP as the most basic example).

There can also be dangerous git hooks. you're basically downloading a malicious exe, and any seemingly harmless command could be dangerous

magnet:?xt=urn:btih:7e0ac90b489baee8a823381792ec67d465488fef&dn=yandexarc&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80%2Fannounce&tr=udp%3A%2F%2F9.rarbg.to%3A2920&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2Fexodus.desync.com%3A6969&tr=udp%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&tr=udp%3A%2F%2Fopen.demonii.com%3A1337%2Fannounce

Would that kind soul get sued or flagged by the Kremlin

Please!

Reply on news.ycombinator.com