Hacker News Reader

Comment by godelski | Hacker News Reader

Please upload source in an unzipped format. If the concern is about GitHub taking it down, use an alternative. There's plenty and many other ways to distribute source in an uncompressed manner.

Otherwise this is indistinguishable from a hack. How do I know these zips are secure? The mega and pixeldrain report different sizes. Rabbit is entirely about hype and a scam, how are we supposed to know this isn't the same nefarious ploy?

I appreciate what's being done and think it's good to call out these scams (I've done so myself) but help by building some trust. We understand the need for anonymity but a nefarious actor could just as easily mascaraed as the same repo. And if you do need files downloaded, provide hashes.

(Fwiw, xz, despite recent events, is great at compression and can help you reduce your bandwidth if needed)

View on HN

> (Fwiw, xz, despite recent events, is great at compression and can help you reduce your bandwidth if needed)

zstd level 22 is even better in my experience

What is the reason for it to be uncompressed?

I suppose the risk of a 0-day in the compression format, given we’re in the post-xz-era. Publishing the source code in clear text would alleviate such risk for the consumer

1. I can read it on my phone or in my browser.

2. Why should I have to download text to __read text__?

3. We don't want to normalize unnecessary behavior that is something scammers and bad actors can easily take advantage of.

While I don't believe the leak is nefarious or contains an exploit, normalizing a requirement to download files that can issue exploits -- when there are easy alternatives that make this unnecessary -- just helps create the exact type of environment that scammers thrive in. 3 is incredibly important. If we're going to call out scammers we shouldn't do it in a manner where we're enabling an environment for more scammers to thrive in. Doing what's done here just created a rich opportunity for hackers who can now post a "rabbit source code leak" and just provide people with a different link. Makes for easy picking. Uncompressed and readable code just makes this harder and easier for people to determine if something nefarious is going on.

It's not a single file unless it's tar'd or compressed or whatever. It's completely normal to distribute software projects as some form of archive. This is doubly true for a "leak" like this where you want the single file to spread around.

I agree that it would be nice to have it browsable online, like in a github repo or whatever, but that's a separate issue.

> It's completely normal to distribute software projects as some form of archive

Again, I think you're missing my point

>> normalizing a requirement to download files that can issue exploits -- when there are easy alternatives that make this unnecessary -- just helps create the exact type of environment that scammers thrive in

Yes, it is "normal" and that is exactly the problem.

Ask yourself this

  Is there a reasonable alternative? 
  Is downloading necessary?

I think you'll find that the answer to both is unambiguously "no." I think you'll also recognize that having the readable source __also__ unambiguously creates higher utility.

So you don't need to explain to me that this stuff is normal because I already understand that (and am actively demonstrating a knowledge of this). I realize communication isn't always obvious, but if someone is telling you that you're missing the point of what they're saying, please consider that you might actually be missing the point rather than doubling down. Even if you aren't, someone telling you that indicates that somewhere there's a miscommunication, and that needs to be resolved.

I would prefer that it is distributed as a zip. It allows me to easily get the entire file, and hash it to make sure it's the same file as other people are getting, and have an archive of it.

I would also like to be able to browse it online, but this is a usability issue for strictly when I'm intending to read it in a browser alone.

As to your final paragraphs referring to communication and me "explainig to you that this stuff is normal", you specifically said that "We don't want to normalize unnecessary behavior" which implies that you do not think it is already normalized. You're also implying that I should have altered my interpretation of your words when you said that I was missing your point, even though you didn't say I was missing your point until the same reply.

In any case, I think I understand your POV regarding archives, and I disagree.

> I would prefer that it is distributed as a zip. It allows me to easily get the entire file, and hash it to make sure it's the same file as other people are getting, and have an archive of it.

I mean hosting it on any GitHub alternative makes this possible too. We also get better archival because when things change, we can see. Considering this says "Part 1" I expect things to change. History tracking is better for archival.

> you specifically said that "We don't want to normalize unnecessary behavior" which implies that you do not think it is already normalized.

That's not accurate. Here's a counter example "We don't want to normalize clickbait headlines." Clickbait headlines are already normalized, that does not mean we want them to be nor does it mean we should accept them and not fight against them. I'm sure you can find many other similar examples.

To me the question is, why would you put source code on github if you're not going to make it uncompressed? What's the point of using a source code hosting website if your payload is a link to an upload site? Pastebin sites have been around for years.

Exactly. Similar questions

  Why does a user need to download a file to achieve the goals? Does doing so provide added utility?
  Does obscurification provide some benefit?
  Does distribution in this manner help normalize environments which scammers take advantage of?

I'd argue:

  - Don't make users download things they don't have to.
  - Serving in plain text gives higher utility as users can view it on any device (e.g. mobile. Am I the only one that reads repos on mobile?)
    - A GitHub alternative also provides the capacity to download an archived zip, thus achieving any benefits that aren't obscurification related
    - Git helps for better archiving as we can have a track record of commits and changes (this is labeled "Part 1"!)
    - Did no one else notice that there are ".github" directories with workflows? But there is no ".git" folder? I'd honestly like that...
  - While a zip itself is not an executable and not generally dangerous in of itself, scammers (hackers) do take advantage of such environments. Because you can... change a file extension. Or because a user may double click the zip to extract, but this will cause execution. Or idk, hackers are fucking smart and people are dumb.

I'm a bit peeved that people feel the need to explain to me that a zip isn't nefarious in of itself, because that's not what I was concerned with (and that there's several such comments and we don't need to keep repeating the same comment...). My concern is with how such formatting is (as best as I can tell) not necessary, suboptimal, and normalizes practices that nefarious actors take advantage of. This topic is obviously hot, so I won't be surprised if there are "alternative links" that could just contain straight up maleware. Yeah, the user has to execute it, but people are dumb, lazy, and/or tired and there is a *better* form of distribution that just doesn't leave this script-kiddy style attack around. Like for fuck's sake, people at intelligence agencies plug in USBs they find on the ground...

I've nothing to do with the leak itself, so can't help you there. But did check - both archives are identical, and contain a Node project that seems to match what is claimed. (Run it at your own risk.)

  $ md5sum lam.zip
  3a78b14e1379ac5c059dbbe5660fca8a lam.zip

Thanks! I don't actually assume that the person is being nefarious, but I think it is also important to make sure that they understand these things. Especially if we're talking about scams.

Scams take advantage of what is normalized, it is how they fly under the radar and bypass people's bullshit detectors. It's why a safety vest, hardhat, and a clipboard is the most covert disguise around. So one of the best ways to prevent scams is to normalize behavior that is harder to take advantage of! (same reason people fall for fake voice scams, because we're so used to distortion in calls anyways. A glitch poor voice can be difficult to distinguish from poor cell reception)

As for the filesizes, I assume it is just the websites reporting incorrectly. Pixeldrain reports 188 MB compressed and 510 MB uncompressed. Mega reports 179.r MB. Pixeldrain at least shows all the files, which look to not have been cleaned up since they have things like .DS_Store. But at least the files are individually downloadable.

179 MB if a megabyte is 1024^2 bytes, 188MB if it's 1000^2.

Zip files aren't evil, just unzip them and look inside.

I think you're missing the point of my comment.

The point of the comment and request is about not requiring technical knowledge and minimizing amount of necessary thinking. The point is about helping stop scammers in the first place!

> 179 MB if a megabyte is 1024^2 bytes, 188MB if it's 1000^2.

This is not entirely correct though because MB != MiB. Us on HN will probably know this but proper labeling helps prevent mistakes. The improper labeling requires us to think more when considering security, which is bad security (not that you shouldn't think, but I'm saying "don't set off alarms when you don't need to set off alarms")

> This is not entirely correct though because MB != MiB.

The point the parent was making is that the file is 188026773 bytes long. One site represents that as 179 MB (base 1024) and the other one as 188 MB (base 1000). Your complaint is therefore with one of the websites and not with the uploader.

> Your complaint is therefore with one of the websites and not with the uploader.

That particular issue, yes. But that wasn't the main issue. I guess you're right, I could have clarified that I'm aware that the uploader is not in charge of the label and it was naive of me to presume that this was obvious. I should have explicitly stated such rather than let it be implicitly said.

At the very least, here's a scan from Jotti.

https://virusscan.jotti.org/en-US/filescanjob/svl9focwgt

a zip archive is not executable unless something has gone very wrong.

You're missing the point. As I've been explaining in other comments which have expressed the same thing as you have (please read to reduce noise and repetition), the point is about not normalizing environments which scammers can easily take advantage of. And clearly, the request has higher utility, so in either way, it is an advantage.

uncompressed and compressed have nothing to do with what you said. you can choose to run the code or not, but it doesn't have to do with the uncompressed thing.

You're missing the point. The point is to make it harder for scammers. Yes, I can safely extract files but on many systems if you double click a zip instead then there you go. Either way, it is always best to not download when you don't have to.

The question here is "is there a reasonable alternative that doesn't require the user to download." The answer is unambiguously "yes" and unambiguously has higher utility.

Bro, it's a zip file. It won't set your computer on fire.

Bro, no one claimed this.

Reply on news.ycombinator.com