DOGE worker’s code supports NLRB whistleblower

You can download it as a Git repository from https://archive.softwareheritage.org/api/1/vault/git-bare/sw...

Look at the critique [0] and then look at the code [1].

[0] https://web.archive.org/web/20250423135719/https://github.co...

[1] https://github.com/ricci/async-ip-rotator/blob/master/src/as...

Certainly Elon made him print it out on paper to personally code review.

It's possible, but very unlikely, the copyright license wasn't actually violated because, for example, the fork could have arranged a separate license.

The best example of this is the Qt Project's code: https://www.qt.io/qt-licensing

You can get it under a GPL license for free. You can pay them money to get it under a Commercial license that would let you modify the code without releasing changes.

So, while I doubt it happened, the person who forked it here could have contacted the original author, the copyright holder, and asked for an exemption from the GPL terms.

Then you keep the license eh? Distributing without an intent to distribute is distributing.

Git is free and open source. If you want version control and collaboration and NO unintended distribution completely for free you can just use Git. It even has a built in server to share with your work buddies.

Copy pasting from stack overflow without attribution is wrong but it's also harder to claim "ownership" over single lines or small snippets. It depends how "obvious" they are. You definitely can't copyright trivial functions. There's a lot of gray here but yes attribution is always good.

But things get a lot less murky when we're talking about forking a project. That's usually nontrivial and non obvious. I think what's most important is that removing a license is an active decision. Certainly that would make a critical difference in a court [0]

Then there's further escalation by who is doing the action. The more power and influence you have the greater responsibilities. All men are not created equal. Men with more power can disproportionally do more damage and require higher accountability. So yeah, I care a fuck ton more about a government employee doing something bad especially while performing official duties more than some rando. The ability to do harm is very different.

The reason I dislike your comment is because it's dismissive of the action. "Other people do it!" Is not a defense nor excuse. It is even worse by ignoring multiple points of context.

[0] though protecting open source has been traditionally hard for many reasons. Specifically it's hard for small developers to take legal action, especially against larger bodies. But isn't this something we should want to be fixed? Credit for our own contributions?!

What group does the person who makes the comment associate with?

irony

Excerpt: "How much more proof do we need that this administration is completely compromised? There is zero reason for the US to relax any offensive digital actions against Russia. If anything, we should be applying more."

They were accessing Github over the internet from superuser accounts they were presumably also using as their user account. Given the code quality, I doubt their opsec is put together, either.

The objective may not have been to obtain access or any useful data. The objective may have been to get the scary headlines about Russians and use the existing media and political agitprop to further destabilize the government you seek to color revolution away.

If they're trying to exfiltrate data, they might want to rotate through IP addresses in order to obfuscate what's going on or otherwise circumvent restrictions. Using a simple ip rotator like the post talks about would maybe be an approach they'd use. If they're not careful with the IP addresses, once in a while one might get caught due to some restriction like being outside the US. It'd maybe appear as though you're getting these weird requests from Russia, but that's just because you're not logging the requests that are not being flagged from the US.

Maybe I'm reading the post incorrectly though (if so, please correct me!)

Best possible case I see would be that the whistleblower has made some mistake (or is being intentionally dishonest). Seems plausible for instance that "it appeared they had the correct username and password" based on "our no-out-of-country logins policy activating" could just be a misunderstanding of how/when the policy triggers. Not to say it's the most likely explanation, just the least concerning one.

I think less concerning than keyloggers, while still assuming the whistleblower is correct, would be that a DOGE employee was using a VPN/proxy/Tor. Probably not a great idea to have traffic going through a hostile nation state even with encryption, but less bad than keyloggers on their machines stealing and trying credentials within minutes.

Definitely concerning though, to be clear - just steelmanning/answering the question of best possible interpretation.

Though with nation state actors you can't rule out Pegasus like zero-click infiltrations.

This context enables two important things:

- Granular exceptions: If Alice is attending a conference in Toronto, you can say "Allow Alice to log in from Canada next week" without opening Canada-wide logins for everyone. Pre-auth geo-blocking forces you into an all-or-nothing stance.

- Better threat intelligence: A valid login from an unexpected region (e.g. Moscow when Alice is normally in D.C.) is a far stronger signal of compromise than a failed attempt. Capturing "successful login + wrong location" helps you prioritize real threats. If you block pre-auth, you'd never know Alice's account was compromised.

Putting geo-checks after authentication gives you precise control over whom, exactly, is logging in from where, and offers richer data for your security monitoring.

[1] https://learn.microsoft.com/en-us/entra/identity/conditional...

DOGE needs to be shutdown and everyone of them held as a flight risk while the whole thing is investigated.

My company retains all e-mails for at least 5 years, for audit purposes. But if some troublemaker were to e-mail child porn to an employee, we'd need to remove that from the audit records, because the laws against possessing child porn don't have an exception for corporate audit records.

So there's essentially always some account with the power to erase things from the audit records.

From the previous post, they had auditor roles built in that they purposely chose to go around

You always need it to setup the system initially.

It's like root on Linux: it's an implementation detail that it must be possible.

...

While he was at work, and it also contained photographs of him walking his dog taken by a drone.

This is mafia shit.

By definition, a judge decides what's legitimate.

If DOGE expects their access to be blocked by a court judgement, and bum-rushes agencies to exfiltrate data ahead of the judgement, that's also criminal intent.

I am not sure what you are getting at. "Covert" isn't how I'd describe DOGE's actions. "Brazen" maybe?

We can also add to that IRS data. The articles of impeachment against Nixon included the following:

"He has, acting personally and through his subordinates and agents, endeavoured to obtain from the Internal Revenue Service, in violation of the constitutional rights of citizens, confidential information contained in income tax returns for purposes not authorized by law" (emphasis mine).

There actually are laws regulating the handling of personal data collected by the government and it generally doesn't have a "the president wants to see it" exception.

Personally? For starters, he can't access anything the Legislature's laws say he can't.

The Executive is there to implement the law, and that includes obeying them him/her-self.

A President telling other people to break the law on his behalf by threatening to fire them is also a crime of extortion.

He's good at having and raising money which was what SpaceX needed, I think he was probably the same then as he is now. Reading about his early days at Tesla and the PayPal stuff, I don't really buy the idea he was ever different and took a dark turn. He's the type of person that will never self-regulate and somehow has never faced any negative consequences for lying and self-aggrandizing so has kept pushing it further

(Btw, awesome username!)

If you could prove that billions were saved in pure waste, then I’d imagine any sane citizen would agree with you, setting aside matters of decorum and human decency (e.g. RIFs that may ultimately be necessary but conducted in an inhumane way)

I’d like my tax money used efficiently, but this group does not merit the trust to carry out those changes, even on a technical level

That is what the GAO is for https://www.gao.gov/ , and these people are much better than script kiddies.

> I would really like my tax money used more efficiently

Me too! You are on hacker news so I assume you are firm believer in https://en.wikipedia.org/wiki/Amdahl%27s_law ! If you would like your tax money used efficiently, are you willing to discuss cuts to social security, medicare, medicaid, veteran benefits, and whatever else is at the top of the budget? https://www.cbo.gov/publication/61181? What would you cut?

Personally, I would increase taxes on anyone making over $500K/year and stop nickle and diming our federal government so the US can actually become a first world country for everyone that isn't a software engineer.

Then a lot of those had to be reinstated because you simply can't operate a hospital without sanitation.

Just like they had to scramble to hire back the folks at the National Nuclear Safety Association.

Yeah, efficiency is great. But this is like ordering tacos and getting... a used tire and some dirty diapers...?

This is like the derelict father with partial custody who parachutes in one weekend a month to buy his son ice cream and a new video game to leave two days later the conquering hero. Meanwhile mom works two jobs, has to set all the expectations and responsibilities for the child, and the father is late on child support payments.

DOGE blitzkrieged government IT. It'll be years before we understand the scope of what they've done and given available evidence: these are script kiddies who worship Musk, I don't think there is ANY reason for optimism or charitable consideration.

Except by most accounts so far it was being used efficiently by the federal workforce. This whole debacle will end up costing the US tax payer more money. See cutting the IRS or USAID which will probably lead the US to bailing out farmers. And if they privatize, then it'll be even more expensive.

This is immature thinking, because, who wouldn't?

The contention comes from differing opinions on what is waste.

I agree, but for a different point.

Generalising, but under the age of 25, most people don't have enough experience (business/government) to understand things such as business ethics, the consequences, auditing practises, privacy concerns, etc.

With professional experience, you develop a better understanding and build up that depth of knowledge of how things impact the wider "world" rather than the immediate task at hand. Meaning, you gain a better understanding of the ethical implications of what you're doing.

As an example - in law, it'd be easier to manipulate a law graduate than a lawyer with 20+ years experience, who would think outside the direct question or task that was asked.

One could be a 60 year old skid.

Is the federal government a business or startup? Does chainsawing it have a tight-enough feedback cycle to get good results? I'm going to say No to both, but I don't have the time or expertise to try to prove it. It can be true, both that young people are great at startups and bad at the federal govt.

This is supporting evidence that they were picked for ideological reasons - namely, being young white supremacists who wouldn't ask any questions. That's why Marko Elez was rehired. Musk, Trump, and Vance all share his views, he was just dumb enough to express them in public.

Young people get convinced to do stupid things that their older selves would regret.

I must be missing something here; surely the level of elite technical skill implicit in his résumé would preclude this kind of thing

I would say that Elmo picked a bunch of junior devs because they don't have enough maturity to talk back and will do anything they're asked but I think that's too charitable. I think he actually went this route because Elmo is a sad man in his 50s who is desperately trying to pretend that he is, and has not matured beyond, his 20s.

The public repos for this person that I could find that weren't forks with no activity to upstream consisted of a dice-rolling guessing game, rock-paper-scissors, and some kind of framework for downloading and transcribing audio files that does not yet download or transcribe, but implements a whole bunch of boilerplate. I find it rather difficult to believe this person engaged in a good-faith review of the async-ip-rotator code base.

Just as its only worth complaining about geriatric geezers in office until the cheeto man brings in young hackers, then the problem is that "the old impaired people were good, actually".

Don't observe. Don't think. Merely repeat the approved message.

> The Party told you to ignore the evidence of your eyes and ears. It was their final, most essential command.

We live in a nation of laws, whether or not conspiracy-minded individuals prefer to follow them.

If this is all true, this is basically hacking sensitive data in the open. We already know the current administration has worked to hobble unions. So putting these things together, this act is not only wrong in and of itself, but the data is likely going to be used to harm americans' interests. So, deserving of punishment.

And then the means to do so have involved ignoring the courts and bypassing constitutional checks and balances? Please tell me how this isn’t criminal if not treasonous?

After all, why do they need unfettered access? Why do they need your bank statements? Why do they need to hide what they're doing with the unfettered access?

That's what's happening here. There is no good explanation other than bad actors

If you don't feel that way then you deserve the world you are creating.

Is this some reminder to people that bad things occur that aren't found out.

Considering how everyone is aware of this is your comment some sort of clusterbomb whataboutism?

> Furthermore, on Monday, April 7, 2025, while my client and my team were preparing this disclosure, someone physically taped a threatening note to Mr. Berulis’ home door with photographs – taken via a drone – of him walking in his neighborhood. The threatening note made clear reference to this very disclosure he was preparing for you

All of the public complaining is by staff that don’t understand their new position in the pecking order.

There is a King in charge and he cares not for the wailing of the petty nobles.

Also, in some cloud systems full read access can give you direct or indirect access to service keys / API keys which then are write equivalent permissions anyway.

They downloaded "IP rotation" python libraries to circumvent rate limits.

The evidence supporting his claim is a screenshot of an Excel spreadsheet with several columns excluded. It appears to have been exported from the DeviceProcessEvents table within the advanced threat hunting schema. However, he failed to provide the threat hunting dashboard view, which would include critical context such as the process tree, MD5 hash, account SID, account domain, and process creation time. Given that he clearly has access to Microsoft Defender XDR or Defender for Endpoint, he has the capability to conduct a thorough investigation. Yet, he did not do so, nor did he include that information in his legal submission. As a result, I find his claims unconvincing.

As for the forked repo deletion - I have no clue. It seems like the repo was already well known. I'm not a dev so I'd defer to a dev's opinion here. The system owner could be function testing, fuzzing, performance testing, ect. Why didn’t he show the process tree, the system name, and netflow to prove that system running code was interacting with prod? – He clearly has access to Azure tools that would allow him to do that.