Darknet Diaries

Dear HN, please stop using imgur to share images in the posts and comments.

-----

Why?

I'll admit that first and foremost I have selfish reasons for this. I often read HN on mobile. I also use Firefox on desktop and mobile, as should you[1]. When I tap on a seemingly direct i.imgur.com/yaddayadda.jpg link, I get the imgur UI loading animation, and it never loads. I have not found a way around this, other than using a Chrome based browser.

But my personal reasons aside, I want you to realize that imgur has become the exact kind of service its creator hated[2], and you probably hate too. One where you can't directly link to the image file, and the polar opposite of "no nonsense" image hosting.

Although the downhill started way before, I'll also note that imgur was bought by MediaLab in 2021[3]. If that doesn't ring any bells, have a listen to the episode 93 of Darknet Diaries[4]. If you don't have time for that, let me quote a comment[5] from the acquisition thread: "the general idea seems to buy declining brands for cheap and extract as much value as possible".

I wish I could give you an alternative as good as the original imgur, but as you probably know, it is very difficult to host a no nonsense image hosting service. For context see the imgur IAmA thread[6].

So instead I have some options that may fit at least the HN use case of occasionally sharing a screenshot or a photo.

[1] https://blog.mozilla.org/en/mozilla/goodbye-edge/

[2] https://old.reddit.com/r/reddit.com/comments/7zlyd/i/c07u7kr/

[3] https://news.ycombinator.com/item?id=28674883

[4] https://darknetdiaries.com/episode/93/

[5] https://news.ycombinator.com/item?id=28677432

[6] https://old.reddit.com/r/IAmA/comments/y81ju/i/

-----

What to use instead?

Option 1:

Abuse a popular unrelated service that you already have an account for.

For example Discord, Reddit, Twitter and GitHub all let you upload an image and link directly to it.

In Discord start a personal "Notebook" group and upload your images there.

In Reddit post images to "Your profile".

In Twitter just tweet it, or reply tweet it to yourself if you want it more hidden.

In GitHub drop images in a comment of your own gist for example.

This may not be your favorite option, but it is my favorite option as a reader of your comment or post, because the probability of the link just working and directly opening the image in the future is higher than most other services.

If you feel bad about abusing the service, you could throw some money at them. Discord has Nitro, Reddit has Gold, Twitter has Blue, GitHub has Team.

Option 2:

Take a look at actual imgur alternatives. I looked some up for you, but I can't personally vouch for any of them.

put.re - I was going to recommend put.re, but apparently they're showing exactly why we can't have nice things https://gitlab.com/putre/frontend/-/issues/16 You can request access, but I haven't tried.

upload.vaa.red - Can't tell what the retention time is, otherwise looks good.

imgbb.com - Says direct linking is a paid feature, but seems to work either way, for now.

cubeupload.com - They've had to remove anonymous uploads. See a pattern yet? Otherwise direct links seem to work, sometimes.

You can also take a look at ShareX image uploaders https://github.com/ShareX/ShareX/tree/develop/ShareX.UploadersLib/ImageUploaders or custom uploaders https://github.com/ShareX/CustomUploaders

Option 3:

Host your own.

I am not an expert on this, or any of the previous things for that matter, but one combination I saw recommended was Backblaze + Cloudflare.

There are many many options here, and putting something like Cloudflare or any of its CDN competitors in front of whatever you feel like setting up will work fine and be cheap or even free.

Maybe comment your favorite set up.

-----

If you have better alternatives, or really any alternatives that work in 2022, please share.

Full Transcript @ https://darknetdiaries.com/transcript/68/

A mysterious mechanical failure one fateful night in a Saudi Arabian chemical plant leads a cast of operational technology researchers down a strange path towards an uncommon, but grave, threat. In this episode, we hear how these researchers discovered this threat and tried to identify who was responsible for the malware behind it. We also consider how this kind of attack may pose a threat to human life wherever there are manufacturing or public infrastructure facilities around the world.

A big thanks to Julian Gutmanis, Naser Aldossary, Marina Krotofil, and Robert M. Lee for sharing their stories with us.

Sponsors This episode was sponsored by IT Pro TV. Get 65 hours of free training by visiting ITPro.tv/darknet. And use promo code DARKNET25.

This episode was sponsored by Linode. Linode supplies you with virtual servers. Visit linode.com/darknet and when signing up with a new account use code darknet2020 to get a $20 credit on your next project.

Sources https://www.fireeye.com/blog/threat-research/2019/04/triton-... https://www.fireeye.com/blog/threat-research/2017/12/attacke... https://www.fireeye.com/blog/threat-research/2018/10/triton-... https://dragos.com/wp-content/uploads/TRISIS-01.pdf Video S4 TRITON - Schneider Electric Analysis and Disclosure Video S4 TRITON - Mandiant Analysis at S4x18 Video S4 TRITON - Reverse Engineering the Tricon Controller by Dragos Video S4 TRITON - A Report From The Trenches Video - Safety Orientation video for the Chemical Plant Attribution Darknet Diaries is created by Jack Rhysider.

Episode artwork by odibagas.

Theme music created by Breakmaster Cylinder. Theme song available for listen and download at bandcamp. Or listen to it on Spotify.

We ran into the same thing with our new recruiting tool, discovered hundreds of fake applicants for the first remote engineering job we posted. We initially noticed that a large number of job applicants were using ChatGPT responses with our virtual recruiter, and showing drastically different scoring from non-fake candidates.

We started scheduling video chats with the candidates clearly using ChatGPT with our virtual recruiter, and they all got on the call and began reading scripts, and could not answer more unique phone screen questions like: What engineering principle is important to you?

It’s the most frustrating thing, taking up so much of our time and taking time away from strong engineers who deserve our time.

I heard a good podcast about this, https://darknetdiaries.com/episode/133/

We’re testing a solution for this to keep our own product operating fast and delivering amazing candidates.

We’re also keeping a list of red flags:

- LinkedIn profile was created in the last year

- GitHub link has a generic identity, 0-2 followers, very little activity

- Candidate will say yes to a phone screen immediately, literally right now

- Or candidate will ask if the meeting is a technical screen

- Candidate will go quiet if you ask them if they are available to fly to HQ to meet the team for their final interview

- Job history includes large, non-tech enterprises where employment would be hard to confirm; think CVS, The Home Depot, Best Buy, etc

- LinkedIn About Statement is written in the third person

- LinkedIn profile uses generic language like “cutting edge technologies”

- Profile photos may be avatars, or look like stock photos

None of these things individually can indicate a fake applicant, but taken all together with language used with our virtual recruiter we’ve gotten good at identifying the fakes. We’re still doing a lot of tests to prevent discrimination on our part.

If anyone wants to chat, my CoFounder and I have become obsessed with solving this.

> This is both fascinating and a scary reminder of what the future has in store for us in a deepfake world.

Social engineering has always been a thing, check out this Darknet Diary podcast about the Lazeraus hacking collective group (suspected to be N. Korean digital Army) and how they have try/tried to infiltrate their way into crytocurrency based exchanges--and have succeeded in the past--using all kinds of methods including hijacking CVs from Linkedin.

The truth is that while the advent of deepfakes and even text to image AI/ML based tech has muddled the waters even more, it's always been a challenge to not encounter some level of difficulty when dealing with verification. Fraud is and will always remain a component in daily operations of any organization.

We have a saying in the Bitcoin space that i think applies here: Do not trust, verify.

And this is why I think people need to understand that the usecases for an immutable ledger can and will go beyond just a digital token (it's only the backbone), and these usecases (the limbs and appendages to continue with the body metaphor) will become more imperative in the 21st Century: you can manipulate all you want via social media and many have, but if verified sources with proper validation is stored on an immutable ledger with a cryptographic proof of work blockchain that is impossible to alter then you can essentially have the closest thing to verifiable truth Online.

Jacob Applbaum said it best when he said that to maintain security online you'll likely have to adopt 2 or more identities separate from each other to continue to have some level of assurance that your personas are not traceable to your real ID in a World where Doxxing became 'a thing' Online. I wonder hat he has to say about the OPSEC/INFOSEC space now that we have the ability to mimic people Online so closely with very little resources.

0: https://darknetdiaries.com/episode/119/

Are there any podcasts out there either with the hosts or guests telling stories like the stories in the books The Cuckoo's Egg by Clifford Stoll, Revolution in the Valley by Andy Hertzfeld, and Hackers by Steven Levy?

I've read these books, and many others like them, but I thought it would be awesome to listen to a podcast where the characters from the stories are guests invited in to retell the stories, however I haven't had much luck finding such a podcast. There once was the Debug[1] podcast with Guy English and Rene Ritchie, and they had an awesome, and very long, "episode series" where they had Apple folks in to retell everything from how Safari to the iPhone was made, if I recall correctly. However the podcast has not been active since 2016. Once upon a blue moon I find a podcast that has a single episode of this kind, but without it being the focus of the podcast.

There are some podcasts like this in the hacking/dark web/cybersecurity genre of computing history - Darknet Dairies[2] and Malicious Life[3] come to mind - but I'm talking a bit broader in scope. I'd like to hear about how the first version of Unix was made, or Plan9, or Vim, or Emacs, or how this weird bug was discovered and fixed, and so on. Interesting stories told by interesting people from the history of computers.

Does anybody know of any podcasts like this?

[1]: https://www.imore.com/debug

[2]: https://darknetdiaries.com/

[3]: https://malicious.life/

If those users are legit, sure. But lets be honest...writing bots in Reddit is stupid easy. I have done it myself. Most things that appear on the front page are most likely not legit. Darknet Diaries, a podcast on hacking, had an episode proving how Apple Podcast top 10s are rigged through bots. Episode 27, specifically. And the thing is...if we can easily do it by pushing mediocre podcasts to the top of a list, why can't we do so with Reddit posts? The API even has calls to upvote/downvote posts and leave comments. This is a thing that Reddit as a company actively supports.

I highly recommend watching two videos..."The Dead Internet Theory", by All Time, and "Reddit is Being Manipulated by Professional Shills Every Day" by Point. They go into how Reddit works algorithmically, and how there is a strong incentive for corporations, governments, and political movements to write bots to manipulate karma. If hackernews lets me, I will link both of them and the darknet diaries episode. Im new here, so Im not sure how links work on ycombinator.

Darknet diaries 27: https://darknetdiaries.com/episode/27/

Dead Internet Theory: https://youtu.be/DEn758DVF9I

Reddit is run by shills: https://youtu.be/4uIrnEIuL8o