Connor Tumbleson

I write weekly on https://connortumbleson.com using Ghost. Started as a new years resolution I've kept just discussing what crosses my life or mind. My favorite posts: * https://connortumbleson.com/2017/05/01/the-human-behind-the-keyboard/ - being an open source maintainer * https://connortumbleson.com/2018/02/11/stumbling-into-a-mlm-on-acciden… - wandering into an MLM and researching it * https://connortumbleson.com/2019/06/02/apktool-in-the-wild/ - finding apktool unintentional markings in a released application

It's likely that there is a whole team behind this operation, and part of that team might include tasks such as "socially engineer XZ project to accept a maintainer of our choice." This was suggested in a different post[1], where there seem to be newly created accounts that came out of nowhere to create a sense of urgency, which might have accelerated the maintainer role transition. [1] https://connortumbleson.com/2024/03/31/watching-xz-unfold-from-afar/ via: https://news.ycombinator.com/item?id=39888854 Search for "Progress will not happen until there is new maintainer" for the relevant text.

Some related posts: "Open Source & Saying "No"": https://connortumbleson.com/2022/11/28/open-source-saying-no/ , https://news.ycombinator.com/item?id=33771881 "Open Source Is Free As in Baby": https://danielcompton.net/dependencies

This immediately came to mind https://connortumbleson.com/2022/09/19/someone-is-pretending-to-be-me/

Just vaguely related, but it seems that various forms of hiring fraud are now appearing, i.e. https://connortumbleson.com/2022/09/19/someone-is-pretending-to-be-me/ In the remote world, it's going to be difficult to address, but it's happened also in the old physical world — albeit less frequently.

They built their phishing emails using data scraped from public profiles. Fascinating. I have to wonder if, in the near future, we're going to have a much higher perceived cost for online social media usage. Problems we're already seeing: - AI turning clothed photos into the opposite [0] - AI mimicking a person's voice, given enough reference material [1] - Scammers impersonating software engineers in job interviews, after viewing their LinkedIn or GitHub profiles [2] - Fraudsters using hacked GitHub accounts to trick other developers into downloading/cloning malicious arbitrary code [3] - AI training on publicly-available text, photo, and video, to the surprise of content creators (but arguably fair use) [4] - AI spamming github issues to try to claim bug bounties [5] All of this probably sounds like a "well, duh" to some of the more privacy and security savvy here, but I still think it has created a notable shift from the tech-optimism that ran from 2012-2018 or so. These problems all existed then, too, but with less frequency. Now, it's a full-pressure firehose. [0]: https://www.wsj.com/politics/policy/teen-deepfake-ai-nudes-bill-ted-cr… [1]: https://www.fcc.gov/consumers/guides/deep-fake-audio-and-video-links-m… [2]: https://connortumbleson.com/2022/09/19/someone-is-pretending-to-be-me/ [3]: https://it.ucsf.edu/aug-2023-impersonation-attacks-target-github-devel… [4]:…