• 35 Posts
  • 1.3K Comments
Joined 2 years ago
cake
Cake day: March 19th, 2024

help-circle

  • There are bots that openly advertise themselves as such. Less common on Lemmy than Reddit but I’ve seen a few.

    undercover bots pushing agendas

    Do we have any real evidence these exist? I only see very spurious accusations of being a bot directed towards communists and other left-wingers, particularly towards racialised people and colonised people. I’d be both sceptical of their widespread existence and of their efficacy at effecting any kind of political change even if they did exist.





  • It depends. I have worked for nonprofits and know a lot of people who do. Word of mouth/connections with people already working there is a good way to find relatively decent NGO work. You would likely be paid near minimum wage though, it’s true, but a lot of NGOs do have well-meaning people who try to make a difference working at the lower levels; they normally have a bureaucratic layer that sucks but your actual coworkers are normally quite sound if you can find the right job. And some NGOs still do overall decent work even if the leadership sucks; they aren’t revolutionary organisations by any means, but when you’re looking at jobs, you’d be comparing them to some generic corporate job which sucks more.



  • If you can’t feasibly vet the code yourself (I think it is feasible for things like scripts and other small projects) and the star count is low/it’s not already well known and trusted, probably try running in a VM first and look out for signs of it doing things it shouldn’t, e.g. if it’s sending HTTP requests to the internet despite it being a program that should be completely offline. Using things like AppArmor and SELinux to prevent programs from doing things they shouldn’t need to do is also good practice.

    Also, the tool itself may be low star count, but is the developer known at all? Someone with any kind of a reputation wouldn’t risk putting malware on their profile.

    I suppose you could also look at the list of dependencies of the program. Is it using any libraries that don’t make sense? e.g. with the above, is there some kind of HTTP request library being used for a program that shouldn’t need to access the internet at all?

    I think generally the risk is quite low as the author would be hiding their malware in plain sight if the source code is available. They’d have to bet on literally nobody checking. Which is fine for very obscure projects, but if you want your malware to spread, you want a good number of people to use it, at which point someone would presumably look at the code and notice it’s malware.




  • Commands are normally not considered “code” on their own. Someone who just runs commands on their computer to get a few operations done will normally not learn any programming constructs or concepts. If you’re doing shell scripting that usually crosses the line into code as you’d be using if statements, for loops, etc, which you normally don’t use if you’re just moving files around or whatever in the shell.