Why in the world would that specific 3x3 matrix be a trigger for an attack? Are they trying to find someone doing some particular kind of numerical analysis?
Presumably it's so it can be used as a subdependency for setting up an attack in a popular, legitimate package, e.g. via a pull request. The code in the legitimate package would not arouse suspicion at all.
Now I'm curious what the target was. Are there any notable classes of programs/problems where you'd do an LU decomposition of this specific matrix?
>Are there any notable classes of programs/problems where you'd do an LU decomposition of this specific matrix?
It doesn't have to be this specific matrix. If it's some service exposed to the internet, it can be user supplied, in which case it turns into a backdoor.
I would assume it’s actually so they can allow it to spread before it gets activated. Then do something that affects the entire chain of package dependencies
Tamping down on verbosity, removing em-dashes and adding misspellings are the obvious fixes to apply when your first attempts at spamming get flagged for being too on-the-nose: <a href="https://news.ycombinator.com/threads?id=coder-pm&next=48716765">https://news.ycombinator.com/threads?id=coder-pm&next=487167...
There are "humanizer" scripts that these people like to use. This one is not the typical style I see in my online moderator adventures, which is usually "lowercase everything and remove all punctuation except periods", as if we are repelled by em-dash use and not the tortured prose.
I like the removal of a random definite article, to simulate an ESL writer and garner sympathy for using LLMs as a "tool to clean up posts". Heavens, they would never even think of using their Claude subscription to be a slop factory, that would cross a line.
Being new here doesn't mean I'm a bot. I'm not native and maybe my style looks for you like a bot, I won't try to argue with you. Just wanted to contribute
Perhaps they just need a way to sneakily activate it? Or perhaps they have a target application which they know uses that. This method suggests a supply chain attack where a valid contributor to a library 'accidentally' includes this package and the hack carries out before anyone notices.
My guess is that it's crypto related but of course it could be anything.
A status code for (industrial/the-man) equipment? You could target specific environments by activating on obscure error codes that can be remotely triggered.
Aka If someone from the outside can make your equipment emit X internally, they can target X in some way.
j2kun · · focus · HN ↗
zarzavat · · focus · HN ↗
krackers · · focus · HN ↗
gruez · · focus · HN ↗
It doesn't have to be this specific matrix. If it's some service exposed to the internet, it can be user supplied, in which case it turns into a backdoor.
tranceylc · · focus · HN ↗
coder-pm · · focus · HN ↗
[dead]
stymaar · · focus · HN ↗
Bad bot.
(I still wonder what these not operators have to gain in that process, but they sure want HN karma).
smokel · · focus · HN ↗
yorwba · · focus · HN ↗
tadfisher · · focus · HN ↗
I like the removal of a random definite article, to simulate an ESL writer and garner sympathy for using LLMs as a "tool to clean up posts". Heavens, they would never even think of using their Claude subscription to be a slop factory, that would cross a line.
ajkjk · · focus · HN ↗
coder-pm · · focus · HN ↗
ajkjk · · focus · HN ↗
My guess is that it's crypto related but of course it could be anything.
TimedToasts · · focus · HN ↗
Aka If someone from the outside can make your equipment emit X internally, they can target X in some way.