(03-28-2022, 03:13 AM)Dismas Wrote:

(03-28-2022, 01:09 AM)vittring Wrote:

(03-28-2022, 12:48 AM)imgr8ness Wrote: Yes of course. I'm not sure how your comment relates to mine.

The Russo-Ukrainian War has been going on for about 8 years now. Russia only launched its invasion of Ukraine in February. It started before that in the cyber realm. Espionage has been the MO for Russia for at least a decade and Ukraine's leaders aren't saints either. Both have committed war crimes that have yet to be seen, and Russia knows it is at fault and they have done a good job at hiding their crimes. The FSB has been great at hiding their past.

I don't know if it's related but node-ipc, a Node JS module, was altered by the maintainer to have malicious intent.

On March 7, a version 10.1.1 of a certain module was published with clear code updates that raised concerns for suspicious activity and potential abuse of the source code, which would later cause a supply chain issue. The module was used by many, including @vue/cli users. According to one organization, it ended up deleting TiB of data related to atrocities being committed inside Ukraine, just because the company was using that version of the module.

https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

The node-ipc edit wasn't from a state-sponsored actor, but an activist. While I'm in favor of Ukraine's independence, this sort of thing undermines the credibility of everyone associated.

(03-28-2022, 03:22 AM)vittring Wrote:

(03-28-2022, 03:13 AM)Dismas Wrote:

(03-28-2022, 01:09 AM)vittring Wrote: The Russo-Ukrainian War has been going on for about 8 years now. Russia only launched its invasion of Ukraine in February. It started before that in the cyber realm. Espionage has been the MO for Russia for at least a decade and Ukraine's leaders aren't saints either. Both have committed war crimes that have yet to be seen, and Russia knows it is at fault and they have done a good job at hiding their crimes. The FSB has been great at hiding their past.

I don't know if it's related but node-ipc, a Node JS module, was altered by the maintainer to have malicious intent.

On March 7, a version 10.1.1 of a certain module was published with clear code updates that raised concerns for suspicious activity and potential abuse of the source code, which would later cause a supply chain issue. The module was used by many, including @vue/cli users. According to one organization, it ended up deleting TiB of data related to atrocities being committed inside Ukraine, just because the company was using that version of the module.

https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

The node-ipc edit wasn't from a state-sponsored actor, but an activist. While I'm in favor of Ukraine's independence, this sort of thing undermines the credibility of everyone associated.

That's why I left in "I don't know it is related or not" because we can't know for sure it wasn't. Just because the news says it doesn't make it true, nor does it make it credible only if a state sponsored actor admits to espionage. Unless you're referring to the admin's motives, which I also can't speak on but I am betting he thought he was doing right. It just wastes time doing things like that. His repo did more harm than good, and if he was really trying to help, there are better ways. You can simply donate to a humanitarian organization and I can name several people that have done so. There's a lot of ex-SOF guys that are organizing events and rallies across a few regions, they talk about it on podcasts and keep information security tight, but it's good that people are doing the right thing without being destructive.

(03-28-2022, 03:27 AM)Dismas Wrote:

(03-28-2022, 03:22 AM)vittring Wrote:

(03-28-2022, 03:13 AM)Dismas Wrote: The node-ipc edit wasn't from a state-sponsored actor, but an activist. While I'm in favor of Ukraine's independence, this sort of thing undermines the credibility of everyone associated.

That's why I left in "I don't know it is related or not" because we can't know for sure it wasn't. Just because the news says it doesn't make it true, nor does it make it credible only if a state sponsored actor admits to espionage. Unless you're referring to the admin's motives, which I also can't speak on but I am betting he thought he was doing right. It just wastes time doing things like that. His repo did more harm than good, and if he was really trying to help, there are better ways. You can simply donate to a humanitarian organization and I can name several people that have done so. There's a lot of ex-SOF guys that are organizing events and rallies across a few regions, they talk about it on podcasts and keep information security tight, but it's good that people are doing the right thing without being destructive.

Given the maintainer had operated in an honest capacity prior, it's hard to imagine he's actually a state actor. Sanctions are fair game, but nobody should have to dance around political ties when using modules. Again, there's been a lot of "just because the news says it, doesn't make it true" rhetoric, so people should at least include an alternate source when making a claim.

(03-28-2022, 01:09 AM)vittring Wrote:

(03-28-2022, 12:48 AM)imgr8ness Wrote: Yes of course. I'm not sure how your comment relates to mine.

The Russo-Ukrainian War has been going on for about 8 years now. Russia only launched its invasion of Ukraine in February. It started before that in the cyber realm. Espionage has been the MO for Russia for at least a decade and Ukraine's leaders aren't saints either. Both have committed war crimes that have yet to be seen, and Russia knows it is at fault and they have done a good job at hiding their crimes. The FSB has been great at hiding their past.

I don't know if it's related but node-ipc, a Node JS module, was altered by the maintainer to have malicious intent.

On March 7, a version 10.1.1 of a certain module was published with clear code updates that raised concerns for suspicious activity and potential abuse of the source code, which would later cause a supply chain issue. The module was used by many, including @vue/cli users. According to one organization, it ended up deleting TiB of data related to atrocities being committed inside Ukraine, just because the company was using that version of the module.

https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

(03-28-2022, 04:39 AM)imgr8ness Wrote:

(03-28-2022, 01:09 AM)vittring Wrote:

(03-28-2022, 12:48 AM)imgr8ness Wrote: Yes of course. I'm not sure how your comment relates to mine.

The Russo-Ukrainian War has been going on for about 8 years now. Russia only launched its invasion of Ukraine in February. It started before that in the cyber realm. Espionage has been the MO for Russia for at least a decade and Ukraine's leaders aren't saints either. Both have committed war crimes that have yet to be seen, and Russia knows it is at fault and they have done a good job at hiding their crimes. The FSB has been great at hiding their past.

I don't know if it's related but node-ipc, a Node JS module, was altered by the maintainer to have malicious intent.

On March 7, a version 10.1.1 of a certain module was published with clear code updates that raised concerns for suspicious activity and potential abuse of the source code, which would later cause a supply chain issue. The module was used by many, including @vue/cli users. According to one organization, it ended up deleting TiB of data related to atrocities being committed inside Ukraine, just because the company was using that version of the module.

https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

'...Russia knows it is at fault...'

I'd like you to clarify what you mean by 'at fault'. For what exactly?

(03-28-2022, 04:39 AM)imgr8ness Wrote:

(03-28-2022, 01:09 AM)vittring Wrote:

(03-28-2022, 12:48 AM)imgr8ness Wrote: Yes of course. I'm not sure how your comment relates to mine.

The Russo-Ukrainian War has been going on for about 8 years now. Russia only launched its invasion of Ukraine in February. It started before that in the cyber realm. Espionage has been the MO for Russia for at least a decade and Ukraine's leaders aren't saints either. Both have committed war crimes that have yet to be seen, and Russia knows it is at fault and they have done a good job at hiding their crimes. The FSB has been great at hiding their past.

I don't know if it's related but node-ipc, a Node JS module, was altered by the maintainer to have malicious intent.

On March 7, a version 10.1.1 of a certain module was published with clear code updates that raised concerns for suspicious activity and potential abuse of the source code, which would later cause a supply chain issue. The module was used by many, including @vue/cli users. According to one organization, it ended up deleting TiB of data related to atrocities being committed inside Ukraine, just because the company was using that version of the module.

https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

'...Russia knows it is at fault...'

I'd like you to clarify what you mean by 'at fault'. For what exactly?

(03-28-2022, 03:36 AM)vittring Wrote:

(03-28-2022, 03:27 AM)Dismas Wrote:

(03-28-2022, 03:22 AM)vittring Wrote: That's why I left in "I don't know it is related or not" because we can't know for sure it wasn't. Just because the news says it doesn't make it true, nor does it make it credible only if a state sponsored actor admits to espionage. Unless you're referring to the admin's motives, which I also can't speak on but I am betting he thought he was doing right. It just wastes time doing things like that. His repo did more harm than good, and if he was really trying to help, there are better ways. You can simply donate to a humanitarian organization and I can name several people that have done so. There's a lot of ex-SOF guys that are organizing events and rallies across a few regions, they talk about it on podcasts and keep information security tight, but it's good that people are doing the right thing without being destructive.

Given the maintainer had operated in an honest capacity prior, it's hard to imagine he's actually a state actor. Sanctions are fair game, but nobody should have to dance around political ties when using modules. Again, there's been a lot of "just because the news says it, doesn't make it true" rhetoric, so people should at least include an alternate source when making a claim.

True, but on the contrary, I guess most people would argue that I shouldn't be pedantic about it; I just believe that the chances of something being false because it's all over the news are likely higher because they are. I stopped watching news in 2020 because I was tired of the same problem arising every time there's a new event in the world that the powers that be can use against citizens to propagandize literally every aspect of our viewing platforms.

(03-28-2022, 04:44 AM)vittring Wrote:

(03-28-2022, 04:39 AM)imgr8ness Wrote:

(03-28-2022, 01:09 AM)vittring Wrote: The Russo-Ukrainian War has been going on for about 8 years now. Russia only launched its invasion of Ukraine in February. It started before that in the cyber realm. Espionage has been the MO for Russia for at least a decade and Ukraine's leaders aren't saints either. Both have committed war crimes that have yet to be seen, and Russia knows it is at fault and they have done a good job at hiding their crimes. The FSB has been great at hiding their past.

I don't know if it's related but node-ipc, a Node JS module, was altered by the maintainer to have malicious intent.

On March 7, a version 10.1.1 of a certain module was published with clear code updates that raised concerns for suspicious activity and potential abuse of the source code, which would later cause a supply chain issue. The module was used by many, including @vue/cli users. According to one organization, it ended up deleting TiB of data related to atrocities being committed inside Ukraine, just because the company was using that version of the module.

https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

'...Russia knows it is at fault...'

I'd like you to clarify what you mean by 'at fault'. For what exactly?

It invaded Ukraine?

(03-28-2022, 04:47 AM)Dismas Wrote:

(03-28-2022, 04:39 AM)imgr8ness Wrote:

(03-28-2022, 01:09 AM)vittring Wrote: The Russo-Ukrainian War has been going on for about 8 years now. Russia only launched its invasion of Ukraine in February. It started before that in the cyber realm. Espionage has been the MO for Russia for at least a decade and Ukraine's leaders aren't saints either. Both have committed war crimes that have yet to be seen, and Russia knows it is at fault and they have done a good job at hiding their crimes. The FSB has been great at hiding their past.

I don't know if it's related but node-ipc, a Node JS module, was altered by the maintainer to have malicious intent.

On March 7, a version 10.1.1 of a certain module was published with clear code updates that raised concerns for suspicious activity and potential abuse of the source code, which would later cause a supply chain issue. The module was used by many, including @vue/cli users. According to one organization, it ended up deleting TiB of data related to atrocities being committed inside Ukraine, just because the company was using that version of the module.

https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

'...Russia knows it is at fault...'

I'd like you to clarify what you mean by 'at fault'. For what exactly?

There was (relative) peace prior to the end of February. Who fired the first shot?

(03-28-2022, 03:36 AM)vittring Wrote:

(03-28-2022, 03:27 AM)Dismas Wrote: Given the maintainer had operated in an honest capacity prior, it's hard to imagine he's actually a state actor. Sanctions are fair game, but nobody should have to dance around political ties when using modules. Again, there's been a lot of "just because the news says it, doesn't make it true" rhetoric, so people should at least include an alternate source when making a claim.

True, but on the contrary, I guess most people would argue that I shouldn't be pedantic about it; I just believe that the chances of something being false because it's all over the news are likely higher because they are. I stopped watching news in 2020 because I was tired of the same problem arising every time there's a new event in the world that the powers that be can use against citizens to propagandize literally every aspect of our viewing platforms.

Without a source, claims are simply speculation. Even if the source is your neighbor, your dog, or your own account - that's better than nothing.

(03-28-2022, 07:05 AM)imgr8ness Wrote:

(03-28-2022, 04:44 AM)vittring Wrote:

(03-28-2022, 04:39 AM)imgr8ness Wrote: '...Russia knows it is at fault...'

I'd like you to clarify what you mean by 'at fault'. For what exactly?

It invaded Ukraine?

Sure, Russia invaded Ukraine. Do you know what led to this? I'm curious if the reasons behind that choice to invade matter to you.

---

(03-28-2022, 04:47 AM)Dismas Wrote:

(03-28-2022, 04:39 AM)imgr8ness Wrote: '...Russia knows it is at fault...'

I'd like you to clarify what you mean by 'at fault'. For what exactly?

There was (relative) peace prior to the end of February. Who fired the first shot?

(03-28-2022, 03:36 AM)vittring Wrote: True, but on the contrary, I guess most people would argue that I shouldn't be pedantic about it; I just believe that the chances of something being false because it's all over the news are likely higher because they are. I stopped watching news in 2020 because I was tired of the same problem arising every time there's a new event in the world that the powers that be can use against citizens to propagandize literally every aspect of our viewing platforms.

Without a source, claims are simply speculation. Even if the source is your neighbor, your dog, or your own account - that's better than nothing.

Relative peace? You must be joking. Do yourself a favor and look up the war in Donbass.

(03-28-2022, 07:18 AM)Boudica Wrote:

(03-28-2022, 07:05 AM)imgr8ness Wrote:

(03-28-2022, 04:44 AM)vittring Wrote: It invaded Ukraine?

Sure, Russia invaded Ukraine. Do you know what led to this? I'm curious if the reasons behind that choice to invade matter to you.

---

(03-28-2022, 04:47 AM)Dismas Wrote: There was (relative) peace prior to the end of February. Who fired the first shot?


Without a source, claims are simply speculation. Even if the source is your neighbor, your dog, or your own account - that's better than nothing.

Relative peace? You must be joking. Do yourself a favor and look up the war in Donbass.

The war in Donbass is a similar situation to now. I believe Dismas was referring to the lack of deaths on this scale. This is far larger than what happened in Donbass.

(03-28-2022, 07:21 AM)imgr8ness Wrote:

(03-28-2022, 07:18 AM)Boudica Wrote:

(03-28-2022, 07:05 AM)imgr8ness Wrote: Sure, Russia invaded Ukraine. Do you know what led to this? I'm curious if the reasons behind that choice to invade matter to you.

---

Relative peace? You must be joking. Do yourself a favor and look up the war in Donbass.

The war in Donbass is a similar situation to now. I believe Oni was referring to the lack of deaths on this scale. This is far larger than what happened in Donbass.

Yes absolutely more deaths, but my view is that is a pointless discussion, ideally there should be no deaths.

The more important discussion is how did we get to this point. Some people seem to think that Putin got up one day and decided to invade Ukraine just because.

In order to make sense of what is happening now, you must look at the history. Russia has been voicing its concern about NATO and US expansion eastward as far back as 2007 and even earlier.

https://www.armscontrol.org/act/2007-03/us-europe-anti-missile-plans-upset-russia
https://www.theguardian.com/world/2007/feb/19/usa.nato

But the US in all of its wisdom decided to ignore Russia's legitimate concerns and press eastwards regardless.

Don't mistake my words to mean I am 'pro' Russia or any other such nonsense. My preference is always for peace, but you cannot antagonize a country, refuse to listen to their concerns and expect no response.

The US is primarily responsible for this and if you look at all of the wars they have been involved in for the last 30 years at least, you will see a pattern.