I Almost Got Hacked by a 'job Interview'

But then again, aren't there obviously scams, and scams that are deemed legal? Like promising a car today that will be updated "next year" to be able to drive itself? Or all the enshittified industry's dark patterns, preying on you to click the wrong button?

I would say they just transition to something else where there is a lower risk with the same reward.

But AI helped. He did not have to read and process the entire source code himself.

In any case, even if your firewall protects you, you'll still have to treat the machine as compromised.

[1]: https://github.com/sandbox-utils/sandbox-venv [2]: https://github.com/sandbox-utils/sandbox-run

Any update I may do to any project dependencies I have on my workstation? Either I bet, pray and hope that there's no malicious code in these.

Either I have an isolated VM for every single separate project.

Either I just unplug the thing, throw it in the bin, and go make something truly lucrative and sustainable in the near future (plumber, electrician, carpenter) that let's me sleep at night.

If each developer can audit some portion of their dep tree and reuse prior cached audits, maybe it’s tractable to actually get “eyeballs” on every bit of code?

Not as good as human audit of course, but could improve the Pareto-frontier for cost/effectiveness (ie make the average web dev no-friction usecase safer).

Risk gets managed, not eliminated. There is no one "correct" approach as risk is a sliding scale that depends on your project's risk appetite.

And I do sandbox everything, but its complicated

Many of these projects are set to compile only on the latest OS' which makes sandboxing even more difficult and impossible on VM, which is actually the red flag

So I sandbox but I don't get to the place of being able to run it

so they can just assume I'm incompetent and I can avoid having my computer and crypto messed up

Supply side attacks are real, and they're here. Attackers attack core developers, then get their code into repositories. As happened this year to the npm package eslint-config-prettier, and last year to the Cyberhaven Chrome extension. Attackers use social engineering to get developers to hand over control of lesser used packages, which they then compromise. As happened in 2021 with the npm package ua-parser-js, and separately with the Chrome extension The Great Suspender. (I'm picking on Chrome because I wanted examples that impact non-developers. I'm only picking on npm because it turned up quickly when I looked for examples.)

The exact social engineering attack described by the OP is also not new. https://www.csoonline.com/article/3479795/north-korean-cyber... was published last year, and describes this being used at scale by North Korea. Remember, even if you don't have direct access to anything important, a sophisticated attacker may still find you useful as part of a spearphishing campaign aimed at someone else. Because a phishing attack that actually comes from a legitimate friend's account may succeed, where a faked message would not. And a company whose LinkedIn shows real developers, is more compelling than one without.

I mean we had Shai-Hulud about a week ago - we don't need AI for this.

https://search.sunbiz.org/Inquiry/CorporationSearch/SearchRe...

~~Scammers probably got access to the guy's account.~~ (how to make strikethrough...)

He changed his LinkedIn to a different company. I guess check verifications when you get messages from "recruiters."

also, got blocked by the 'Chief Blockchain Officer' when I asked for a comment.

A real company wouldn't be scamming candidates.

It could be a real company where someone hijacked an e-mail account to pose as someone from the company, though.

so I am not able to share the full chat because i used Claude with google docs integration. but hears the google doc i started with

https://docs.google.com/document/d/1of_uWXw-CppnFtWoehIrr1ir...

this and the following prompt

``` 'help me turn this into a blog post.

keep things interesting, also make sure you take a look at the images in the google doc' ```

with this system prompt

``` % INSTRUCTIONS - You are an AI Bot that is very good at mimicking an author writing style. - Your goal is to write content with the tone that is described below. - Do not go outside the tone instructions below - Do not use hashtags or emojis

% Description of the authors tone:

1. *Pace*: The examples generally have a brisk pace, quickly moving from one idea to the next without lingering too long on any single point.

2. *Mood*: The mood is often energetic and motivational, with a sense of urgency and excitement.

3. *Tone*: The tone is assertive and confident, often with a hint of humor or sarcasm. There's a strong sense of opinion and authority.

4. *Style*: The style is conversational and informal, using direct language and often incorporating lists or bullet points for emphasis.

5. *Voice*: The voice is distinctive and personal, often reflecting the author's personality and perspective with a touch of wit.

6. *Formality*: The formality is low, with a casual and approachable manner that feels like a conversation with a friend.

7. *Imagery*: Imagery is used sparingly but effectively, often through vivid metaphors or analogies that create strong mental pictures.

8. *Diction*: The diction is straightforward and accessible, with a mix of colloquial expressions and precise language to convey ideas clearly.

9. *Syntax*: The syntax is varied, with a mix of short, punchy sentences and longer, more complex structures to maintain interest and rhythm.

10. *Rhythm*: The rhythm is dynamic, with a lively beat that keeps the reader engaged and propels the narrative forward.

11. *Perspective*: The perspective is often first-person, providing a personal touch and direct connection with the audience.

12. *Tension*: Tension is present in the form of suspense or conflict, often through challenges or obstacles that need to be overcome.

13. *Clarity*: The clarity is high, with ideas presented in a straightforward manner that is easy to understand.

14. *Consistency*: The consistency is strong, maintaining a uniform style and tone throughout each piece.

15. *Emotion*: Emotion is expressed with intensity, often through passionate or enthusiastic language.

16. *Humor*: Humor is present, often through witty remarks or playful language that adds a light-hearted touch.

17. *Irony*: Irony is occasionally used to highlight contradictions or to add a layer of complexity to the narrative.

18. *Symbolism*: Symbolism is used subtly, often through metaphors or analogies that convey deeper meanings.

19. *Complexity*: The complexity is moderate, with ideas presented in a way that is engaging but not overly intricate.

20. *Cohesion*: The cohesion is strong, with different parts of the writing working together harmoniously to support the overall message.```

* You had the headline spot on. Then you explained what you thought might be the reason for it.

* Then you pondered about why the OP might have done it.

* Finally you challenged the op to all but admitting his sins, by asking him to share the incriminating prompt he used.

---

(my garbage wasn't written by AI, but I tried by best to imitate it's obnoxious style).

I've not been using much LLM output recently, and generally I ask it to STFU and just give me what I asked as concisely as possible. Apparently this means I've seriously gotten out of practice on spotting this stuff. This must be what it looks like to a lot of average people ... very scary.

Advice for bloggers:

Write too much, write whatever comes out of your fingers until you ran out of things to write. It shouldn't be too hard to just write whatever comes out, if you save your self-criticism for later.

If you're trying to explain something and you run out of things to write before you manage to succeed at your goal. Do a bit more research. Not being able to write too much about a topic is a good indication that you don't understand it well enough to explain it.

Once you have a mess which somehow gets to the point, cut it way down, think critically about any dead meat. Get rid of anything which isn't actually explaining the topic you want.

Then give it to an LLM, not to re-write, but to provide some editorial suggestions, fix the spelling mistakes, the clunky writing. Be very critical of any major suggestions! Be very critical of anything which no longer feels like it was written by _you_.

At this point, edit it again, scrutinise it. Maybe repeat a subset of the process a couple of times.

This is _enough_ you can post it.

If you want to write a book, get a real editor.

Do not get ChatGPT to write your post.

This "slop" reads perfectly fine to me, and obviously a lot of others, except those who have now been conditioned to watch out for it and react negatively about it.

Think about it, why react negatively? The text reads fine. It is clear, even with my usual lack of attention I found it engaging, and read to the end. In fact, it doesn't engage in the usual hubris style prose that a lot of people think makes them look smarter.

And when I read the Google doc, I understood, that I would have preferred the Google doc as well :-D

What's HN policy on obviously LLM written content -- Is it considered kosher?

> The Bottom Line"

Don't expect LinkedIn to care much about policing messages or paid invitations; and many profiles are fake. At most, you report people and if they LI enough complaints they take the profile down. (Presumably the scammers just create another profile.) I think LI would care much more about being paid with a bad CC.

I suspect LI is doing AI moderation by this point. Maybe we could complain to their customer-service AI about their moderation AI...

You can report abuse and flag it for someone to review, though.