6 ms·

Re the falsifying working hours, wouldn’t these boffins be able to automate Git commits at certain times or even pass instructions to another team who is workin

Re the falsifying working hours, wouldn’t these boffins be able to automate Git commits at certain times or even pass instructions to another team who is working the late night shift to post these changes etc. I went to MacDonald’s last night, it is open 24/7, these spy agencies surely aren’t more lazy than minimum wage MacD employees - I am sure they work around the clock. Plus, you have night hawks like me who get more stuck in to a project at 4am and sleep through the day. Israeli intelligence, ah probably. Wouldn’t be surprised. I imagine if it was GCHQ, it wouldn’t have been so noisy and got uncovered like this.

kuschku 2y ago
> Re the falsifying working hours, wouldn’t these boffins be able to automate Git commits at certain times or even pass instructions to another team who is working the late night shift to post these changes etc. Is it possible? Definitely. But that's extremely rare, especially if you want to keep a relatively natural pattern for the commits and replies. You'd basically have to have a team of devs working at really odd times and a queuing system that automatically queues all emails, github interactions, commits, etc to dispatch them at correctly distributed timestamps. And you'd need a source pattern to base your distribution on, which is hard to correctly model as well. e.g., if someone slept badly one night, the next morning their interactions shift slightly back and are more sparse in the morning. Their lunch break will also shift due to that. Such changes usually are most prominent in the days surrounding DST changes.
- sophacles 2y ago
  > Is it possible? Definitely. But that's extremely rare, especially if you want to keep a relatively natural pattern for the commits and replies. What sort of nonsense is this? Have you ever actually known any software developers? A huge number of them keep odd hours, moreso in the infosec sphere. They wouldn't need to automate anything, just start working hours that match the timezone that they're faking... If it really is a state actor, I imagine they'd be able to find someone willing to keep those hours.
  - kuschku 2y ago
    I've spent a lot of time analysing activity patterns, it's not as simple as you think, especially once you combine IRC, GitHub interactions and commits themselves. These are my own hours for example (from a few years ago): https://i.k8r.eu/lgN3ug.png https://i.k8r.eu/lgN3ug.png
  - MichaelZuo 2y ago
    I would have to agree with kushku, it’s a very very high bar to fake thousand of timestamps over several years in a consistent way that doesn’t attract suspicion under forensic scrutiny. Of course this is post facto so not that helpful until after something serious happens. If there was some sort of reputation system that could do this analysis automatically then that would be very useful.
  - yogorenapan 2y ago
    I agree. I don’t follow the time zone of the country I live in as I work remote. Haven’t seen the sun in a while. Probably not healthy.
FearNotDaniel 2y ago
You don't need to automate git commits to fake the timestamps; just change system clock to the desired time, make the commit and then reset the clock to local time when you're done. It all happens on the local machine so the timestamps of commits should be considered completely untrusted information.
- kuschku 2y ago
  That's exactly what Jia Tan did, but this failed a few times during rebases as well as with commits done from the web UI. Additionally timestamps from comments on GitHub itself are trusted information and match the UTC+2/UTC+3 data well.

kuschku 2y ago

> Re the falsifying working hours, wouldn’t these boffins be able to automate Git commits at certain times or even pass instructions to another team who is working the late night shift to post these changes etc. Is it possible? Definitely. But that's extremely rare, especially if you want to keep a relatively natural pattern for the commits and replies. You'd basically have to have a team of devs working at really odd times and a queuing system that automatically queues all emails, github interactions, commits, etc to dispatch them at correctly distributed timestamps. And you'd need a source pattern to base your distribution on, which is hard to correctly model as well. e.g., if someone slept badly one night, the next morning their interactions shift slightly back and are more sparse in the morning. Their lunch break will also shift due to that. Such changes usually are most prominent in the days surrounding DST changes.

sophacles 2y ago
> Is it possible? Definitely. But that's extremely rare, especially if you want to keep a relatively natural pattern for the commits and replies. What sort of nonsense is this? Have you ever actually known any software developers? A huge number of them keep odd hours, moreso in the infosec sphere. They wouldn't need to automate anything, just start working hours that match the timezone that they're faking... If it really is a state actor, I imagine they'd be able to find someone willing to keep those hours.
- kuschku 2y ago
  I've spent a lot of time analysing activity patterns, it's not as simple as you think, especially once you combine IRC, GitHub interactions and commits themselves. These are my own hours for example (from a few years ago): https://i.k8r.eu/lgN3ug.png https://i.k8r.eu/lgN3ug.png
- MichaelZuo 2y ago
  I would have to agree with kushku, it’s a very very high bar to fake thousand of timestamps over several years in a consistent way that doesn’t attract suspicion under forensic scrutiny. Of course this is post facto so not that helpful until after something serious happens. If there was some sort of reputation system that could do this analysis automatically then that would be very useful.
- yogorenapan 2y ago
  I agree. I don’t follow the time zone of the country I live in as I work remote. Haven’t seen the sun in a while. Probably not healthy.

FearNotDaniel 2y ago

You don't need to automate git commits to fake the timestamps; just change system clock to the desired time, make the commit and then reset the clock to local time when you're done. It all happens on the local machine so the timestamps of commits should be considered completely untrusted information.

kuschku 2y ago
That's exactly what Jia Tan did, but this failed a few times during rebases as well as with commits done from the web UI. Additionally timestamps from comments on GitHub itself are trusted information and match the UTC+2/UTC+3 data well.