The danger here, of course, is that while these compromised devices are currently being monetized in a relatively benign way (other than bandwidth costs to the user, which to be sure can be nontrivial)… it would be naive to assume that there isn't a Command and Control capability that can assign less benign tasking - or can be compromised to do so.

This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…

▲

mzajc 3 hours ago | parent | next [-]

> benign

On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.

How is DDOSing every site on the web benign?

▲

nucleardog 3 hours ago | parent | next [-]

Relatively benign.

A compromised device inside the White House network could presumably be doing something _much_ worse than participating in a DDOS against random websites.

▲

lakeviewterrace 3 hours ago | parent [-]

Not really. The government employs better network security people than the average HN schizo detective.

If something is on their network, they know about it. They have a bigger budget and more bodies to throw at the problem than you want to believe.

▲

hackernud3s 2 hours ago | parent | next [-]

Apparently they do not though.

▲

Terr_ 2 hours ago | parent [-]

There were experts but the Republican White House fired them:

https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...

Perhaps some of them annoyed the President's illegally-appointed mega-donor, if they spoke out against giving root access to all his unvetted junior flunkies.

▲

FireBeyond 2 hours ago | parent [-]

The same junior flunkies who would do things like go to government agencies, create administrative accounts, which would then, often with minutes, be seen connecting from Russia and Eastern Europe with the correct credentials.

▲

trismus an hour ago | parent [-]

Source?

	▲	adzm an hour ago \| parent \| next [-]
		> Daniel J. Berulis, a cybersecurity architect with the NLRB, filed a whistleblower complaint alleging that within 15 minutes of DOGE team members creating new user credentials and demanding administrative access, multiple login attempts using those exact credentials originated from a Russian IP address https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...
	▲	Terr_ an hour ago \| parent \| prev [-]
		Oh come on, search-engines have gone downhill, but not that far downhill! You already know it involves "DOGE" and "Russia" and "credentials", that ought to be enough: * https://www.reuters.com/technology/cybersecurity/whistleblow... * https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...

▲

manyatoms 2 hours ago | parent | prev | next [-]

I'd be stunned if they're paying anywhere near enough to attract top talent

▲

dhosek an hour ago | parent | next [-]

I applied to USDS in 2023, the process took nearly a year and ended with them just ghosting me after two interview rounds. Pay was capped (by law) below my target salary but at a level that I would accept as it would have been fully remote, but there was also a term limit on the job which meant I would have at most two years in the position.

It’s not just the pay, there’s a lot of structural elements that mean that the potential talent pool is less than desired.

▲

vlan0 2 hours ago | parent | prev | next [-]

Th best folks I know wouldn't touch a government job, no matter the pay.

	▲	fhub an hour ago \| parent [-]
		There was a period of time where it seemed (as an outsider) that they were attracting good talent. This was when Megan Smith was CTO. https://en.wikipedia.org/wiki/Megan_Smith.

▲

alt227 2 hours ago | parent | prev [-]

Dont they usually bargain work against jailtime for domestic cyber criminals?

▲

2III7 2 hours ago | parent | prev | next [-]

Read "This is how they tell me the world ends".

Or let me sum it up for you. The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the government.

▲

altairprime 2 hours ago | parent [-]

Sometimes, top security experts often can’t work for the U.S. government even if they do want to due to being ineligible for security clearance from checks notes gender and sexuality mistrust, non-zero drug usage lifetime to date, formerly grayhats, have ever sought mental health care, and/or anti-authoritarian viewpoints.

▲

lakeviewterrace 2 hours ago | parent | next [-]

To be fair, the track record for mentally unwell people in positions of trust isn't great.

	▲	StilesCrisis 18 minutes ago \| parent \| next [-]
		"Saw a therapist once" =/= "unwell." In fact avoiding therapy at all costs is a good sign of trouble.
	▲	dylan604 an hour ago \| parent \| prev [-]
		Before the most recent elections, people voted for an unwell person to lead the country. So it's not just someone can obtain the position, but that people actually chose to put one in office. Twice. Although, it was less well known on the first one.

▲

2 hours ago | parent | prev [-]

[deleted]

▲

2 hours ago | parent | prev | next [-]

[deleted]

▲

vlan0 2 hours ago | parent | prev [-]

Bruh do you remember snowden? The government is HEAVILY sub-contracted. Accenture? Really? My guy...

▲

BeetleB an hour ago | parent | prev | next [-]

> The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.

Indeed. I recently set up a bot on my local machine that I can interact with via Telegram. I gave it the ability to retrieve the contents of a URL via Playwright (with modifications). Basic things like getting the Readability view and getting the site as Markdown with links.

I was essentially mimicking the feature OpenAI etc offer where it can do a web search for you and get you the answer you seek. I just didn't want to pay a company for that feature.

It's not autonomous. It only acts when I tell it to. The actual search is via the Kagi API, but the URL contents is via Playwright. I also ensured it can't do lots of requests at a time. There's a mandatory (random) sleep of between 1 and 5 seconds between two requests.

In less than a week, I've been flagged. When I do a Google search (as a human), I have to prove I'm human. Many sites have simply blocked me - I can't buy stuff from various vendors[1], I cannot access several news sites, etc.

The thing is, I didn't really access that many sites with the bot! At most it's the equivalent of someone mildly addicted to the web. Yet they caught me quickly.

Obviously, I disabled the bot's capability to get site content. I wonder how long my IP will be in the blacklist.

I know some people will say "Good riddance" to the outcome and to what I did. I'd love to have a real, serious discussion on whether what I did was immoral. But whatever your thoughts on the matter, do ponder over the fact that the system has made it hard for average Joes like you and me to have this "feature", but if you pay a giant tech company a monthly fee, you can have it.

[1] Thankfully, Amazon didn't block me. In the past I'd avoid them, but now I'm in the dilemma where I don't want to buy stuff from sites that make it difficult for me to buy stuff from them!

	▲	itishappy 2 minutes ago \| parent [-]
		I don't think this is an immoral application at all from your description, but would that be clear on the receiving end?

▲

cyanydeez an hour ago | parent | prev [-]

Compared to, russian intel scraping beyond demented word of mouth.

▲

_alternator_ an hour ago | parent | prev | next [-]

I'll just note that "compromised" is perhaps too strong. These services often come from VPN plugins (eg Hola VPN) that lets users watch sports from different restricted geographic regions. There is a trade here that's in the TOs: you get someone else's IP address, they get yours.

▲

lesuorac 3 hours ago | parent | prev | next [-]

> This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…

I mean politicians are so addicted to twitter the nsa makes special phones…

▲

dylan604 an hour ago | parent [-]

Not sure which direction you're intending this. The NSA is making special phones to protect politicians, or to make it easier to ensure they can read everything?

	▲	za_creature an hour ago \| parent \| next [-]
		Por que no los dos? It's always better to protect politicians from someone else
	▲	lesuorac an hour ago \| parent \| prev [-]
		Politicians bringing phones isn’t a scif isn’t necessarily a bad thing.

▲

YeahThisIsMe 3 hours ago | parent | prev [-]

[flagged]

	▲	dylan604 an hour ago \| parent \| next [-]
		Why are you so surprised that the US gov't is being spied on? Of course they are. Why/how could you ever suspect they would not be? How Polyanna can one be to think this way?
	▲	senordevnyc 2 hours ago \| parent \| prev [-]
		Why would you assume everyone in the world gives a shit about this?