News for hackers. Stuff that matters.
Re:Snyk security researcher deploys malicious NPM packages t... by bbqfog on Monday January 13, 2025 @07:58PM (#42692000)
Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains.

https://en.wikipedia.org/wiki/Snyk

Re:Snyk security researcher deploys malicious NPM packages t... by kstrauser on Monday January 13, 2025 @08:31PM (#42692310)
I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks.

Your criticism sounds to me like "just a reminder that this armed bodyguard service comprises Navy SEALs and Army Rangers". Uh, great!

Re:Snyk security researcher deploys malicious NPM packages t... by xyzzy123 on Monday January 13, 2025 @11:28PM (#42693636)
I'd give good odds it was a mistake by a staff member (or small group) who overstepped and was not part of any formal work.

Most companies where I've worked as a security researcher, you get some time as part of your job to hack on random stuff to be able to generate interesting talks / research. This feels like that.

This isn't a special cyber spooky practice, most pentesting companies do this to generate IP (rarely, lol), buzz (reasonably often) and keep the staff happy (this is really the main thing).

It's rare for management to be fully across the scope of this.

Re:Snyk security researcher deploys malicious NPM packages t... by CuriouslyC on Monday January 13, 2025 @08:51PM (#42692476)
Maybe if you change that to "armed bodyguard services employ ex KGB assassins"
Re:Snyk security researcher deploys malicious NPM packages t... by nullityrofl on Monday January 13, 2025 @09:41PM (#42692829)
I think you've missed the point: it's Americentric to assume that Navy SEALs and Army Rangers are inherently pure, good and have done nothing evil on behalf of the American government when we largely know that to be untrue.
Re:Snyk security researcher deploys malicious NPM packages t... by kstrauser on Monday January 13, 2025 @10:38PM (#42693291)
That wasn't my point at all. The point was that often the best people to protect a resource are the ones who know how to attack it.
Re:Snyk security researcher deploys malicious NPM packages t... by bbqfog on Monday January 13, 2025 @11:07PM (#42693488)
I have no downside to seeking alternatives. The pager incident ensured that I will always look for non-Israeli tech.
Re:Snyk security researcher deploys malicious NPM packages t... by dekelpilli on Tuesday January 14, 2025 @12:17AM (#42693951)
Based on the pager incident, I'd think you should avoid companies that don't have a publicly-known link to Israel. It's not like Hezbollah thought they were buying pagers from 8200 alumni.
Re:Snyk security researcher deploys malicious NPM packages t... by kstrauser on Monday January 13, 2025 @11:55PM (#42693816)
And what does that have to do with Snyk, other than that some of their employees use to work for IDF?

I'm a US Navy veteran. Would you also stay away from my employers because they have veterans on staff?

Seriously, I get what you're trying to say, but I don't understand the broader point you're trying to make. So Snyk has some ex-IDF employees. Find a high-profile infosec firm that doesn't. They military service they were compelled to has a reputation at being really, really good at infosec. I see no reason why companies shouldn't want to hire them afterward.

Re:Snyk security researcher deploys malicious NPM packages t... by defrost on Tuesday January 14, 2025 @12:08AM (#42693909)
Without wanting to take a position here, the GP comment had a specific narrow point.

The claim was that Snyk was founded by Unit 8200 members.

Not that it had a few Israeli veterens, almost all Israeli's serve in the IDF after all.

https://en.wikipedia.org/wiki/Unit_8200

To be fair I have a former Unit 8200 member in my larger extended family who left and has since been vocal in opposition to Netanyahu so membership in an elite Cyber Unit alone doesn't define a person.

That aside, most Governments would keep an eye on a company started by, say, former NSA employees and watch for covert activity under any overt actions.

Re:Snyk security researcher deploys malicious NPM packages t... by dekelpilli on Tuesday January 14, 2025 @07:05AM (#42696261)
It would correlate strongly that 8200 alumni end up being educated and working in tech, and likely living in Tel Aviv. This is a group of people who, by and large, are not big fans of the current government.
Re:Snyk security researcher deploys malicious NPM packages t... by PoppinFreshDo on Monday January 13, 2025 @11:33PM (#42693668)
What pager incident?
Re:Snyk security researcher deploys malicious NPM packages t... by mhitza on Monday January 13, 2025 @11:45PM (#42693763)
Re:Snyk security researcher deploys malicious NPM packages t... by PoppinFreshDo on Tuesday January 14, 2025 @03:41AM (#42695088)
Well, if the mossad put "made in israel" on those devices I doubt they would have worked.
Re:Snyk security researcher deploys malicious NPM packages t... by defrost on Monday January 13, 2025 @11:44PM (#42693747)
The recent one in which Israeli techs compromised pager supply chains.

It was very widely reported across the globe.

[dead]
Re:Snyk security researcher deploys malicious NPM packages t... by PessimalDecimal on Monday January 13, 2025 @09:38PM (#42692811)
This is a tiresome motte-and-bailey argument. You are trying to conflate the OP comment with something it's not (base antisemitism).

Just like companies founded by say former operatives of the CIA, NSA, MI6, etc. would (and maybe should?) be viewed with skepticism, so too are companies founded by former members of Unit 8200.

Mentioning that Israel's military (like many others) has engaged in some less than ethical behavior is not equivalent to antisemitism. Trying to pretend otherwise is ridiculous.

Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @09:46PM (#42692871)
Israel has mandatory military service. If anyone who has ever served in the IDF is tarnished and has that part of their life periodically dragged out as evidence that they may be untrustworthy, you're saying that the entire Jewish population of the state of Israel needs to have a giant asterisk attached to them reminding everyone that they were in the IDF.

That may not be strictly antisemitic—maybe you're totally fine with Jews as long as they were raised anywhere else—but it's still not a healthy way to treat people.

Re:Snyk security researcher deploys malicious NPM packages t... by joseppudev on Monday January 13, 2025 @10:11PM (#42693078)
I don't understand the purpose of creating ambiguity by confusing mandatory military service and intelligence corp that operates under secrecy. Original post getting flagged is not a great sight either.
Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @10:14PM (#42693102)
IDF Unit 8200 consists of thousands of conscripts serving their mandatory military service. If I were in Israel subject to conscription, I would absolutely have attempted to position myself into that unit for my mandatory service, as would most here. Beats the infantry.

What exactly am I confusing by pointing that out?

Were you under the impression that this unit was something like the NSA, staffed with people who chose to spy on people as a career? Because it's not. It's staffed by kids who are very good with computers and who—when given a choice between covert intelligence and a branch that actively shoots guns at people—chose the intelligence arm. Which would you have chosen?

Re:Snyk security researcher deploys malicious NPM packages t... by PessimalDecimal on Monday January 13, 2025 @10:27PM (#42693194)
https://www.timesofisrael.com/hezbollah-pager-explosions-put...

Just months ago, some of those "kids who are very good with computers" caused compromised pagers to explode, with no knowledge of who would be near them. Civilians, including children, died as a result. It is right to think people who are "good with computers" in this way might not have the best intentions in their other applications of computers.

Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @10:30PM (#42693214)
The other alternative that those kids were given was to shoot guns or missiles. Are you really comfortable blaming them for the rest of their lives for choosing the option that likely gave them the smallest chance of killing people?

Any Israeli citizen in that age bracket today is going to be running a real risk of killing people. They don't have a choice (dodging the draft doesn't count as a choice). If you're going to hold that over for them for the rest of their lives I don't know how that's distinct from racism (or countryism if you prefer).

Re:Snyk security researcher deploys malicious NPM packages t... by PessimalDecimal on Monday January 13, 2025 @10:37PM (#42693278)
> Are you really comfortable blaming them for the rest of their lives for choosing the option that likely gave them the smallest chance of killing people?

Yes. The "just following orders" excuse has been tried in the past. People didn't buy it then and we won't buy it now.

https://www.nbcnews.com/news/world/israel-soldiers-arrest-ab...

If the IDF wants to name the specific individuals from Unit 8200 who were involved in maiming or killing civilians including children by blowing up electronics in their faces, that might change things. Then it'd be a lot easier for people to avoid having concerns about that entire unit. Not naming them seems a lot like tacit support by the IDF for the actions of those in Unit 8200 who killed those children. Otherwise, people very well may have concerns about that entire unit. That's not "racism."

Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @11:23PM (#42693605)
(I deleted a comment that didn't seem relevant any more now that you added a bunch.)

So it's okay to blame vets of Unit 8200 for its actions 10 years after they founded Snyk (I have no idea how long after they left the unit) on the grounds that the intelligence arm of the IDF doesn't name names? So just in case and in the face of all the facts of the timelines, we should make sure to drag out these people's former mandatory service and remind everyone they served alongside bad guys 10+ years ago?

I'm not okay with blaming soldiers for following orders. When it's that or getting shot by your own side, there isn't a real choice. But I can't even begin to understand the mindset that would blame soldiers for the orders that other, unrelated soldiers followed more than 10 years later. That's some next-level hatred.

Re:Snyk security researcher deploys malicious NPM packages t... by mardifoufs on Tuesday January 14, 2025 @03:13AM (#42694922)
Yes, because it's an institutional problem. I'm sure you have no issues using products developed by say, ex FSB agents just because it's been 10 years?
Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Tuesday January 14, 2025 @08:28AM (#42696891)
The FSB is no comparison because it's more equivalent to the NSA—it was a career path, not a place to serve out mandatory military service.

FSB agents worked there for decades and chose that instead of any number of other things they could have done. Unit 8200 conscripts worked there for at most 2 years 8 months and chose it instead of a different, more gun-blazing branch of the military.

Mandatory military service completely changes the profile of the vets in a way that makes all these comparisons totally irrational. They're founded in fear and hatred for Israelis, not any reasonable similarity.

Re:Snyk security researcher deploys malicious NPM packages t... by mardifoufs on Tuesday January 14, 2025 @09:20AM (#42697496)
Fear of Israelis, sure. But hatred? Come on. Israel has done a lot in the past year, and is being accused of genocide. The fact that is used a conscript army makes it worse, not better.

Also, okay then let's switch it up to the Russian army. Would you use a product with known ties to some electronic warfare russian army unit. Or rather, would you consider any doubts or hesitations over using said product to be "russophobic"?

Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Tuesday January 14, 2025 @01:05PM (#42701203)
> The fact that is used a conscript army makes it worse, not better.

I'm not defending the state, I'm defending the individuals who were conscripted.

The entire point of this subthread is that it's heinous to confuse the two.

> Would you use a product with known ties to some electronic warfare russian army unit. Or rather, would you consider any doubts or hesitations over using said product to be "russophobic"?

If I suddenly learned that some founding members of the JetBrains team had previously been conscripted into the Russian army and had served in a cyberwarfare unit, that would change absolutely nothing for me. And yes, I do consider the backlash against JetBrains in the aftermath of the invasion of Ukraine to have been highly rusophobic.

Re:Snyk security researcher deploys malicious NPM packages t... by mardifoufs on Tuesday January 14, 2025 @06:47PM (#42705546)
To be honest, I don't disagree but I see why people do care about it.

In the sense that this is just a direct result of Israel's actions. They staged an incredibly powerful intelligence coup with the blown up pagers. Now I agree that if you aren't involved in middle Eastern politics, there's no reason to be scared of Israeli products (even if made by ex-israeli soldiers). But I completely understand where the reputational damage comes from, it was such a well executed operation that it does cast more doubts on anything related to Israel.

My point about conscription was that it is worse in the sense that most Israeli citizens can be de-facto coerced into becoming an agent of the state, making Israeli products inherently more suspicious (and more tied to state policy, regardless of the individuals involved). As you say, most Israelis don't necessarily chose to be in the army. A lot of Hamas fighters are also basically conscripts, but that nuance wouldn't matter for most either.

There's also just the purely ideological angle, which is also what happened to anything touching Russia back in 2022. That's the angle that I agree is mostly unjustifiable.

Re:Snyk security researcher deploys malicious NPM packages t... by danenania on Monday January 13, 2025 @11:49PM (#42693780)
Why doesn’t refusing the draft count as a choice?
Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @11:57PM (#42693830)
Because it means a serious risk of the end of your life as you know it. I'm not willing to hold someone else to a standard that I know that I couldn't live up to.

If you truly believe that you'd risk your government's wrath instead of just picking the least dangerous and least likely to kill people branch of your military, then feel free to throw stones. For myself, my plan if the draft were reinstated in the US while I was still of that age was to find out how to join a cyberwarfare division, which would have led me straight to Unit 8200 if I were Israeli.

Re:Snyk security researcher deploys malicious NPM packages t... by danenania on Tuesday January 14, 2025 @12:12AM (#42693927)
If someone told me I had to deliberately kill innocent people or go to prison, I would choose prison and it wouldn’t be close. I would also prefer to end my own life than do this.

I know it’s not this simple in matters of war, but if someone believes their government is systematically committing moral atrocities, it seems reasonable to consider civil disobedience as an option even if the consequences are severe.

You’re right that we in the US are lucky not to be faced with a choice like this (for now), but I still think it’s a choice.

Re:Snyk security researcher deploys malicious NPM packages t... by KennyBlanken on Monday January 13, 2025 @10:34PM (#42693252)
Those "kids who are very good with computers" designed a black-box AI that has been designating people terrorists which the military then uses to bomb not just them but their entire family.

https://www.npr.org/2023/12/14/1218643254/israel-is-using-an...

Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @10:38PM (#42693294)
And their peers in the other branches are killing civilians in other ways. Your point?

The only way to hold this against the individuals rationally, especially for those on this forum who would absolutely have chosen Unit 8200 as the least bad option given conscription, is to blame every citizen of the state of Israel and hold them all in distrust for having ever been in any branch of the IDF. I'm personally not okay with that level of sweeping blame and distrust. Are you?

Re:Snyk security researcher deploys malicious NPM packages t... by KennyBlanken on Monday January 13, 2025 @10:58PM (#42693434)
> is to blame every citizen of the state of Israel

nobody has said or even implied this

> hold them all in distrust for having ever been in any branch of the IDF

nobody has said or even implied this

> that level of sweeping blame and distrust

There has not been any such thing in this discussion.

We're done here.

Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @11:02PM (#42693456)
Yes, it was done by OP, the comment that was rightly flagged and then later resurrected:

> Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains.

Given that Unit 8200 is staffed by conscripts, how is this anything other than attempting to ensure that any person who ever came of age in Israel has that held against them for the rest of their careers?

Members of Unit 8200 weren't given a choice between that and the private sector—they were given a choice between that and shooting a gun, which for a technically inclined new-adult isn't much of a choice at all. And am I seriously supposed to believe that OP would argue that choosing to be a grunt who shoots a gun at people would be the morally purer choice that would make someone more trustworthy?

Re:Snyk security researcher deploys malicious NPM packages t... by joseppudev on Monday January 13, 2025 @10:36PM (#42693267)
Size seems to be classified. Their officers seem to be classified as well. I understand how getting into the unit might be very normal. But doubt here is the healthy thing. Especially as a goyim.
Re:Snyk security researcher deploys malicious NPM packages t... by RHSeeger on Monday January 13, 2025 @09:32PM (#42692769)
They just recently snuck bombs into a supply chain and then remotely detonated them in positions where the caused civilian injuries. I would assume the comment has nothing to do with religion/race, and everything to do with the actions taken. Even for someone that is a supporter of that government, it's hard to deny they've taken some actions that are unsupportable.
Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @09:41PM (#42692830)
Who is "they"? Are we talking about Snyk? IDF Unit 8200? The IDF as a whole? The state of Israel? Jews in general?

The reason why OP's comment feels like a racist dog whistle is because it's an enormous and dangerous generalization that seems to encompass an entire country. Israel has mandatory military service—if everyone who's ever served in the IDF is untrustworthy because they served in the IDF then you're by definition excluding nearly every Israeli citizen from trust. I guess that's not strictly antisemitism—maybe you're happy to trust Jews that don't live in Israel—but it's definitely an unsavory position to take.

Re:Snyk security researcher deploys malicious NPM packages t... by KennyBlanken on Monday January 13, 2025 @10:45PM (#42693358)
Godwin's got an itch he can't scratch and doesn't know why....

"Encompassing the entire country" would be anti-zionist, not antisemitic.

There is a huge difference, and that does not change because the majority of people in that country are a particular religion, just like it's not "Anti-Protestant" if someone attacks Great Britain policies, or "Anti-Hindu" if someone criticizes India.

There is a difference, to the extent that there are plenty of jews who are anti-zionist.

Would you like to accuse them of being antisemitic because "nearly every Israeli citizen is Jewish"?

Also, it's your construct that criticizing the policies and actions of a country's military and government is "anti" that county...

Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @10:52PM (#42693403)
> Also, it's your construct that criticizing the policies and actions of a country's military and government is "anti" that county...

No, it's not—we're in a subthread where the OP said "Just a reminder that Snyk was founded by ex-IDF Unit 8200 soldiers. I would not trust them given what we've seen Israel do to supply chains."

They took the country's current policy and made it personal against specific IDF vets. That's what I'm standing against.

For the rest, I specifically said that it may not be antisemitic given that it's country-specific, so I'm not sure what you were getting at. I'm still not okay with blanket blaming an entire country's citizenry for its government actions. I wasn't okay with that when it came to Russia and Ukraine, I don't know why I should treat this differently now.

Re:Snyk security researcher deploys malicious NPM packages t... by Der_Einzige on Monday January 13, 2025 @10:29PM (#42693210)
It's not just the IDF, you have a CHOICE to join the spymaster side of it, vs being a regular grunt. That unit is part of Aman, the military version of Mossad.
Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @10:32PM (#42693237)
And why would choosing to be a grunt be more morally pure?

I'm a techie, if I were forced into conscription I would absolutely choose an option that let me use computers over one that forced me to shoot a gun. There's no way on Earth I can hold it against a bunch of kids who were forced to make that choice that they chose the intelligence arm.

And frankly, I have a hard time seeing how someone on this forum could hold that against them in good faith. Nearly everyone here would make the same call given that choice. If you think you wouldn't have, you're probably deluding yourself.

Re:Snyk security researcher deploys malicious NPM packages t... by myth_drannon on Monday January 13, 2025 @09:40PM (#42692822)
How the hell that is connected to a private software company?

Nvidia, Google, Microsoft, Intel is full of ex-8200.

Re:Snyk security researcher deploys malicious NPM packages t... by manquer on Tuesday January 14, 2025 @02:27AM (#42694698)
I would say it is on similar to criticism of TikTok or Huwaei and China.

It has less to do with whether it malicious intent from the start of building an organization for explicit intent of capturing core infra. It has more to do with how the Government of Israel operates and the legal requests they can make of their citizens and/or veterans.

Perhaps concern over Israeli products should be probably higher than for China as Israel more well known incidents of exploits as a State actor like with Stuxnet, Pegasus or more recently with pagers etc.

China no doubt has their own share of operations but they either have not used them as publicly in a large scale overt operation or been more discreet about it.

Point is the concern is valid just as it would be valid for China.

Re:Snyk security researcher deploys malicious NPM packages t... by kstrauser on Tuesday January 14, 2025 @10:14AM (#42698178)
You mean like how we found out that China attacked and pwn3d the entire US phone system? That’s not a shining example of discretion.
Re:Snyk security researcher deploys malicious NPM packages t... by manquer on Tuesday January 14, 2025 @06:19PM (#42705287)
As the U.S. has done to our closest allies and their leaders, would be shocking and incompetent if they have not done much more in Russia and China and vice versa

There is no equivalence intelligence gathering or gaining the capability for sabotage (which everyone does) versus actual active sabotage which today only Israel executes like with Stuxnet or with the pagers.

Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Monday January 13, 2025 @11:39PM (#42693708)
Just a reminder that Unit 8200 is staffed mostly by conscripts who are serving out their mandatory military service and chose to accept an invitation to serve in the cyberwarfare arm of the IDF instead of choosing to shoot guns.

In other words, it's staffed by Israeli kids who made the choice most of us would have made under the circumstances. It seems a bit unfair to hold that against them more than 10 years later, no?

Re:Snyk security researcher deploys malicious NPM packages t... by lmm on Tuesday January 14, 2025 @02:09AM (#42694599)
> In other words, it's staffed by Israeli kids who made the choice most of us would have made under the circumstances. It seems a bit unfair to hold that against them more than 10 years later, no?

You could say the same about the guy in a call center in India trying to pull a tech support scam on you over the phone. Yes, he's probably making the best choice he can for his own livelihood, probably the same thing you would do in his position. No, that doesn't mean you should trust him.

Just as you have to treat all Chinese companies as under control of the PRC government and all Australian companies as compromised by their security services, you have to treat all Israeli citizens as under the control of the Israeli military. Any adult can be conscripted and they have a history of disguising military operations as civilian ones. Someone might tell you they left the Israeli military 10 years ago and they're probably telling the truth, but if you make a habit of believing that statement you're going to get burned.

Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Tuesday January 14, 2025 @08:46AM (#42697133)
> You could say the same about the guy in a call center in India trying to pull a tech support scam on you over the phone. Yes, he's probably making the best choice he can for his own livelihood, probably the same thing you would do in his position. No, that doesn't mean you should trust him.

No, you can't, because the scammer in the call center is choosing that over thousands of other options. Are they choosing to maximize their pay? Maybe. But for every scammer there are thousands of Indians who show a different option.

Choosing to dodge or resist the draft is totally different—very few people do it, and those who do get prison terms. If you sincerely believe that you'd have chosen to go to prison rather than be drafted, more power to you, but I and most others would aim to minimize the likelihood of ourselves dying and minimize the number of people I'd have to kill. For me that would have meant signing up for cyberwarfare, which in Israel would have meant Unit 8200.

The rest of your comment is totally irrational fear-based speculation. Anti-Israel sentiment may not be antisemitic, but it sure shares the same tendency towards irrational fear and aggression.

Re:Snyk security researcher deploys malicious NPM packages t... by lmm on Tuesday January 14, 2025 @09:39AM (#42697719)
> the scammer in the call center is choosing that over thousands of other options.

No, they're the people who don't have other options (because they lack the skills and/or qualifications and/or are discriminated against). It's not malice, it's just desperation to get money to live on (or, often, to provide for people who depend on them). But of course the end result is the same.

> The rest of your comment is totally irrational fear-based speculation.

Entirely rational given the historical pattern of behaviour shown by the Israeli military, and the fact that they have no reason to change (quite the opposite).

Re:Snyk security researcher deploys malicious NPM packages t... by weatherlite on Tuesday January 14, 2025 @08:47AM (#42697143)
> Just as you have to treat all Chinese companies as under control of the PRC government and all Australian companies as compromised by their security services, you have to treat all Israeli citizens as under the control of the Israeli military

Got it , and are now all American companies suspect because they are managed behind the scenes by Musk and Trump?

Re:Snyk security researcher deploys malicious NPM packages t... by lmm on Tuesday January 14, 2025 @09:34AM (#42697655)
All American companies are suspect given the National Security Letter system yes. (Also South Korea and Kazakhstan, and obviously also any country where the "rule of law" is low enough that governments can do as they wish without formal legal powers)
Re:Snyk security researcher deploys malicious NPM packages t... by bbqfog on Tuesday January 14, 2025 @09:18AM (#42697479)
I feel the same way about companies with CIA founders.
Re:Snyk security researcher deploys malicious NPM packages t... by bbqfog on Tuesday January 14, 2025 @09:17AM (#42697468)
I would under no circumstance join the IDF or even live in Israel. They’re not “kids”, they are military personnel.
Re:Snyk security researcher deploys malicious NPM packages t... by arccy on Tuesday January 14, 2025 @09:44AM (#42697786)
key word: "conscript"

if you're born there, you have little choice in the matter.

Re:Snyk security researcher deploys malicious NPM packages t... by bbqfog on Tuesday January 14, 2025 @09:56AM (#42697938)
I've never met an Israeli who wasn't a dual citizen. It's a choice to stay in Israel and fight in the IDF. In fact, the Snyk founder lives in London now: https://uk.linkedin.com/in/guypo
Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Tuesday January 14, 2025 @01:01PM (#42701107)
> I've never met an Israeli who wasn't a dual citizen.

Given that unless you are in Israel you're most likely to be meeting Israeli expats or at the very least people who travel, that's hardly surprising and not great evidence for anything.

> In fact, the Snyk founder lives in London now

So you're acknowledging that you're going to hold their country of origin against them even after they've moved. Got it.

Re:Snyk security researcher deploys malicious NPM packages t... by bbqfog on Tuesday January 14, 2025 @01:14PM (#42701361)
I don’t understand your complaint. People are free to vocally denounce Zionism. These founders have not done that. Quite the opposite, Snyk has offices in Israel and has been vocal about their ties to the IDF. It’s absolutely within my agency to not use their products. Again, there’s zero downside to do that.
Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Tuesday January 14, 2025 @01:38PM (#42701749)
Correct, you're welcome to do that, and I'm welcome to denounce you for advocating boycotting a product because of the country of origin of its founders.

People can't help where they're born, and you're wrong to hold that against them. You're welcome to work through that cognitive dissonance however you like, but in the meantime I will continue to advocate for treating individuals as individuals.

Re:Snyk security researcher deploys malicious NPM packages t... by bbqfog on Tuesday January 14, 2025 @01:42PM (#42701803)
No one is entitled to my business. I have no cognitive dissonance, my business interests are aligned with my moral interests in this case. I don’t use Israeli tech whenever possible.

You “denouncing” people who make a rational calculation isn’t really helping to market the firms you are supporting.

Re:Snyk security researcher deploys malicious NPM packages t... by lolinder on Tuesday January 14, 2025 @02:02PM (#42702100)
I'm not supporting firms, I'm supporting the right of individuals to be seen as individuals rather than as members of a group assigned to them at birth.

That said, this obviously isn't going anywhere, so have a nice day.

Re:Snyk security researcher deploys malicious NPM packages t... by guappa on Thursday January 16, 2025 @03:31AM (#42722869)
"being born in israel" and "Join the army and take part in genocide" aren't the same thing, despite your tryhard attempts to make them into the same thing.
Re:Snyk security researcher deploys malicious NPM packages t... by yard2010 on Tuesday January 14, 2025 @12:29AM (#42694007)
Don't hate the player hate the game ;)
Re:Snyk security researcher deploys malicious NPM packages t... by krembo on Tuesday January 14, 2025 @03:42AM (#42695091)
That's absurd. If that's your claim, do you know how many of your daily tools and hardware you should also drop?
Re:Snyk security researcher deploys malicious NPM packages t... by bbqfog on Tuesday January 14, 2025 @09:15AM (#42697439)
I’m dropping as many as I can as is my prerogative as a consumer.
Re:Snyk security researcher deploys malicious NPM packages t... by krembo on Tuesday January 14, 2025 @04:58PM (#42704482)
Do you need some help with that? I'll be more than happy if antisemites like you won't be using any of the advanced tech we're working hard to create .
Re:Snyk security researcher deploys malicious NPM packages t... by bbqfog on Tuesday January 14, 2025 @05:56PM (#42705070)
Sure, where do you work? I’ll be happy to add it to my list!
Re:Snyk security researcher deploys malicious NPM packages t... by guappa on Thursday January 16, 2025 @03:27AM (#42722829)
Ah the old trick of calling racism if you voice disagreement with a government… At this point people like you have made the word "antisemite" completely devoid of any meaning.
Re:Snyk security researcher deploys malicious NPM packages t... by krembo on Thursday January 16, 2025 @06:10AM (#42723867)
You are not criticizing the government but denying Israel's right to exists and protect itself, and this is the good ol' antisemitism with a brand new liberal mask.
Re:Snyk security researcher deploys malicious NPM packages t... by guappa on Thursday January 16, 2025 @07:29AM (#42724352)
The population of Gaza has LITERALLY been decimated in the past year (10% died).

If you don't criticise this, you are a terrible human being.

Genocide is bad also if you do it on dark skinned people, FYI.

Re:Snyk security researcher deploys malicious NPM packages t... by krembo on Thursday January 16, 2025 @12:12PM (#42728010)
So had the population of Drezden in 1945. If you can't understand that being on the evil side of history and starting a war has its price, you are a terrible human being.
Re:Snyk security researcher deploys malicious NPM packages t... by guappa on Thursday January 16, 2025 @04:48PM (#42731358)
If a genocide supporter calls me a terrible human being, I'm clearly a good person.

Dresden was a war crime and played no part in winning the war. Same with the atomic bombs.

Re:Snyk security researcher deploys malicious NPM packages t... by weatherlite on Tuesday January 14, 2025 @04:05AM (#42695219)
So every Israeli is now a Mossad agent and every customer is an enemy of Israel like Hezbollah? You won't buy from Snyk because you want to boycott Israel, just own up to it it's a popular position to take.
Re:Snyk security researcher deploys malicious NPM packages t... by bbqfog on Tuesday January 14, 2025 @09:14AM (#42697427)
I’d put Unit 8200 and Mossad in the same basket. I think I made it clear I’m boycotting Israeli products, I’m not hiding that.
Re:Snyk security researcher deploys malicious NPM packages t... by Cthulhu_ on Tuesday January 14, 2025 @05:09AM (#42695626)
As the pager / radio terrorist attack showed, it's the Mossad involvement you don't know about that you should be worried about. Same with the CIA, they were behind "secure" radio communication in Europe for decades (https://en.wikipedia.org/wiki/Crypto_AG) and nobody had any idea.