differentials

If you used brew install handbreak between May 2nd and 5th, you downloaded the malicious version; - https://github.com/caskroom/homebrew-cask/commit/461af7672fa... The pull request has comments as well, and a snarky dev ;D - https://github.com/caskroom/homebrew-cask/pull/33354

Good question, I assume there is some way the compiler/runtime would dedupe these for the coder at compile time. However I don't honestly know enough about the Go internals... Honestly, I wrote more Go code during this blog post than I ever had, even though I had been reversing it for a while...

Yes, you could in theory rename everything prior to compilation for obfuscation/space saving - similar to how (some) Java protections worked.

Everything get prefixed by the package namespace, so things pulled from github.com/group_name/package ends up looking like `github_com_group_name_package_class_funcname. This why why "rebuilding" the function names was a good way to quickly filter out the "known" code from the malicious functionality.

The https link should be working now, switched over to cloudflare. Thanks for the link though!

Author here... Link was submitted using https which I had not set up yet. Just switched over to a CF nameserver so it should be working shortly...