dmarto

And now the phishing page is advertising data for sale:

> crates.io db along with juicy tokens for sale. email for buying! (free leak if no offer till sunday >.<)

So far: rickroll → Strong Dog vs Weak Dog meme → future plans → advertisement.

Heh, the phishing page now redirects to a rickroll.

Here is the author's latest update and the revelation of the mystery:

https://devnonsense.com/posts/asymmetric-routing-around-the-...

Vendoring is nice, and I usually prefer it, but you don't always have the time or people for it.

Vendoring + custom build system (Bazel?) for everything is basically googles approach, if what I have read is correct. Definitely better than everything we have, but the resources for it are not something most can afford.

P.S also what mrcus said, if we trust the upstream build process, we may as well trust their binaries.

With an active electrode, it should be good enough. After all, we are talking about hobby-grade results.

The Olimex ones are 10-bit (supporting both active and passive electrodes), while it's claimed[0] that 12-bit resolution is sufficient for EEG.

However, it's worth noting that there are obvious advantages to the higher resolution.

[0] https://www.biosemi.com/faq/24bitsystem.htm

There is also the OpenEEG project[0], the boards are way cheaper (sub 100eur[1]) and also they are both open source and open hardware.

[0] - https://openeeg.sourceforge.net/doc/index.html

[1] - https://www.olimex.com/Products/EEG/OpenEEG/

You have perfectly put into words, all my thoughts.

I have been thinking about ways to secure myself, as it is exhausting to think about it every time there is an update or some new dependency.

After this attack, I think the only sure way is to unplug the computer and go buy goats.

The next best thing? Probably ephemeral VMs or some Codespaces/"Cloud Dev Env thingy". (except neither would save me in the xz case)

Kinda relevant, as I saw few comments about how safer languages are the solution.

Here[0] is a very simple example, that shows how easy such supply chain attacks are in Rust; and lets not forget that there was a very large python attack just a few days ago[1].

[0] - https://github.com/c-skills/rust1

[1] - https://checkmarx.com/blog/over-170k-users-affected-by-attac...