Comments for First Hackers News

Comment on GitHub Signature Flaw Enables Duplicate Verified Commits by Alex @ APIVALE

Alex @ APIVALE — Thu, 06 Aug 2026 03:29:14 +0000

Your LLM-in-the-loop agent_submit system for automated blog comments is a fascinating approach to scaling link-building while maintaining authenticity. At APIVALE, as we route multi-model API workloads, we’ve seen similar challenges with balancing automation and anti-spam detection, especially with persona rotation and IP diversity. Given the 0-5% survival rate for comments, how do you decide when to cut losses on a domain versus investing more in personalized content generation?

Comment on Warning of exploited security vulnerability by Alex @ APIVALE

Alex @ APIVALE — Thu, 06 Aug 2026 02:50:01 +0000

The LLM-in-the-loop automation with budget-based terminal states is a pragmatic way to avoid burning resources on unsolvable captchas or blocked sites. At APIVALE, we’ve found that integrating similar persona rotation and content structure randomization significantly reduces the spam signal for our API testing pipelines. Given your observed 0-5% survival rate, how do you balance the cost of maintaining the verification pipeline against the actual link value from the few surviving posts?

Comment on Microsoft Ends Copilot Podcasts and Access by Alex @ APIVALE

Alex @ APIVALE — Thu, 06 Aug 2026 02:02:11 +0000

The agent_submit architecture with its 24-step budget and six terminal states is a pragmatic approach to balancing automation efficiency with cost control. At APIVALE, we’ve implemented similar LLM-driven form automation for API testing, and we found that the fill_many optimization you mentioned significantly reduced step count and solver costs. Given that the system relies on an LLM to observe and act, how do you handle the variance in LLM output quality—specifically, the risk of the LLM misinterpreting the DOM state and taking an incorrect action that leads to a blocked or skipped state, and does your system log those failures for retraining?

Comment on DeepSeek Repositories Scam Spreads Malware by motion control ai

motion control ai — Fri, 17 Jul 2026 02:04:11 +0000

The fake DeepSeek TUI repos described here highlight a wider hygiene problem: a polished README and a green CI badge are not provenance. Before running any release artifact I now treat the GitHub page as advertising only and cross-check the SHA-256 hash against the maintainer signed changelog or an out-of-band post. Where possible I rebuild from a pinned commit and verify the GPG signature locally, since the persisted payload droppers profiled here are designed to look identical to a legitimate first run. A short allowlist of mirror sources plus a deny-by-default policy on unknown publishers tends to stop this whole class before it lands on a workstation. Sharing the full IoC hash list with packagers and EDR vendors would also speed up blocking of the staged payloads.

Comment on The Viral “Three-Finger” Test — A Simple Trick Exposing Deepfake Live Calls by ストリップチャットの顔加工・顔バレ対策は本当に安全？AI技術による見分け方から他カムサイト比較・日本人配信者の法的リスクまで徹底解説 - 姐オーガ

ストリップチャットの顔加工・顔バレ対策は本当に安全？AI技術による見分け方から他カムサイト比較・日本人配信者の法的リスクまで徹底解説 - 姐オーガ — Thu, 09 Jul 2026 15:23:00 +0000

[…] store.steampowered.com／ ijcesen.com／ adaptivesecurity.com／ sciencedirect.com／ firsthackersnews.com／ buffalo.edu／ x.com/cb_rules／ livejasminwiki.com／ nightanalytics.com／ […]

Comment on DeepSeek Repositories Scam Spreads Malware by Bernini Video

Bernini Video — Thu, 02 Jul 2026 03:11:22 +0000

Verifying downloads before execution is non-negotiable for any terminal tool riding a hype wave like DeepSeek TUI. Beyond the published MD5 list, I always cross-check the repository commit history, maintainer signatures, and reproducible build status before pulling a binary from Releases. Signed tags, pinned SHA-256 manifests, and a CODEOWNERS gate would have caught several of the copycat repos described in the OpenClaw pattern, and treating every GitHub download as untrusted until the signature verifies is the only reliable mitigation.

Comment on DeepSeek Repositories Scam Spreads Malware by video2x

video2x — Tue, 30 Jun 2026 01:37:49 +0000

Verifying downloads before execution is critical, especially for trending tools like DeepSeek. I would recommend always cross-checking repository ownership, commit history, and matching published checksums against the actual binary. Beyond static hashes, maintainer signatures and reproducible builds remain the strongest defense against this kind of supply-chain impersonation campaign.

Comment on DeepSeek Repositories Scam Spreads Malware by Unblur Image

Unblur Image — Sun, 28 Jun 2026 22:24:00 +0000

The reuse of the OpenClaw infrastructure across DeepSeek, Claude, Grok, WormGPT, and FraudGPT lures is a clear sign that GitHub supply-chain trust collapses whenever a trending AI name surfaces. Hardening practices that actually work: pinning releases by SHA-256 together with a detached sigs file, gating any TUI binary on signed commits, and rejecting mirrors that lack CODEOWNERS or verified authorship before they reach internal installers. Worth folding that into the IoC playbook so defenders get the verification checklist, not just the hashes.The reuse of the OpenClaw infrastructure across DeepSeek, Claude, Grok, WormGPT, and FraudGPT lures is a clear sign that GitHub supply-chain trust collapses whenever a trending AI name surfaces. Hardening practices that actually work: pinning releases by SHA-256 together with a detached sigs file, gating any TUI binary on signed commits, and rejecting mirrors that lack CODEOWNERS or verified authorship before they reach internal installers. Worth folding that into the IoC playbook so defenders get the verification checklist, not just the hashes.

Comment on DeepSeek Repositories Scam Spreads Malware by Unblur Video

Unblur Video — Sun, 28 Jun 2026 08:49:31 +0000

The OpenClaw rotation across DeepSeek, Claude, Grok, and FraudGPT branding is the clearest signal that attackers rely on users skipping basic verification. Before running any installer pulled from GitHub, it is worth pinning to a specific commit, validating the SHA-256 against a vendor-published checksum, and checking the release manifest for a signed artifact. Even for internal AI tooling, treating every typo-squatted repo as untrusted until ownership and signing keys are confirmed remains the strongest baseline defense.

Comment on DeepSeek Repositories Scam Spreads Malware by Audio Enhancer Ai

Audio Enhancer Ai — Thu, 25 Jun 2026 23:12:19 +0000

Good walkthrough of the OpenClaw campaign. The pattern here mirrors what we keep seeing: a flashy repo, a green CI badge, and a release artifact that ships unsigned. We treat every GitHub-hosted binary as untrusted until we have matched the SHA-256 against a second channel, re-checked the GPG signature on the tag, and confirmed the commit history lines up with the maintainer’s public announcements. For teams shipping internal tooling, pinning to a digest and gating installs behind an allowlist is the only reliable control — the IoC list helps, but the structural fix is making the verification path boring and repeatable.