home.social

#web3isgoinggreat — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #web3isgoinggreat, aggregated by home.social.

fetched live
  1. Now that #Web3 is thankfully not going so great, maybe it's time to reclaim the word for all the projects and individual endeavors that are working on bringing back the fun to the web, beyond the walled gardens of big tech.
    #web3isgoinggreat

  2. Now that #Web3 is thankfully not going so great, maybe it's time to reclaim the word for all the projects and individual endeavors that are working on bringing back the fun to the web, beyond the walled gardens of big tech.
    #web3isgoinggreat

  3. Looks like the original client ID is taken care of, but the phishers just cycle through clients -- still with the same display name, mind you:

    19fdc124-ddf3-4c5f-bdaf-4d5a079b9c2b

    Third Party: Support

    #Coinbase, maybe you shouldn't be allowed to spin up OAuth apps without human approval in the loop. Or at least, disallow display names like "Third Party: Support".

    The underlying infrastructure these scammers are using is still the same. Coinbase could make a point of automatically monitoring it and auto-banning any client ID they use.

    Maybe I'll do that myself, just to prove a point.

    #cryptocurrency #web3 #Web3isgoinggreat

  4. Looks like the original client ID is taken care of, but the phishers just cycle through clients -- still with the same display name, mind you:

    19fdc124-ddf3-4c5f-bdaf-4d5a079b9c2b

    Third Party: Support

    #Coinbase, maybe you shouldn't be allowed to spin up OAuth apps without human approval in the loop. Or at least, disallow display names like "Third Party: Support".

    The underlying infrastructure these scammers are using is still the same. Coinbase could make a point of automatically monitoring it and auto-banning any client ID they use.

    Maybe I'll do that myself, just to prove a point.

    #cryptocurrency #web3 #Web3isgoinggreat

  5. Whelp, six hours later and the OAuth client is still active :( Odds are good that, at this point, most of the victims have been successfully phished. You really need fast response times to get ahead of these campaigns. #web3isgoinggreat

    #coinbase #cryptocurrency #phishing #web3

  6. Whelp, six hours later and the OAuth client is still active :( Odds are good that, at this point, most of the victims have been successfully phished. You really need fast response times to get ahead of these campaigns. #web3isgoinggreat

    #coinbase #cryptocurrency #phishing #web3

  7. Chat told me to email [email protected] with the full phishing email. Sent them an .eml file along with a link to this thread.

    There. I did my good deed for the day. I despise what #cryptocurrency has become, but I also despise scammers that seek to steal from those they can fool.

    #coinbase #web3 #web3isgoinggreat

  8. Chat told me to email [email protected] with the full phishing email. Sent them an .eml file along with a link to this thread.

    There. I did my good deed for the day. I despise what #cryptocurrency has become, but I also despise scammers that seek to steal from those they can fool.

    #coinbase #web3 #web3isgoinggreat

  9. What's this? A phishing email that doesn't get any spelling or grammar wrong? Impressive.

    The URL included in the email has a redirect to:

    newkste66f02.s3.amazonaws.com/

    Which just has this in the HTML:

    ```
    window.location.assign("jademountains.net/s2");
    ```

    Which redirs with an appended slash:

    jademountains.net/s2/

    Which redirs to

    coinbase-v3teamapp.com/signin/

    Which isn't a legit coinbase domain -- URL registered today. Which resolves to a blank page with a single javascript payload:

    coinbase-v3teamapp.com//static

    Which appears to be a React app, which then ultimately triggers a load of this URL, which includes a list of desired OAuth scopes:

    login.coinbase.com/oauth2/auth${e.data.data.clientId}&redirect_uri=${e.data.data.redirectURI}&account=all&scope=wallet:accounts:read,wallet:accounts:update,wallet:accounts:create,wallet:accounts:delete,wallet:addresses:read,wallet:addresses:create,wallet:buys:read,wallet:buys:create,wallet:deposits:read,wallet:deposits:create,wallet:notifications:read,wallet:payment-methods:read,wallet:payment-methods:delete,wallet:payment-methods:limits,wallet:sells:read,wallet:sells:create,wallet:transactions:read,wallet:transactions:send,wallet:transactions:request,wallet:transactions:transfer,wallet:user:read,wallet:user:update,wallet:user:email,wallet:withdrawals:read,wallet:withdrawals:create,offline_access

    Which, cleaned up, is this:

    wallet:accounts:read
    wallet:accounts:update
    wallet:accounts:create
    wallet:accounts:delete
    wallet:addresses:read
    wallet:addresses:create
    wallet:buys:read
    wallet:buys:create
    wallet:deposits:read
    wallet:deposits:create
    wallet:notifications:read
    wallet:payment-methods:read
    wallet:payment-methods:delete
    wallet:payment-methods:limits
    wallet:sells:read
    wallet:sells:create
    wallet:transactions:read
    wallet:transactions:send
    wallet:transactions:request
    wallet:transactions:transfer
    wallet:user:read
    wallet:user:update
    wallet:user:email
    wallet:withdrawals:read
    wallet:withdrawals:create
    offline_access

    Which is, I'd assume, basically everything, including the ability to withdraw:

    wallet:withdrawals:read
    wallet:withdrawals:create

    Before ultimately ending up at what appears to be a coinbase-owned domain:

    login.coinbase.com/signin?clie

    ```
    $ dig -t A coinbase.com +short
    104.18.35.15
    172.64.152.241
    $ dig -t A login.coinbase.com +short
    172.64.152.241
    104.18.35.15
    ```

    The OAuth bits of the URL tell me that this must be a third-party Coinbase app. Can't find an easy way to map that client ID of

    c300bb46-07f8-4257-9760-a892c704a8b6

    back to an app page though to report it.

    What the hell. I'll bite. I don't have anything in Coinbase anymore. Let's see if I can't get the actual app and report it.

    Logging in... SMS 2-factor, Email 3rd factor.

    Aaaaaand BINGO. The third-party app is named

    "Third Party: Support"

    However, searching for that in Coinbase's app search yields... nothing. Great job, Coinbase.

    Okay, how do I go about reporting this to them? Looks like there's a chat option. Fine. Gonna use this post as my description of what's going on.

    #coinbase #phishing #web3 #web3isgoinggreat #cryptocurrency

  10. What's this? A phishing email that doesn't get any spelling or grammar wrong? Impressive.

    The URL included in the email has a redirect to:

    newkste66f02.s3.amazonaws.com/

    Which just has this in the HTML:

    ```
    window.location.assign("jademountains.net/s2");
    ```

    Which redirs with an appended slash:

    jademountains.net/s2/

    Which redirs to

    coinbase-v3teamapp.com/signin/

    Which isn't a legit coinbase domain -- URL registered today. Which resolves to a blank page with a single javascript payload:

    coinbase-v3teamapp.com//static

    Which appears to be a React app, which then ultimately triggers a load of this URL, which includes a list of desired OAuth scopes:

    login.coinbase.com/oauth2/auth${e.data.data.clientId}&redirect_uri=${e.data.data.redirectURI}&account=all&scope=wallet:accounts:read,wallet:accounts:update,wallet:accounts:create,wallet:accounts:delete,wallet:addresses:read,wallet:addresses:create,wallet:buys:read,wallet:buys:create,wallet:deposits:read,wallet:deposits:create,wallet:notifications:read,wallet:payment-methods:read,wallet:payment-methods:delete,wallet:payment-methods:limits,wallet:sells:read,wallet:sells:create,wallet:transactions:read,wallet:transactions:send,wallet:transactions:request,wallet:transactions:transfer,wallet:user:read,wallet:user:update,wallet:user:email,wallet:withdrawals:read,wallet:withdrawals:create,offline_access

    Which, cleaned up, is this:

    wallet:accounts:read
    wallet:accounts:update
    wallet:accounts:create
    wallet:accounts:delete
    wallet:addresses:read
    wallet:addresses:create
    wallet:buys:read
    wallet:buys:create
    wallet:deposits:read
    wallet:deposits:create
    wallet:notifications:read
    wallet:payment-methods:read
    wallet:payment-methods:delete
    wallet:payment-methods:limits
    wallet:sells:read
    wallet:sells:create
    wallet:transactions:read
    wallet:transactions:send
    wallet:transactions:request
    wallet:transactions:transfer
    wallet:user:read
    wallet:user:update
    wallet:user:email
    wallet:withdrawals:read
    wallet:withdrawals:create
    offline_access

    Which is, I'd assume, basically everything, including the ability to withdraw:

    wallet:withdrawals:read
    wallet:withdrawals:create

    Before ultimately ending up at what appears to be a coinbase-owned domain:

    login.coinbase.com/signin?clie

    ```
    $ dig -t A coinbase.com +short
    104.18.35.15
    172.64.152.241
    $ dig -t A login.coinbase.com +short
    172.64.152.241
    104.18.35.15
    ```

    The OAuth bits of the URL tell me that this must be a third-party Coinbase app. Can't find an easy way to map that client ID of

    c300bb46-07f8-4257-9760-a892c704a8b6

    back to an app page though to report it.

    What the hell. I'll bite. I don't have anything in Coinbase anymore. Let's see if I can't get the actual app and report it.

    Logging in... SMS 2-factor, Email 3rd factor.

    Aaaaaand BINGO. The third-party app is named

    "Third Party: Support"

    However, searching for that in Coinbase's app search yields... nothing. Great job, Coinbase.

    Okay, how do I go about reporting this to them? Looks like there's a chat option. Fine. Gonna use this post as my description of what's going on.

    #coinbase #phishing #web3 #web3isgoinggreat #cryptocurrency

  11. Just found this fascinating article over at the always wonderful Smart Bitches Trashy Books about a really interesting deep dive into AI narrators and library books:

    smartbitchestrashybooks.com/2024/10/ai-audiobook-narrators-in-overdrive-and-the-issue-of-library-ai-circulation-policy/

    Thanks to
    divergentrays.com/blog/posts/2024-10-27-Weekly-Wrap-Up-30 for the link!

    I can't say I'm surprised, but I think it's always helpful to see the way these things work behind the scenes and to know what to look for. I read a lot of genre fiction myself, and have been digging through the self published books for years now. A good number of them do have that smell of "for the algorithm" about them, and are always found at the bottom of the stacks, or in the free sections. Before LLMs, I believe most of these were being written by content mills for the express purpose of making money and getting clicks, so it's only logical that they would move on to AI generation instead. But with content mills, at least a real person was getting paid at some point in the process, right?

    #web3isgoinggreat #AI #AIart #LLM #noAIcontent #selfpublishing #books #amazon

  12. Please, spread the news to everyone you know that uses bluesky.

    Bluesky has added Blockchain Capital, who gave them 15 million dollars, as a board member, meaning theyre selling seats on the board for money.

    They may say they dont want anything to do with web3, but adding a web3 representative to the board of directors says otherwise.

    They also announced subscriptions for things like avatar frames or profile colors, something similar to what Discord does with Nitro.

    bsky.social/about/blog/10-24-2
    blockchaincapital.com/blog/blu

    #bluesky #twittermigration #web3isgoinggreat #mastodonmigration #blueskymigration

  13. Please, spread the news to everyone you know that uses bluesky.

    Bluesky has added Blockchain Capital, who gave them 15 million dollars, as a board member, meaning theyre selling seats on the board for money.

    They may say they dont want anything to do with web3, but adding a web3 representative to the board of directors says otherwise.

    They also announced subscriptions for things like avatar frames or profile colors, something similar to what Discord does with Nitro.

    bsky.social/about/blog/10-24-2
    blockchaincapital.com/blog/blu

    #bluesky #twittermigration #web3isgoinggreat #mastodonmigration #blueskymigration

  14. Because money

    Summary :
    The tea.xyz protocol plan to reward open source software contributors resulted in crypto enthusiasts with no intention of participating in OSS opening endless pull requests to claim ownership of prominent OSS projects. This spam was disruptive to said projects, whose (usually volunteer) maintainers had to figure out what was going on and then try to stop the spammy PRs.

    web3isgoinggreat.com/single/te

    #FOSS #Logiciels_Libres #Crypto #Spam #Web3isGoingGreat

  15. Because money

    Summary :
    The tea.xyz protocol plan to reward open source software contributors resulted in crypto enthusiasts with no intention of participating in OSS opening endless pull requests to claim ownership of prominent OSS projects. This spam was disruptive to said projects, whose (usually volunteer) maintainers had to figure out what was going on and then try to stop the spammy PRs.

    web3isgoinggreat.com/single/te

    #FOSS #Logiciels_Libres #Crypto #Spam #Web3isGoingGreat

  16. Cryptocurrency fraudster Bankman-Fried is now being sentenced, will soon find out how long he is in prison:

    theguardian.com/business/live/

    To manage expectations, the prosecutors have asked for 40-50 years while the defence asked for 6 years. (The headlines about 100 years are only a theoretical maximum, no one is actually asking for that.)

    #BankmanFried #SamBankmanFried #Web3IsGoingGreat

  17. Cryptocurrency fraudster Bankman-Fried is now being sentenced, will soon find out how long he is in prison:

    theguardian.com/business/live/

    To manage expectations, the prosecutors have asked for 40-50 years while the defence asked for 6 years. (The headlines about 100 years are only a theoretical maximum, no one is actually asking for that.)

    #BankmanFried #SamBankmanFried #Web3IsGoingGreat

  18. I've now received 3 separate emails asking me to sell my potential share of the upcoming Fluence Network cryptocurrency airdrop. This project aims at rewarding the "~110,000 developers who contributed into open source web3 repositories during last year" according to the project webpage. In order to do this "Public keys of selected Github accounts were added into a smart contract on Ethereum" which they stored in a single file hosted on AWS that their own "install" script fetches in order to generate proof of GitHub account ownership.

    So you can check any GitHub account eligibility on the Fluence website, of course, but you can also obtain the conveniently complete list of 108,615 eligible GitHub accounts to spam with your stupid cryptocurrency acquisition request. I've pulled down my email address from my public profile in the hope that it will stem the tide, but that's yet another possibly well-meaning Web3 project that ends up abused within seconds of its inception because of poorly thought-out process.

    Also I never contributed to any web3 repository, so I'm vaguely curious how they compiled this list of accounts but not that much either.

    #Web3IsGoingGreat #Web3 #Cryptocurrency

  19. @lasagne @[email protected] @finkd

    Ohh, I tried @elonmusk but they never did an avatar so probably a good bet, nah, no Elmo there on #web3isgoinggreat ... Yet.

  20. @lasagne @[email protected] @finkd

    Ohh, I tried @elonmusk but they never did an avatar so probably a good bet, nah, no Elmo there on #web3isgoinggreat ... Yet.

  21. How many people in #infosec are worried that @elonmusk is just gonna date the #Telegram or #Signal or #Discord Chief Privacy Officer for repopulating his #MarsExpidition .....

    or perhaps @finkd's
    #CryptoBucks PM is getting an eye on them....

    Perhaps they are just helping his #GFY #Web3IsGoingGreat 'kitchen sink' #PrivateEquity devalue his loan to remix the alt-riechtZ 'help build back the Berlin wall of #BlueCheckMarks ' on #Xittler as a pivot? 🤔

  22. How many people in #infosec are worried that @elonmusk is just gonna date the #Telegram or #Signal or #Discord Chief Privacy Officer for repopulating his #MarsExpidition .....

    or perhaps @finkd's
    #CryptoBucks PM is getting an eye on them....

    Perhaps they are just helping his #GFY #Web3IsGoingGreat 'kitchen sink' #PrivateEquity devalue his loan to remix the alt-riechtZ 'help build back the Berlin wall of #BlueCheckMarks ' on #Xittler as a pivot? 🤔

  23. Kryptogeld: Millionenbeute nach sechs Sekunden​ - wegen eines Copy&Paste Rundungsfehlers! Alles sowas von vertrauenswürdig! heise.de/news/Kryptogeld-Milli

  24. I knew that Bitcoin was still going strong despite the collapse of many of its siblings -- there's a lot more established "infrastructure" and money propping it up -- but I hadn't realized just how nuts the cryptosystem is, particularly in Texas.

    I suppose North America should be grateful Texas isolated its power grid.



    houstonchronicle.com/opinion/o

  25. #Bauhaus #Mannheim hat einen Datenreichtum:

    Habe ihr schon mal mit der Bauhaus Plus-Card bestellt?

    Kundendaten der Baumarktkette konnten durch einen Programmierfehler eingesehen werden – und entwickelten dann ein Eigenleben bei Bing Chat.

    Mit Kenntnis einer Bestellnummer, die sich leicht über die Produktliste des Onlineshops ermitteln lässt, konnten vorliegende Bestelldaten, die die Rechnungs- und Lieferadresse des Bestellers sowie die Zahlungsart umfassten, für die jeweiligen Personen abgerufen werden. Eine stichprobenartige Überprüfung ergab Daten, die bis in das Jahr 2021 zurückreichten. Wie lange das Datenleck existierte und wie viele Plus-Card-Kunden betroffen waren, konnte nicht ermittelt werden.

    Immerhin, schnell reagiert haben sie, sollte lobend erwähnt werden. Allerdings kommt hier der Bing Cache ins Spiel 🥳

    Mit etwas Glück könnten eure Daten noch in Microsofts AI Lösung BIng Chat gelandet sein.

    #web3isgoinggreat #privacy #datenschutz

    golem.de/news/datenleck-bestel…

  26. The newest scam on the crappy nightmare app called "Facebook" appears to be fake stores holding fake "going out of business sales."

    Holding a fake "going out of business" sale is against the law in many states, including Pennsylvania. Does Facebook care? No. Facebook doesn't give a single fk. #Web3isGoingGreat #LateStageSocialMedia

  27. Hmm... ah yes, let me just rotate my device.

    I should try my SteamDeck next to see if it has any issues.

    #NeosVR #web3isgoinggreat #VR

  28. I must have gotten 20 ads on Facebook over the last two days for this crap. This is the kind of advertiser who's now heavily using Facebook. Good job, Zuck

    #web3isgoinggreat

  29. Really high quality advertisers on Facebook these days, good job, Zuck #web3isgoinggreat

  30. @jack @molly0xfff
    Regular old ridesharing app with even less privacy and even more dubiousness around problem resolution. #web3isgoinggreat

  31. WOW!!! This is "aged like milk" on a whole 'nuther level!!!

    I was cleaning up some old emails at work and ran across this BEAUTY.

    Guys, this is really breathaking!! lol

  32. WOW!!! This is "aged like milk" on a whole 'nuther level!!!

    I was cleaning up some old emails at work and ran across this BEAUTY.

    Guys, this is really breathaking!! lol

    #CryptoDunce #Web3isGoingGreat

  33. It's mostly crime (both organized and not organized, but not easy to prove) and destroys the planet as a side effect. These companies make America worse, not better.

    Cryptocurrency shouldn't be regulated, it should be banned
    hachyderm.io/@molly0xfff/10986
    --
    #Congress #Web3IsGoingGreat

  34. It's mostly crime (both organized and not organized, but not easy to prove) and destroys the planet as a side effect. These companies make America worse, not better.

    Cryptocurrency shouldn't be regulated, it should be banned
    hachyderm.io/@molly0xfff/10986
    --
    #Congress #Web3IsGoingGreat

  35. I really want to ignore threat group activity on blockchains. That whole facet of the internet is a joke but the amount of money they're moving isn't which is why we have to keep tabs on them. At least there's web3isgoinggreat to reaffirm it's a constant downfall.
    #CyberCrime #Web3IsGoingGreat

  36. I really want to ignore threat group activity on blockchains. That whole facet of the internet is a joke but the amount of money they're moving isn't which is why we have to keep tabs on them. At least there's web3isgoinggreat to reaffirm it's a constant downfall.
    #CyberCrime #Web3IsGoingGreat

  37. Luke Dash, one of the core developers of #Bitcoin just got all his Bitcoins stolen.

    Yeah #crypto is clearly the future, and everyone should trust it ... NOT!!! Don't do crypto, kids!

    twitter.com/lukedashjr/status/

    #web3isgoinggreat

  38. Luke Dash, one of the core developers of #Bitcoin just got all his Bitcoins stolen.

    Yeah #crypto is clearly the future, and everyone should trust it ... NOT!!! Don't do crypto, kids!

    twitter.com/lukedashjr/status/

    #web3isgoinggreat

  39. did a little bit of analysis on the tax loss harvesting service for NFTs that i wrote up in @web3isgreat earlier today (indieweb.social/@web3isgreat/1).

    so far they've purchased almost 5,500 NFTs.

    the most expensive NFT to have been sent to the service was one that sold for around $12,000 in January 2022. it's #78 from the "The Crypt (Army of the Dead)" collection. the project has had basically no volume since February.

    #crypto #NFTs #web3isgoinggreat

  40. did a little bit of analysis on the tax loss harvesting service for NFTs that i wrote up in @web3isgreat earlier today (indieweb.social/@web3isgreat/1).

    so far they've purchased almost 5,500 NFTs.

    the most expensive NFT to have been sent to the service was one that sold for around $12,000 in January 2022. it's #78 from the "The Crypt (Army of the Dead)" collection. the project has had basically no volume since February.

    #crypto #NFTs #web3isgoinggreat

  41. The media feeding frenzy over SBFs incredibly inevitable downfall is a bit weird considering

    a. The media spent years uncritically talking up crypto and lionising SBF

    b. Essentially every other crypto enterprise is just as crooked as FTX was

    #crypto #ftx #sbf #sbf #web3isgoinggreat

  42. The media feeding frenzy over SBFs incredibly inevitable downfall is a bit weird considering

    a. The media spent years uncritically talking up crypto and lionising SBF

    b. Essentially every other crypto enterprise is just as crooked as FTX was

    #crypto #ftx #sbf #sbf #web3isgoinggreat