Sven Slootweg @joepie91@pixie.town

The e-mail purports to be from a supplier, more specifically a contractor; it has all the right business speak that a contractor might actually use when trying to gently remind you of an unpaid invoice.

The "end of fiscal year" adds further pressure; it sets a deadline for the payment of the invoice, and crucially makes that deadline something that is imposed by a third party; that way, the scammer discourages attempts to argue about the payment term and makes faster payments happen.

Perhaps you *do* reply, though, to inquire about the line items, despite your "colleague"s approval - the e-mail will go to an e-mail that's *wrong*, but not obviously so!

A lot of companies legitimately use Sendcloud for their internal e-mail affairs, and so it going through a Sendcloud address is a credible thing. This domain, sendcloud-management.com, is probably not actually owned by Sendcloud, but it will *appear* to be to a hurried accounting employee trying to keep a supplier happy!

This is an excellently-written attempt. First of all, the headers. The subject line is crucial here - "Overdue since January" puts on the pressure, trying to make the reader panic, believing that they've somehow overlooked an invoice for months. This makes it likely for them to overlook small things that aren't quite right.

The sender, for example; it's worth noting that the person named here, Kris Marszalek, *does not exist*. It's a randomly generated name! This takes advantage of the fact that in most companies, most departments have *no idea* who actually works there, and will just assume "oh, that must be the new hire".

The e-mail address for both the From and Reply-To headers may be wrong, but the name (which in some e-mail clients is the only thing that shows!) explicitly includes "via cryto.net" (my domain), making it look like it came from someone inside of the "company".

This is important for the scam; having it be forwarded by someone internal, or at least appearing that way, serves as an implicit 'approval'; it will lead the reader to assume that "oh, someone else already checked this and concluded it's legit".

Ever wondered how those corporate invoice scams work, where companies are tricked into paying bullshit invoices for services they've never purchased? Well, I just received one of those, so let's look at it!

Watching the Federated feed and looking up unfamiliar terms is like a 50/50 split of "oh huh, interesting topic" versus "oh god I am instantly exhausted just from reading what this is about"

And like, we're talking "literally was one of the main presenters of a fascist TV broadcaster and runs a crowdfunding platform that all the fascists use" here. Their bigotry is not exactly a secret.

So it looks like the Dutch Pirate Party still harbours right-wing bigots (Ahmed Aarad, in this case), or at least still tolerates their involvement.

This sort of shit is why I can't take the Pirate Party seriously here.

Time for the periodic "how are ESM-only modules on npm doing" update:

Looked at some arbitrarily selected popular sindresorhus modules (delay, p-event), and >90% of installs continues to be of (now at least 4 years old) CommonJS versions.

Yeah, I don't think this qualifies as a success for ESM.

#NodeJS #npm

(And this is not even going into the governance issues which somehow always seem to get left out from the security discussion, even though that is *absolutely* a security-relevant factor.)

The thing with "just use Signal" is that it isn't actually suitable for larger (public) rooms, and so isn't a wholesale replacement for other messenger and chat platforms.

Like, sure, re-encrypting the message for every individual recipient, which AFAIK is what Signal does, is easier to implement right than having a shared room key. But it also hard-caps how many people you can plausibly be messaging at once.

Please boost for reach!

A friend of mine (currently based in NL) is looking for a remote job. They're looking for something related to web development, or maintenance of legacy codebases (web or otherwise).

They have experience with web/software development (Java, JS, assorted other web things), as well as reverse-engineering Java software, but no employment experience yet. Also a few years of basic NixOS experience.

They can pick up and learn new things very quickly, but they do need a work environment that is friendly to queer neurodivergent folks.

If you have a suitable job available (or something that's close enough - they're flexible!), please send me either a DM on here, or an e-mail at admin@cryto.net. I'll get you in touch with them.

#Java #JavaScript #NixOS #GetFediHired #FediHired #job #jobs

It baffles me how the local hardware always manages to not have the thing I need. Absolutely terrible stock management.

Like, how do you run a hardware store in a middle-class neighbourhood, in the middle of summer, and *not* carry some sort of airco-safe cleaning agent?

And it's not like I won't be able to find it elsewhere, it's not a *problem*. I just don't understand how they get things like this so consistently wrong, because I bet they're leaving a lot of money on the table.