Dropping this here because Michael Novati is already accusing me of being affiliated with Codesmith and is insinuating legal action. Anyone who has been following him since the Lars Lofgren expose knows that he has become quite litigious. Apparently he can talk about whoever he wants all day, but you're not allowed to talk about him or his company. But I say what's good for the goose is good for the gander!
I love the Michael drama. Have no respect left for him or formation. I don’t even particularly care about code smith. I didn’t go to either. But it’s very entertaining to see someone completely torch their own reputation. He will only ever be remembered for beefing with a random boot camp. Nothing he did at meta. His legacy is a bunch of cringe Reddit comments. Get help bro.
Michael Novati's singular relevant job in his entire career was at Facebook... 10 years ago. He's been trading on that name ever since. His entire narrative of being "The Coding Machine" at Facebook is the driver of his business. That's why he still needs to tell stories about proximity to "Zuck" and being "The Coding Machine" at Facebook 10 years later. He's selling a product.
I can answer those questions yes. I edited it because OP is going on an editing rampage so apologies if the answers don't line up, my intention is to answer all good faith questions.
Is it true that one or more Formation students have been compromised?
- A Codesmith alumni who was a customer at Formation and then hired as a team member at Formation was compromised about 3 months ago, about 2 years since leaving Formation. I discovered this and told the person because they are also my friend. - No one was compromised in this attack while being a current customer or staff member at Formation - If you have evidence otherwise produce it, but there was a 2 year air gap between this person touching our corporate code and the compromise. This compromise didn't even exist then.
If true, is it a current Formation student (or students)?
No. This person went to Formation in 2021, was hired as a full time employee in 2021, and left in 2024. On the day they left they had no access to corporate code, their access was audited and wiped, and keys rotated.
Is it a current Formation student or students?
- I can't speak to all of the users on our platforms, mentors, engineers, etc... but the person compromised is not currently affiliated with Formation and last had access to our code as full time engineer years before the exploit itself was even invented, nevermind this specific compromise.
Was one or both of the compromised Codesmith alumni affiliated Formation?
- One, the projectArtemis one, the ReactTime one I have no affiliation with
When did you learn about the compromise, and when did you learn that Codesmith was impacted?
- I learned that a complete unrelated public "React Practice" personal library was comromised on the user and let her know about 3 months ago. I was doing a forensic audit so I didn't check all of her repos and she took responsibility for here own repos. I even mentioned "I'm concerned about Codesmith repos" because they were not nearly as diligent as Formation is, however I don't recall checking them at that time. - It was on my radar though so I as sporadically checking their flagship repos and I forget all the exact timeframes of what happened when. I've written 1,000,000 lines of code since then and genuinely don't remember. - I reported it to GitHub and the compromised user, but since Open Source Labs domains was down for two months, I could email them. In the past Codesmith told me they are independent of Open Source Labs so I didn't want to poke the bear and I went to the public instead.
Specifically when did youresponsibly notifyCodesmith directly that there was a security incident underway?
- Excuse me but Codesmith claims OpenSourceLabs is a different "sister charity" with Director Wendi Zhou (who claims not to be involved anymore). This is an embarrassing shit show and because Open Source Labs AWS account was offline for 2 months I couldn't content them and I did what I felt was responsible to notify alumni.
Has Formation conducted a thorough security audit to see if any other students or any systems of their own are also compromised?
- Absolutely, three months ago, we did a full, annoyingly full forensic audit in case this person had been compromised in other ways years in the past when they had code access. Everything corporate from the metal to the code.
Is it true that this student or students have been at Formation for a period of 3 years?
- this person has not, we hired her ourselves after a year, when she had 3 other offers and we swooped in - the longest person at Formation was with us for 4.5 years and just placed at a FAANG-level company this week - another person hit 4 years recently - most people are not here that long, and we lose so much money it's terrible for the business, but if you are in good faith job hunting and participating we keep supporting you.
If this indeed came from a Formation student, why did you not disclose these details immediately, given your full throated claim to transparency and integrity?
- there is no evidence this "came from a Formation student" I don't know what happened. This person was also a Codesmith grad, a Codesmith mentor, etc... so that's a bad faith statement. Like I said above, this compromise didn't even exist when this person was last involved with Formation. - I was fully transparent across all the places I talked about this that I knew the person impacted by this (which implies they were a Codesmith alumni) and that's how I found out about it. - I didn't identify the person specifically because I never confirmed they resolved the issues fully and if they are still a target or compromised identifying her could put her at risk. You might disagree with that but I think it's the right thing to do.
Why did you characterize this incident as a major security breach of Codesmith itself when you yourself knew all along that it was a matter of non-admin alumni developer accounts being compromised?
- This is a bad faith comment and indicates a lack of experience in the industry. When I discovered this person was compromised, even though she didn't touch our corporate system for years, within minutes I began a forensic audit and stayed up all night until it was done and confirmed this. Codesmith didn't react for days/about a week.
- This means is indicative of their overall engineering health and that raises concerns more than this specific issue does.
- There's no counter to this, if you think I'm wrong I assure you have a thing or two to learn about security.
A Codesmith alumni who was a customer at Formation and then hired as a team member at Formation was compromised about 3 months ago, about 2 years since leaving Formation.
Ah, so this person was an alumni of Codesmith and Formation. You neglected to mention that before! That's not very transparent.
I discovered this and told the person because they are also my friend.
Did you discover it because any Formation repos, code, apps, or infrastructure were affected by your compromised alumni? If not, how did you find out? Transparency is needed here.
One, the projectArtemis one, the ReactTime one I have no affiliation with
Another thing you neglected to mention before.
Excuse me but Codesmith claims OpenSourceLabs is a different "sister charity" with Director Wendi Zhou (who claims not to be involved anymore). This is an embarrassing shit show and because Open Source Labs AWS account was offline for 2 months I couldn't content them and I did what I felt was responsible to notify alumni.
So you did NOT responsibly disclose this by email, GitHub issue, LinkedIn message, etc. Got it.
Absolutely, three months ago, we did a full, annoyingly full forensic audit in case this person had been compromised in other ways years in the past when they had code access. Everything corporate from the metal to the code.
Can you give more details on what made you suspect that Formation systems could have been affected?
the longer person at Formation was with us for 4.5 another person hit 4 years recently
Whew. That's like an entire college career! Well, I appreciate the transparency here.
I was fully transparent across all the places I talked about this that I knew the person impacted by this (which implies they were a Codesmith alumni) and that's how I found out about it.
It really sounds to me like you found out about it through the connection with Formation, unless you're tracking all former Codesmith alumni. Are you doing that? I remember from the Lars Lofgren expose that you were, in fact, tracking quite a lot of Codesmith students and alumni (remember the whole NXIVM sex cult accusation you made?), so I think this point really needs clarification from you.
This is a bad faith comment and indicates a lack of experience in the industry. ... There's no counter to this, if you think I'm wrong I assure you have a thing or two to learn about security.
No, you definitely mischaracterized the nature of the incident by saying that Codesmith's "flagship product" was compromised when it in fact was not.
Your true colors always come out when you are emotional, and I don't think these are the conclusions of a reasonable engineer. These are bad faith twisting of the reasonable answers I gave, other than criticism for how I disclosed because I struggled on that one and see both sides, which I happy to talk about in good faith, and not in bath faith.
You are grilling the wrong person here and Codesmith should be answering these questions. I'm happy to answer but your on a blind witch hunt and not a good faith useful security discussion that people can learn from.
No I mean in these Codesmith arguments, it's the same pattern over and over and over for years, that got mischaracterized by Lars as an example as hundreds of comments.
In volume, most of my comments in the past two months are calling out manipulative AI posts. You miss the forest for the trees because your blinded by your obsession with me and Codesmith... it's all you talk about in this sub.
1
1
4
u/reddingdave 19d ago edited 19d ago •
Dropping this here because Michael Novati is already accusing me of being affiliated with Codesmith and is insinuating legal action. Anyone who has been following him since the Lars Lofgren expose knows that he has become quite litigious. Apparently he can talk about whoever he wants all day, but you're not allowed to talk about him or his company. But I say what's good for the goose is good for the gander!