Hacker News Reader

Comment by davb | Hacker News Reader

I once read a theory that poor grammar, particularly with 419 scams, acts as a sort of gullibility filter where only the most susceptible targets will respond.

View on HN

I doubt it in this case. It sounds like they had a browser zero-day, and could potentially steal cryptocurrencies from people they were targeting. You don't particularly care how gullible someone is; if you get your zero-day to successfully work on them and steal all their Bitcoin, there's nothing they can do about it.

I think the default assumption is the correct one here; the attacker(s) are a solo or small group of anonymous non-native English speakers, and the risk of getting another person in on it who is a native English speaker wasn't worth it. The smaller your criminal conspiracy, the better.

You may be overestimating the writing ability of native English speakers.

The kind of mistakes a non-native English speaker makes tend to be different than ones an uneducated native speaker does.

I think that lack of an article 'the' is typical of native speakers of Slavic languages?

It is. It took my father ~20 years of working in an English-speaking country to be consistent with his usage of that article.

Slavs aren't the only ones though! Romance languages, while not completely lacking articles like Slavic ones, have slightly different requirements for articles. (They tend to use them more for abstract concepts, eg. "the reality" when we would say "reality", or "the <noun>(s)" for describing general behavior/attributes of that noun -- this difference may make speakers over-correct by using articles less in English)

Certain nouns are "inherently definite" -- names of people or places, for example, or abstractions or things which are inherently unique. Languages which mark definiteness often differ as to whether these inherently definite nouns, or which ones of them, should be marked as such. English generally treats them like proper names -- no article, definite or indefinite. Romance languages more often require the definite article. These are just two different ways of indicating the same underlying category.

Agreed. The best example of this for me is nextdoor. The spelling and grammar for most of the posts are terrible and the posters are predominantly white and over 50.

You're right that most native English speakers don't have anywhere near immaculate grammar. However, the grammar errors that native speakers make are generally quite different from those that non-native speakers make.

If you're going to involve someone specifically for the purpose of writing English, then obviously you'd pick someone who's good at it. It's not a native/non-native distinction so much as it is "good at writing in English" vs not.

In this case though, since the zero day runs without consuming the attacker's time, what is to be gained by filtering out less-gullible people? If it's automated, why not cast as wide a net as possible?

Fear of retribution/consequences?

Danger of discovery, perhaps? Every person who doesn’t end up judging the prize gets suspicious.

Yup, it was a Microsoft Research paper IIRC. That's more applicable to scams that cast a wide net to avoid investing resources on savvier targets in the second, more labor-intensive phase. I don't think it would be too relevant to spear-phishing like this case where the resources are already invested in step 1.

https://www.microsoft.com/en-us/research/publication/why-do-...

Here is the paper

Thank you!

When you're trying to trick people into sending money orders over seas that makes sense but not really when you're trying to get people to click a link that exploits a zero day to install malware.

Reply on news.ycombinator.com