3 ms·

> There aren't a lot of facts to go on In fact there is a long history of evidence. The Russia defenders love to try to create uncertainty, using these same ta

> There aren't a lot of facts to go on In fact there is a long history of evidence. The Russia defenders love to try to create uncertainty, using these same talking points every time, regardless of the evidence.

Natsu 9y ago
No, there are a lot of articles. There are hardly any facts in any of them, I keep checking for that and getting disappointed. If you can find something with more facts, distill them and point me at them please. The best we ever got on a technical level was that original report from the DNC consultants where most of the IP addresses in the "signature" were Tor exit nodes and they didn't recognize an old, freeware copy of P.A.S. despite it being publicly available. We've had a lot of utterly laughable things, like the one where someone was intercepting the DNS traffic for a 3rd party marketing site weakly linked to Trump that was making queries to a Russian bank... because of some Russian spam. I can't help but note that the same people keep falling for nonsense of this level. However, feel free to link to the actual technicals of the reports if you have any. Despite the prior reports being stuff and nonsense (but mostly the latter), I remain open to changing my mind should anyone offer actual proof of some sort. Please note that I'm looking for logs, IP addresses, code and other things that could qualify as actual evidence, not so-and-so's say-so. The closest this article got to facts were various bits of speculation about people's motives, claiming that Trend Micro thinks it matches this APT (for reasons they didn't bother to cover) and links to past coverage... that also fails to answer any of the obvious questions about what we know and how we know it, for which the usual answer in the past has been variations on interviews with unnamed people, appeals to classified data not in evidence, or random "experts" giving an opinion without disclosing any of the facts used to form that opinion. In short, it's a lot of hearsay. I follow more or less this process: https://www.popehat.com/2017/01/19/how-to-read-news-like-a-search-warrant-application/ https://www.popehat.com/2017/01/19/how-to-read-news-like-a-s... Most news currently fails this test. I completely ignore all articles that fail the test as unreliable, even when I happen to agree with the conclusions. This applies to other articles as well, not just controversial things.
- Natsu 9y ago
  Just as a follow-up, I eventually found the Trend Micro report linked from an Ars Technica article. It's justification for labeling this as Fancy Bear was that they saw an email address from a free provider that they believe is linked and some cyrillic text. That's not really very much, given that the original label for this APT is already quite tenuous, given how the 'signature' from the original report consists of things like using Tor exit nodes that are quite common. Maybe there's more to it, but if so they should really put it in their reports.

Natsu 9y ago

No, there are a lot of articles. There are hardly any facts in any of them, I keep checking for that and getting disappointed. If you can find something with more facts, distill them and point me at them please. The best we ever got on a technical level was that original report from the DNC consultants where most of the IP addresses in the "signature" were Tor exit nodes and they didn't recognize an old, freeware copy of P.A.S. despite it being publicly available. We've had a lot of utterly laughable things, like the one where someone was intercepting the DNS traffic for a 3rd party marketing site weakly linked to Trump that was making queries to a Russian bank... because of some Russian spam. I can't help but note that the same people keep falling for nonsense of this level. However, feel free to link to the actual technicals of the reports if you have any. Despite the prior reports being stuff and nonsense (but mostly the latter), I remain open to changing my mind should anyone offer actual proof of some sort. Please note that I'm looking for logs, IP addresses, code and other things that could qualify as actual evidence, not so-and-so's say-so. The closest this article got to facts were various bits of speculation about people's motives, claiming that Trend Micro thinks it matches this APT (for reasons they didn't bother to cover) and links to past coverage... that also fails to answer any of the obvious questions about what we know and how we know it, for which the usual answer in the past has been variations on interviews with unnamed people, appeals to classified data not in evidence, or random "experts" giving an opinion without disclosing any of the facts used to form that opinion. In short, it's a lot of hearsay. I follow more or less this process: https://www.popehat.com/2017/01/19/how-to-read-news-like-a-search-warrant-application/ https://www.popehat.com/2017/01/19/how-to-read-news-like-a-s... Most news currently fails this test. I completely ignore all articles that fail the test as unreliable, even when I happen to agree with the conclusions. This applies to other articles as well, not just controversial things.

Natsu 9y ago
Just as a follow-up, I eventually found the Trend Micro report linked from an Ars Technica article. It's justification for labeling this as Fancy Bear was that they saw an email address from a free provider that they believe is linked and some cyrillic text. That's not really very much, given that the original label for this APT is already quite tenuous, given how the 'signature' from the original report consists of things like using Tor exit nodes that are quite common. Maybe there's more to it, but if so they should really put it in their reports.