4 ms·

The author is the IT security person for the Linux Foundation, who's activities include distributing the Linux kernel via kernel.org. They represent a particula

The author is the IT security person for the Linux Foundation, who's activities include distributing the Linux kernel via kernel.org. They represent a particularly juicy target for nation-state actors, and have been targeted with reasonably advanced attacks before. In 2015 the author published a checklist for laptop security, this is just an extension of that, teaching people (and LF employees) how to comply with their policies and China's. Are they likely to be hassled at the border? No. But if there's a way to make all parties happy, might as well document it.

est 9y ago
LMAO. Sounds like Redhat couldn't even dare setup a R&D center in China. Seriously if you frequent kernel mail lists you can see tons of Chinese participating in OOS.
alecco 9y ago
If I were him I would go with a burner laptop and wouldn't take with me any digital credentials.
- mricon 9y ago
  That's the TL;DR of the article. ;)
nickpsecurity 9y ago
"who's activities include distributing the Linux kernel via kernel.org. They represent a particularly juicy target for nation-state actors" If they really cared, they wouldn't host it on Linux. It would be OpenBSD or something with every software measure possible on read-only storage that admin physically replaces. That's just to start with. It's good that the author is taking measures but it gets amusing how much risk they keep on distribution side when you bring up nation-states going after them. Most big ones have 0-days for Linux systems anyway. They just use them in a targeted fashion to get more ROI from them. China can probably hit anyone working for Linux Foundation if they wanted to outside some really, paranoid setups that might exist. They just don't since they don't care about them. They're 100% unimportant to Chinese intelligence. What is important is the source code of the kernel and privileged software which are freely available. If anything, letting Linux development and distribution continue is a good thing for Chinese intelligence since developers add features (and vulnerabilities) more than do code audit on a project whose source is available to the black hats. Makes Chinese spies' jobs so much easier. :)

est 9y ago

LMAO. Sounds like Redhat couldn't even dare setup a R&D center in China. Seriously if you frequent kernel mail lists you can see tons of Chinese participating in OOS.

alecco 9y ago

If I were him I would go with a burner laptop and wouldn't take with me any digital credentials.

mricon 9y ago
That's the TL;DR of the article. ;)

nickpsecurity 9y ago

"who's activities include distributing the Linux kernel via kernel.org. They represent a particularly juicy target for nation-state actors" If they really cared, they wouldn't host it on Linux. It would be OpenBSD or something with every software measure possible on read-only storage that admin physically replaces. That's just to start with. It's good that the author is taking measures but it gets amusing how much risk they keep on distribution side when you bring up nation-states going after them. Most big ones have 0-days for Linux systems anyway. They just use them in a targeted fashion to get more ROI from them. China can probably hit anyone working for Linux Foundation if they wanted to outside some really, paranoid setups that might exist. They just don't since they don't care about them. They're 100% unimportant to Chinese intelligence. What is important is the source code of the kernel and privileged software which are freely available. If anything, letting Linux development and distribution continue is a good thing for Chinese intelligence since developers add features (and vulnerabilities) more than do code audit on a project whose source is available to the black hats. Makes Chinese spies' jobs so much easier. :)