12 ms·
Despite the clear slant in this article to associate this with more malicious goals... This is an ENTIRELY reasonable request. The US has shown time and time a
by horsawlarway 9y ago
Despite the clear slant in this article to associate this with more malicious goals... This is an ENTIRELY reasonable request.
The US has shown time and time again that it has absolutely ZERO morals with regards to monitoring/spying/breaking security products at whim, when it suits us, and often even when it's a REALLY bad fucking idea and everybody knows it.
- coldcode 9y agoAnd the Russians clearly don't have a desire to hack US systems, which of course is much easier if you can see the source code. The alternative of course is build your own products and don't buy anything from the US.
- deleted 9y ago[deleted]
- justinclift 9y agoFor a lot of software, Open Source solutions might be a workable alternative. There's not fantastic "go so" solutions in every product category though. :/ Though, if enough US companies do decide not to do business with Russian, it might kickstart the filling-in of some the holes.
- origami777 9y agoIt may be reasonable, but it's not a good idea. We shouldn't trust Russsians, and they shouldn't trust us. I'd rather the US companies be forced not to sell if those are the terms. It exposes US companies even more than they are. The Russians should find another product if they aren't happy with it.
- mfoy_ 9y agoWhy with the "Us vs. Them" mentality?
- ceejayoz 9y agoBecause when dealing with nation states, it usually is "Us vs. Them" to at least some extent, even between stalwart allies?
- jbooth 9y agoBecause there's been a very recent and very public hacking scandal that was "them vs us"?
- philliphaydon 9y agoThis one with no evidence?
- jbooth 9y agoEvidence is downthread. CIA, FBI and NSA all concur, they all put out unclassified statements with their conclusions, although they obviously kept much of their supporting evidence classified.
- 1001101 9y agoSo, in other words, "trust us."
- deleted 9y ago[deleted]
- baakss 9y ago>although they obviously kept much of their supporting evidence classified. Was anything not classified? I have trust issues stemming from an unnecessary war based on false premises when I was a child. Most of my hesitation stems from a lack of information about it. "Russians hacked Podesta's emails and released them to Wikileaks." "Russians hacked voting machines." Those are very targeted statements, and I'd feel better about the whole thing if more questions were answered. Have the hackers successfully been linked to the Russian Government? How? How long has this been going on? Since before this election cycle? If so, why is it only now an issue worthy of public attention? Have other Government entities, China, North Korea, etc, done the same? Have we seen similar attacks from inside the US?
- Angostura 9y ago> We shouldn't trust Russsians, and they shouldn't trust us. The problem at the moment is that 'we' can't necessarily trust 'ourselves'. Paradoxically, having the Russians audit may make our products more trustworthy for our own use. See also Open Source.
- Paul-ish 9y agoThese companies could sell a product in Russia that is different than the one they sell in the US. Audits by Russia don't mean much unless everyone gets the same binaries.
- AnimalMuppet 9y agoOnly if they tell us what they find.
- CaptSpify 9y agoThe identity of the requester is orthogonal to the issue. Anyone should be able to request the source code. It doesn't matter if it's someone we trust or not.
- origami777 9y agoI could get on board with that if that's the way it worked. Here's hoping to that becoming the reality!
- 1001101 9y agoI'm not sure the shareholders of those companies would agree with you. They may find another product - I can't imagine there isn't an incentive to seed a competitor to US companies in Russian jurisdiction. Russia has the capital and talent to do it, and I can't imagine the will is that far off.
- origami777 9y agoAt a certain point it becomes a national security risk. And we have to choose, money or security. Until our overall cybersecuirty improves I vote against the profit incentive. And I say we don't leave that decision to shareholders because they don't act with our nations best interest in mind all the time.
- Razengan 9y ago> We shouldn't trust Russsians, and they shouldn't trust us. WHAT will it take to end this tiresome, counter-productive, primitive tribalism, really?
- AnimalMuppet 9y agoHumans becoming trustworthy? In other words, you have to fix human nature.
- Razengan 9y agoMost of "human nature" is taught and learned. If you think "untrustworthiness" is part of our fundamental animal instincts, then just look at how most cultures have managed to repress one of the most basic animal instincts – sex – through indoctrination. Why can't the same be done for violence and maliciousness? Check out the Green Sky Trilogy (aka Below The Root) books, which depict a world where pacifism has been more or less achieved, through teaching children to abhor violence the same way our world does for sex and stuff. [0] https://en.wikipedia.org/wiki/Green_Sky_Trilogy https://en.wikipedia.org/wiki/Green_Sky_Trilogy
- yellowapple 9y agoIt's a good idea, but too limited in scope. Everyone should have the ability to inspect the source code of the software they use. At the very least, government-used software should be accompanied with source code for potential independent audit. Transparency is a dependency of trust.
- fweespeech 9y ago> The US has shown time and time again that it has absolutely ZERO morals with regards to monitoring/spying/breaking security products at whim, when it suits us, and often even when it's a REALLY bad fucking idea and everybody knows it. > Despite the clear slant in this article to associate this with more malicious goals... This is an ENTIRELY reasonable request. So does Russia and China. And given the fact Russia launched a massive cyber attack against the voting system and the DNC, the purpose of the request is certainly offensive in nature regardless of the excuses made.
- pabloski 9y ago> And given the fact Russia launched a massive cyber attack against the voting system and the DNC Sorry but this is pure speculation ( or fake news if you like the term ) by CNN, MSN and WaPo. Show the proof if you have any.
- jbooth 9y agohttp://abcnews.go.com/US/russian-hackers-targeted-half-states-voter-registration-systems/story?id=42435822 http://abcnews.go.com/US/russian-hackers-targeted-half-state... "There's no doubt that some bad actors have been poking around," FBI Director James Comey told lawmakers Wednesday, without offering any more specifics. He acknowledged there have been “some attempted intrusions at voter registration databases” since August, when the FBI issued a bulletin to state governments warning that hackers had infiltrated the Illinois State Board of Elections and tried to breach election systems in Arizona.
- maxerickson 9y agoYou have the speculators wrong, it's the assessment of the US intelligence community: https://www.dni.gov/files/documents/ICA_2017_01.pdf https://www.dni.gov/files/documents/ICA_2017_01.pdf
- fweespeech 9y ago> Sorry but this is pure speculation ( or fake news if you like the term ) by CNN, MSN and WaPo. Show the proof if you have any. Are you kidding me? This has been known for months and is in declassified DNI reports. https://www.dni.gov/files/documents/ICA_2017_01.pdf https://www.dni.gov/files/documents/ICA_2017_01.pdf > Cyber Espionage Against US Political Organizations. > The General Staff Main Intelligence Directorate (GRU)probably began cyber operations aimed at the US election by March 2016. We assess that the GRU operations resulted in the compromise of the personal e-mail accounts of Democratic Party officials and political figures. By May, the GRU had exfiltrated large volumes of data from the DNC. > Russia’s effort to influence the 2016 US presidential election represented a significant escalation in directness, level of activity, and scope of effort compared to previous operations aimed at US elections. We assess the 2016 influence campaign reflected the Kremlin’s recognition of the worldwide effects that mass disclosures of US Government and other private data such as those conducted by WikiLeaks and others have achieved in recent years, and their understanding of the value of orchestrating such disclosures to maximize the impact of compromising information. > We assess Moscow will apply lessons learned from its campaign aimed at the US presidential election to future influence efforts in the United States and worldwide, including against US allies and their election processes. We assess the Russian intelligence services would have seen their election influence campaign as at least a qualified success because of their perceived ability to impact public discussion. > Russian Cyber Intrusions Into State and Local Electoral Boards.Russian intelligence accessed elements of multiple state or local electoral boards. Since early 2014, Russian intelligence has researched US electoral processes and related technology and equipment. > Public Disclosures of Russian Collected Data. > We assess with high confidence that the GRU used > the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release US victim data obtained in > cyber operations publicly and in exclusives to media outlets. > Content that we assess was taken from e-mail accounts targeted by the GRU in March 2016 appeared on DCLeaks.com starting in June Btw this is the GRU: https://en.wikipedia.org/wiki/Main_Intelligence_Directorate https://en.wikipedia.org/wiki/Main_Intelligence_Directorate
- javabean22 9y agoYeah, let's just completely ignore WHO is making that request.
- asimpletune 9y agoI don't know if this has been said already, but to me the hazard is that it makes it ok for any country to make demands on software creators. I think it's a dangerous precedent. Really, all software should be publicaly reviewable or it should be the sole choice of the creator.
- kobeya 9y agoYou can always not comply and then not sell your product in Russia. I don't see what the problem is.
- mc32 9y ago"Western" does not equal US. They are requesting source code from products originating from any country not equal to Russia, essentially. So apparently they only trust their own morals, if those.
- Demiurge 9y agoDoes the concept of security need to be connected to morality?
- mc32 9y agoIn an ideal world, yes. The OP injected morality in a sphere where it's usually not a primary concern. In an ideal world, the FBs and GOOGs would not profit off of user information, for example, but we do not live in that world so we kind of accept this quid pro quo.
- nradov 9y agoThe request is pointless for that purpose. Unless a government is using the source code to create their own trusted builds using an environment under their control then there is no guarantee that a particular set of source code has any bearing on the compiled product image.
- gozur88 9y agoGovernments are not moral. It's not really even a concept that applies. And to single the US out for this kind of stuff is kind of silly. Every country with the means to do so spies on other countries. http://www.spiegel.de/international/germany/german-intelligence-also-snooped-on-white-house-a-1153592.html http://www.spiegel.de/international/germany/german-intellige...
- Cyph0n 9y agoDuring a visit to Cisco's product security R&D division, I was told that Cisco already has a system in place for customers who want to check for backdoors. Firstly, they provide customers with all internal documentation on every single device, component, and software. Secondly, if the customer is still sceptical, they invite a team to Cisco HQ. They provide the team with a closed-room environment containing all source code (including HDL) for inspection. The customer can also bring their own devices to test the outputs against that of the reference device they are inspecting. So, in the case of Cisco, I'm not sure why this is news, since this system has been in place since the Snowden leak.
- jb613 9y agoOne has to wonder who the customers this is setup to appease. If something is later found, corporate customers have litigation options - so more likely this is for nation-states.
- Cyph0n 9y agoWell, even for corporate customers, litigation will not wind back the clock and erase the compromised data the [insert 3 letter agency] already got ahold of.
- cosinetau 9y agoAll that is true, but the same is true of the eastern bloc, and they laughed at the thought for the same request. Kaspersky comes to mind.
- sliverstorm 9y agoIt's reasonable of them to be suspicious of our software and want to review it. It's reasonable of us to be suspicious of ulterior motives. Modern day mexican standoff.
- Spooky23 9y ago...And you've largely been made aware of these things (and not similar things being done by the FSB) because Russian affiliated individuals have told you so. The affairs of state are never moral.