3 ms·

> Why? Occam's razor? If the majority of large, coordinated attacks and malware come from those countries it seems reasonable to suspect them initially, doesn'

> Why? Occam's razor? If the majority of large, coordinated attacks and malware come from those countries it seems reasonable to suspect them initially, doesn't it? He said they were "guesses". He straight up told you he was speculating. That's not xenophobic, that's statistical probability. > Even if there's a good chance it is them, should we not believe in innocent until proven guilty? Yes, but if no speculation is allowed until after a conviction then how would anyone ever be investigated? We would never be able to accuse anyone of anything!

tptacek 9y ago
He doesn't look silly because he guessed at a state-level attribution --- state-level attacks certainly happen. He looks silly because the attacks he chose to attribute to state actors were in fact being conducted by a small number of teenaged Minecraft players.
freeflight 9y ago
> Occam's razor? If the majority of large, coordinated attacks and malware come from those countries it seems reasonable to suspect them initially, doesn't it? Not really, just because attacks come from a certain country domain does not mean that said countries government is sponsoring said attacks. Even the CIA/NSA use hijacked foreign servers for their operations, that's why attribution of this stuff is so difficult. I'd also be interested in how you define "large and coordinated attacks" because if you track by something like Norse Attack Map [0] then your Occam's Razor would suddenly point at the US, at least right now. > Yes, but if no speculation is allowed until after a conviction then how would anyone ever be investigated? We would never be able to accuse anyone of anything! There's a difference between "speculation" and flat out misrepresenting the probabilities. At this point, it should be pretty clear, especially to any expert in the field, that the Internet is a massive force multiplier and the regular rules of "You need big influence to have big impact" have pretty much never applied to it. People need to account for that in their attempts at attribution instead of going the lazy route of blaming "The axis of evil" for it, which this lazy China/Russia/NK attribution basically boils down to. [0] http://map.norsecorp.com/#/ http://map.norsecorp.com/#/

tptacek 9y ago

He doesn't look silly because he guessed at a state-level attribution --- state-level attacks certainly happen. He looks silly because the attacks he chose to attribute to state actors were in fact being conducted by a small number of teenaged Minecraft players.

freeflight 9y ago

> Occam's razor? If the majority of large, coordinated attacks and malware come from those countries it seems reasonable to suspect them initially, doesn't it? Not really, just because attacks come from a certain country domain does not mean that said countries government is sponsoring said attacks. Even the CIA/NSA use hijacked foreign servers for their operations, that's why attribution of this stuff is so difficult. I'd also be interested in how you define "large and coordinated attacks" because if you track by something like Norse Attack Map [0] then your Occam's Razor would suddenly point at the US, at least right now. > Yes, but if no speculation is allowed until after a conviction then how would anyone ever be investigated? We would never be able to accuse anyone of anything! There's a difference between "speculation" and flat out misrepresenting the probabilities. At this point, it should be pretty clear, especially to any expert in the field, that the Internet is a massive force multiplier and the regular rules of "You need big influence to have big impact" have pretty much never applied to it. People need to account for that in their attempts at attribution instead of going the lazy route of blaming "The axis of evil" for it, which this lazy China/Russia/NK attribution basically boils down to. [0] http://map.norsecorp.com/#/ http://map.norsecorp.com/#/