5 ms·

Sure, and then one day you sit with your laptop in a park on your company's campus and you are accidentally connected to the wrong wifi hotspot and you leak som

by roel_v 9y ago

Sure, and then one day you sit with your laptop in a park on your company's campus and you are accidentally connected to the wrong wifi hotspot and you leak some info that way. Opsec is hard. Technology can only solve so much, the weak link will always be the wet spongy tissue.

viraptor 9y ago
If you're running an operation with international political implications, you don't sit with your laptop in the park. There's "opsec is hard", and there's "you're an idiot".
- roel_v 9y ago
  Do you think these large government agencies with hundreds or thousands of employees are some sort of magical super-organizations where everything and everybody is 100% on, all the time? These are all regular people like you and me working there. We're talking about the world's most organized agencies, yet who put or leave an internet-connected webcam with a default password in front of their building; or hire someone who will copy gigabytes of data and run off with it - and fail to notice; or give their most secret and valuable spyware to an ally who then gets impatient and exposes it with some stupid mistake. This is not about being an 'idiot', this is perfectly normal behavior to happen once in a few years over hundreds or thousands of people.
  - viraptor 9y ago
    I think these are all separate cases. Yes, opsec is hard in general. There's a scale of how hard some problems are to prevent - what you listed is in various places on it. The specific case I responded to with laptop in the park while you're trying to mess with foreign governments would be at one extreme of that scale.
    - bryanrasmussen 9y ago
      they're all separate cases of people doing stupid shit while working doing this kind of stuff. The laptop in the park was an example of how someone could do stupid shit while working on this kind of stuff, it was of course an example plucked from thin air of one kind of stupid shit one could do and get caught out, not necessarily the stupid shit that actually got him caught. The point is that at least most people, even if most of the time highly competent, slip up some times and it seems this guy slipped up one time which really thinking about it starts to make me suspicious because if you slip up once in hundreds of times why not 3-7 times. why only one time. but anyway the point is intelligent most of the time, stupid once is all it takes to get caught and nearly everyone does it. And now I'm defending a Russian agent doing stuff I think sucks.
- notfromhere 9y ago
  even intelligence agents are human. how many spies were caught by doing stupid shit? For example, Rudolf Abel was caught because he paid with a fake nickel on accident.
- ajross 9y ago
  If you're writing mission critical software, you don't scribble all over memory by writing through unvalidated pointers. There's "software quality is hard", and there's "you're an idiot". What you're asking for, fundamentally, is for people not to make mistakes. You probably don't hold that opinion in your professional life (yeah, I'm assuming you're a programmer). Why here?
  - viraptor 9y ago
    There's not even remotely the same magnitude of error between those two cases in my mind. One you can miss by accident, the other you're actively doing.
jorvi 9y ago
You can prevent this by running Little Snitch and only allowing outbound traffic if you are connected to GRUfi. Hell, Little Snitch even has a mode that blocks all but the core services on your Mac. Do that combined with a router-VPN with a kill switch and a hardened browser I don’t see how you would leak your location. Edit: you could even configure Little Snitch to ask for permission for every app and domain your Mac wants to connect to. That way you would even catch yourself accidentally surfing to the wrong URL or using the wrong browser.
- roel_v 9y ago
  Yes yes yes - you're completely missing the point. The point is that it's easy to come up with some sort of contained scenario in which you can devise a perfect technical solution for a well-defined problem. But it's hard to get groups of hundreds of people to always behave perfectly according to protocol, every time, everywhere, with not a single slip-up over several years.
petegrif 9y ago
You are absolutely correct. People make mistakes. Even very well trained professionals make mistakes. Incredibly experienced skydivers die. Industrial safety is tough despite well designed processes and constant training. Tradecraft slipups happen. etc etc The weak link is the human being.

by roel_v 9y ago

viraptor 9y ago

If you're running an operation with international political implications, you don't sit with your laptop in the park. There's "opsec is hard", and there's "you're an idiot".

roel_v 9y ago
Do you think these large government agencies with hundreds or thousands of employees are some sort of magical super-organizations where everything and everybody is 100% on, all the time? These are all regular people like you and me working there. We're talking about the world's most organized agencies, yet who put or leave an internet-connected webcam with a default password in front of their building; or hire someone who will copy gigabytes of data and run off with it - and fail to notice; or give their most secret and valuable spyware to an ally who then gets impatient and exposes it with some stupid mistake. This is not about being an 'idiot', this is perfectly normal behavior to happen once in a few years over hundreds or thousands of people.
- viraptor 9y ago
  I think these are all separate cases. Yes, opsec is hard in general. There's a scale of how hard some problems are to prevent - what you listed is in various places on it. The specific case I responded to with laptop in the park while you're trying to mess with foreign governments would be at one extreme of that scale.
  - bryanrasmussen 9y ago
    they're all separate cases of people doing stupid shit while working doing this kind of stuff. The laptop in the park was an example of how someone could do stupid shit while working on this kind of stuff, it was of course an example plucked from thin air of one kind of stupid shit one could do and get caught out, not necessarily the stupid shit that actually got him caught. The point is that at least most people, even if most of the time highly competent, slip up some times and it seems this guy slipped up one time which really thinking about it starts to make me suspicious because if you slip up once in hundreds of times why not 3-7 times. why only one time. but anyway the point is intelligent most of the time, stupid once is all it takes to get caught and nearly everyone does it. And now I'm defending a Russian agent doing stuff I think sucks.
notfromhere 9y ago
even intelligence agents are human. how many spies were caught by doing stupid shit? For example, Rudolf Abel was caught because he paid with a fake nickel on accident.
ajross 9y ago
If you're writing mission critical software, you don't scribble all over memory by writing through unvalidated pointers. There's "software quality is hard", and there's "you're an idiot". What you're asking for, fundamentally, is for people not to make mistakes. You probably don't hold that opinion in your professional life (yeah, I'm assuming you're a programmer). Why here?
- viraptor 9y ago
  There's not even remotely the same magnitude of error between those two cases in my mind. One you can miss by accident, the other you're actively doing.

jorvi 9y ago

You can prevent this by running Little Snitch and only allowing outbound traffic if you are connected to GRUfi. Hell, Little Snitch even has a mode that blocks all but the core services on your Mac. Do that combined with a router-VPN with a kill switch and a hardened browser I don’t see how you would leak your location. Edit: you could even configure Little Snitch to ask for permission for every app and domain your Mac wants to connect to. That way you would even catch yourself accidentally surfing to the wrong URL or using the wrong browser.

roel_v 9y ago
Yes yes yes - you're completely missing the point. The point is that it's easy to come up with some sort of contained scenario in which you can devise a perfect technical solution for a well-defined problem. But it's hard to get groups of hundreds of people to always behave perfectly according to protocol, every time, everywhere, with not a single slip-up over several years.

petegrif 9y ago

You are absolutely correct. People make mistakes. Even very well trained professionals make mistakes. Incredibly experienced skydivers die. Industrial safety is tough despite well designed processes and constant training. Tradecraft slipups happen. etc etc The weak link is the human being.