> When it turned out that they were correct, I knew it was not a lucky guess. And when did that happen? You do realize that the US DoJ charging somebody still

> When it turned out that they were correct, I knew it was not a lucky guess. And when did that happen? You do realize that the US DoJ charging somebody still isn't "evidence"? Just like claims that some NK agents coded something are mostly based on code heuristics and usually nothing else. > Attribution isn't simply that the bad packets came from a Chinese IP address. Where did I ever claim that? It's the whole reason why I pointed out what I did. Even your linked "rant" agrees that much: > Attribution is not done with single pieces of evidence or a smoking gun it is done as analysis on complex data sets most of which is not even technical "most of which is not even technical" Just because you are clustering together a bunch of assumptions still doesn't make them any more than assumptions. Just like companies working in the sector have a vested interest in making it look like they are more certain than they actually are because nobody pays them for "maybes", people pay them with the expectation of getting solid answers. In that context, it does not really help to harp on about "MOs" and how other security firms totally agreed with some attribution, they are all just wild-guessing based on what they expect the opposition to use and what fits their "MO". Assumptions which are extremely easy to exploit for anybody willing to go the distance.