3 ms·

I've done some travelling to risky places before (Kiev and other places) and even though the networks were hostile there, I still don't understand the point of

I've done some travelling to risky places before (Kiev and other places) and even though the networks were hostile there, I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to. They can. Air-gapping isn't going to slow them down.

iiertiosas 7y ago
Or just bribing people in “allowed” countries.
- jrockway 7y ago
  I think it would probably be costly to bribe someone in the "allowed" countries. I'm not going to risk going to prison for some small sum of money, and a large sum of money is logistically difficult to give me. People will ask questions, the scheme will probably be found out. Meanwhile, if the government can just arrest you and say "change this repository and you go free", it's essentially free.
peteretep 7y ago
> I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to Security isn’t absolute, it’s layered. The harder you make it for the adversary, the more it costs the adversary (eg: potentially burning a zero day), and the more chance there is of detection. Can Russian intelligence get into Gitlab? Probably. Are measures that make it more expensive liable to deter them? I think so.
joatmon-snoo 7y ago
As the subject of this thread also points out, there's an important factor of risk to the individual: to prevent them from getting put in a position where they can be coerced into turning over data access.
mike_d 7y ago
> They can. Air-gapping isn't going to slow them down. Two points here. First of all, failing to acheive absolute security is not a justification for ignoring best practices. Second, this isn't air gapping. It is preventing a bugged laptop from sitting in on conference calls and meetings for the next year or two until it gets aged out.

3 ms·

I've done some travelling to risky places before (Kiev and other places) and even though the networks were hostile there, I still don't understand the point of

by 3pt14159 7y ago

iiertiosas 7y ago
Or just bribing people in “allowed” countries.
- jrockway 7y ago
  I think it would probably be costly to bribe someone in the "allowed" countries. I'm not going to risk going to prison for some small sum of money, and a large sum of money is logistically difficult to give me. People will ask questions, the scheme will probably be found out. Meanwhile, if the government can just arrest you and say "change this repository and you go free", it's essentially free.
peteretep 7y ago
> I still don't understand the point of pretending that Russia et al can't get into Gitlab whenever they want to Security isn’t absolute, it’s layered. The harder you make it for the adversary, the more it costs the adversary (eg: potentially burning a zero day), and the more chance there is of detection. Can Russian intelligence get into Gitlab? Probably. Are measures that make it more expensive liable to deter them? I think so.
joatmon-snoo 7y ago
As the subject of this thread also points out, there's an important factor of risk to the individual: to prevent them from getting put in a position where they can be coerced into turning over data access.
mike_d 7y ago
> They can. Air-gapping isn't going to slow them down. Two points here. First of all, failing to acheive absolute security is not a justification for ignoring best practices. Second, this isn't air gapping. It is preventing a bugged laptop from sitting in on conference calls and meetings for the next year or two until it gets aged out.