3 ms·

There's a bunch of different measures discussed, but they all seem to remove some attack surface that we have seen exploited. Securing the routers and network

by gpm 6y ago

There's a bunch of different measures discussed, but they all seem to remove some attack surface that we have seen exploited. Securing the routers and network cables removes the means for man in the middle attacks (or at least makes them preventable with router security). Not connecting to telecos does the same (because of bgp highjacking and the like). Removing chinese apps and not storing data on Chinese servers makes decreases the amount of data that can be extracted from large portions of the population by the CCP. E.g. preventing the "who knows who" graph from leaking wholesale (even if individual nodes can still be investigated via other means). This doesn't fix all security problems, but it removes some of China's current advantages in cyberwarfare. Not putting apps in Chinese app stores and devices looks to be an outlier in that it's a form of sanction (in response to human rights abuses) rather than a defensive measure.

matthewdgreen 6y ago
Securing routers and network cables is basic stuff that we should be doing anyway (and probably are, at a classified level.) You don't need to balkanize the net in order to do those things. Removing "Chinese apps" just means that different Candy Crush clones will be collecting that data, either directly or through their advertising networks. Or it means the Chinese companies who need to collect data will collect it through data breaches. The best thing you can say is that this puts a speed bump in front of attackers, but since speed bumps aren't a security measure the reality is that it won't do anything.
luckylion 6y ago
> This doesn't fix all security problems, but it removes some of China's current advantages in cyberwarfare. How? It makes attacks slightly more expensive (because you need to use infrastructure in a "clean" country), but it doesn't stop anyone that's dedicated and has money to spend. Want your spy-app on the app store? Don't register your company in China, just do it in the US. Voila, you're "clean."
- gpm 6y ago
  Building something like tiktok covertly is orders of magnitude harder than building it openly in China.
  - luckylion 6y ago
    Why? Copy cats are normal, everybody copies things that are successful in other countries. How do you assure that the company that creates a new app "out of the blue" isn't secretly funded by China? Require a background check and federal approval before an app can be downloaded more than 1000 times?
    - gpm 6y ago
      You can't move around the many millions of dollars in advertising without the government being aware of it. Good old fashioned investigative work and arrest of anyone knowingly contributing to wirefraud is sufficient to stop clandestine apps from growing to the size of tiktok. Sort of like how the CFO of Huawei is currently in jail. Creating orwellian straw man arguments is not a productive method of conversation. Please stop.
      - luckylion 6y ago
        > You can't move around the many millions of dollars in advertising without the government being aware of it. Why would you need to? I don't understand the point you're making. It's not about the money, it's about data, right? Presumably the Chinese aren't using Tik Tok to fund their government, they're happy to spend money on data collection. From the outside, you can't tell whether a company is collecting user data to give them to the Chinese intelligence service or just to engage in "good old American surveillance capitalism". That these kinds of operations can collect data and fund themselves is just the cherry on top. My point is that if "location of development" team and "immediate source of funding" are the criteria, you might keep the average Chinese developer out that just wants to release his hobby app. But you're not keeping out anyone that's dedicated, has money to spend and can just do it in plain sight, because the actual acts are not the criteria you look at, because they're identical to the things your companies do (which they obviously don't want to stop from collecting data). If the initiative was for simply protecting companies and individuals from tracking and spying, I'd be on board and I could easily see how that might have some success. But it's not, and short of forcibly removing anyone with Chinese heritage from the US and doing lie detector test on everyone else to make sure they're not secretly working for China, there's no way to keep anyone safe from Chinese data collection invasive anti-privacy companies while not interfering with the regular invasive anti-privacy companies. Well, maybe by looking at growth rate and use of dark patterns, the Chinese agents might fear being uncovered and won't go all out with the abuse... > Creating orwellian straw man arguments is not a productive method of conversation. Please stop. Not everybody is a Chinese agent. "We will build a wall, it'll be great, nobody will be able to come through, and China will pay for it" just doesn't sound like a good plan to me.
adsjhdashkj 6y ago
What i don't get is why we should care about this (care as in, advocate for). MITM is a great argument for distrusting the everyone in the middle, not trying to increase trust in the middle man - no? This just feels like an attempt to control who is the middleman spying on data, not actually securing Americans data. Which makes sense, coming from the government and whatnot - but i'm just trying to make sense of if there's an actual reason i should like this "Clean Network" (which is to say, my comment is an honest question, not an attack on the proposal). Perhaps i'm just biased because of my (pet) passion for distributed systems. I don't trust any MITM, so i think i struggle to understand the concern for _who_ is in the middle. I'd be far more interested in this type of pitch if it came with heavy support for encryption, distribution, etc.
- gpm 6y ago
  Look at the "great cannon" attack for an example of why securing the middle is important. Secure software obviously shouldn't trust the middle, but the middle being compromised means that insecure software can do orders of magnitude more damage. Moreover the middle can just shut down. Especially for things like embassies it's not a good idea to give the adversaries an easy off switch. I agree that "encrypt all the things" would be a very nice addition.

by gpm 6y ago

matthewdgreen 6y ago

Securing routers and network cables is basic stuff that we should be doing anyway (and probably are, at a classified level.) You don't need to balkanize the net in order to do those things. Removing "Chinese apps" just means that different Candy Crush clones will be collecting that data, either directly or through their advertising networks. Or it means the Chinese companies who need to collect data will collect it through data breaches. The best thing you can say is that this puts a speed bump in front of attackers, but since speed bumps aren't a security measure the reality is that it won't do anything.

luckylion 6y ago

> This doesn't fix all security problems, but it removes some of China's current advantages in cyberwarfare. How? It makes attacks slightly more expensive (because you need to use infrastructure in a "clean" country), but it doesn't stop anyone that's dedicated and has money to spend. Want your spy-app on the app store? Don't register your company in China, just do it in the US. Voila, you're "clean."

gpm 6y ago
Building something like tiktok covertly is orders of magnitude harder than building it openly in China.
- luckylion 6y ago
  Why? Copy cats are normal, everybody copies things that are successful in other countries. How do you assure that the company that creates a new app "out of the blue" isn't secretly funded by China? Require a background check and federal approval before an app can be downloaded more than 1000 times?
  - gpm 6y ago
    You can't move around the many millions of dollars in advertising without the government being aware of it. Good old fashioned investigative work and arrest of anyone knowingly contributing to wirefraud is sufficient to stop clandestine apps from growing to the size of tiktok. Sort of like how the CFO of Huawei is currently in jail. Creating orwellian straw man arguments is not a productive method of conversation. Please stop.
    - luckylion 6y ago
      > You can't move around the many millions of dollars in advertising without the government being aware of it. Why would you need to? I don't understand the point you're making. It's not about the money, it's about data, right? Presumably the Chinese aren't using Tik Tok to fund their government, they're happy to spend money on data collection. From the outside, you can't tell whether a company is collecting user data to give them to the Chinese intelligence service or just to engage in "good old American surveillance capitalism". That these kinds of operations can collect data and fund themselves is just the cherry on top. My point is that if "location of development" team and "immediate source of funding" are the criteria, you might keep the average Chinese developer out that just wants to release his hobby app. But you're not keeping out anyone that's dedicated, has money to spend and can just do it in plain sight, because the actual acts are not the criteria you look at, because they're identical to the things your companies do (which they obviously don't want to stop from collecting data). If the initiative was for simply protecting companies and individuals from tracking and spying, I'd be on board and I could easily see how that might have some success. But it's not, and short of forcibly removing anyone with Chinese heritage from the US and doing lie detector test on everyone else to make sure they're not secretly working for China, there's no way to keep anyone safe from Chinese data collection invasive anti-privacy companies while not interfering with the regular invasive anti-privacy companies. Well, maybe by looking at growth rate and use of dark patterns, the Chinese agents might fear being uncovered and won't go all out with the abuse... > Creating orwellian straw man arguments is not a productive method of conversation. Please stop. Not everybody is a Chinese agent. "We will build a wall, it'll be great, nobody will be able to come through, and China will pay for it" just doesn't sound like a good plan to me.

adsjhdashkj 6y ago

What i don't get is why we should care about this (care as in, advocate for). MITM is a great argument for distrusting the everyone in the middle, not trying to increase trust in the middle man - no? This just feels like an attempt to control who is the middleman spying on data, not actually securing Americans data. Which makes sense, coming from the government and whatnot - but i'm just trying to make sense of if there's an actual reason i should like this "Clean Network" (which is to say, my comment is an honest question, not an attack on the proposal). Perhaps i'm just biased because of my (pet) passion for distributed systems. I don't trust any MITM, so i think i struggle to understand the concern for _who_ is in the middle. I'd be far more interested in this type of pitch if it came with heavy support for encryption, distribution, etc.

gpm 6y ago
Look at the "great cannon" attack for an example of why securing the middle is important. Secure software obviously shouldn't trust the middle, but the middle being compromised means that insecure software can do orders of magnitude more damage. Moreover the middle can just shut down. Especially for things like embassies it's not a good idea to give the adversaries an easy off switch. I agree that "encrypt all the things" would be a very nice addition.