5 ms·

This really comes off as a hastily prepared political dig against China, when there are in addition so many other actors and countries trying to take advantage

This really comes off as a hastily prepared political dig against China, when there are in addition so many other actors and countries trying to take advantage of poor security. The JPEGed giant logo at the top doesn't help... Other observations: -- "Remove untrusted applications from US mobile app stores": so, this would call for even tighter control by Apple, Google, over its app distribution and monopolies? -- Clean Apps: "Prevent untrusted PRC OEMs from installing trusted apps on their apps store... should remove apps to ensure they are not partnering with a human rights abuser." Umm, seriously, we're going to open this can of worms? Edit to add a last thought: I have yet to understand or read a coherent description about how we do not have the technical ability to protect against eavesdropping/etc regardless of who owns the physical hardware. Why is CCP-owned infrastructure uniquely susceptible to this? If we can't protect our transmissions with encryption, secure data storage techniques, what does it matter that the equipment is supplied by China? What unusual attack do they get access to by owning or manufacturing the equipment?

gpm 6y ago
> so, this would call for even tighter control by Apple, Google, over its app distribution and monopolies? I think it does the opposite. It says "if you're going to vouch for software, really vouch for it". Not "only let users install software you can vouch for". It means that non-app store distribution becomes more of a thing, not less.
apazzolini 6y ago
> The JPEGed giant logo It's almost like they ran it through jpegify.me on purpose as a joke, but really it's just another sign of the US's government technical incompetence.
- 24gttghh 6y ago
  "CleanNetwork_NewCleans-300x169.jpg" 300x169, blown up to at least double that size.
- sjs382 6y ago
  The site uses WordPress and the post author decided to include a thumbnail, scaled up to regular size, rather than using the original: https://www.state.gov/wp-content/uploads/2020/08/CleanNetwork_NewCleans.jpg https://www.state.gov/wp-content/uploads/2020/08/CleanNetwor...
  - munificent 6y ago
    Jesus fucking Christ. I remember when the US government wasn't a complete laughingstock.
    - kfrzcode 6y ago
      Hot take! Interested in helping improve the state of things? Plenty of jobs available with the USDS and various departments from Forestry to HHS!
      - theossuary 6y ago
        Who would take a job anywhere with that type of leadership though?
        kfrzcode 6y ago
        Tens of thousands of non-partisans who are motivated to improve the technical infrastructure of the government.
        elliekelly 6y ago
        Every interaction I’ve had with someone from USDS has been top-notch. I obviously can’t speak to the politics that may happen amongst the higher ups behind the scenes but the people they’re recruiting are excellent.
    - Angostura 6y ago
      But this isn't characterised in the text as a US government initiative. It's "The Trump administration's" - see first sentence. Very odd.
- cbm-vic-20 6y ago
  Or, the government employee tasked with putting this thing up did it intentionally as a subtle form of protest.
- reaperducer 6y ago
  it's just another sign of the US's government technical incompetence. Not "the government." "A person in the government." The federal government has a very good design system. But for some reason, whoever built this page chose not to follow it. https://designsystem.digital.gov https://designsystem.digital.gov
  - saagarjha 6y ago
    > The federal government has a very good design system. Having no knowledge of how the federal government works, but having worked for fairly large organizations, I would still guess that the design system exists and is used in many places but a significant fraction may not even know it exists much less that they are supposed to use it.
    - blaser-waffle 6y ago
      Seconded. Plus many Fed'Gov orgs have explicitly different systems, requirements, and silos. The DOD or NSA would put out something flashy, but this is State...
- rtkwe 6y ago
  I think it's more a sign of this being hastily thrown together. There's a lot of last minute stuff going on to try to boost Trump's reelection bid.
monoideism 6y ago
> What unusual attack do they get access to by owning or manufacturing the equipment? It is incredibly easy to add almost undetectable backdoors to hardware, particularly inside ICs. Here's one particularly clever attack described by security researchers at U of Michigan, but there are many: https://www.wired.com/2016/06/demonically-clever-backdoor-hides-inside-computer-chip/ https://www.wired.com/2016/06/demonically-clever-backdoor-hi...
- supernova87a 6y ago
  How would a hardware vulnerability on router equipment handling traffic compromise data flowing over that router which has already been encrypted properly at the source/destination?
  - mthoms 6y ago
    I'm no HW guy but when "activated", could it not brick itself? Or, only transmit packets passing to/from certain IP addresses?
    - solstice 6y ago
      That doesn't sound useful or very sophisticated from a spying POV. I guess mass-shutdown of Telco infrastructure would be catastrophic but that could most likely be avoided by having a mix of suppliers and a minimum of known-good hardware in the field.
      - rtkwe 6y ago
        You'd have to maintain that mixture of manufacturers broadly across all the 'critical' bits of infrastructure for it to really matter and there's a lot of infrastructure to defend. Just disrupting payments or mobile data sporadically across the US could deal a big blow to a lot of businesses. Just look how poorly they've fared with the COVID disruptions.
        solstice 6y ago
matthewaveryusa 6y ago
Denial of service, metadata extraction, easy path to mitm if there's a zero day. Those are just a few attacks possible without decrypting payloads. If I gave you a root CA's private key and my ip address you would not be able to mitm me unless you found a way to inject yourself in my datapath. Good luck with that unless you have nice backdoors to core infrastructure.
glenstein 6y ago
>This really comes off as a hastily prepared political dig against China I think 'Clean net' is a horrific, short sighted, dystopian joke that will be the subject of ridicule and fascination as a historical subject. I also think there's no surveillance operation in the world as vast and as troubling as China's, and there's nothing fundamentally inaccurate or misleading about pointing that out.
- colordrops 6y ago
  > there's no surveillance operation in the world as vast and as troubling as China's Replace "China" with "US".
MattGaiser 6y ago
> Why is CCP-owned infrastructure uniquely susceptible to this? If we can't protect our transmissions with encryption, secure data storage techniques, what does it matter that the equipment is supplied by China? What unusual attack do they get access to by owning or manufacturing the equipment? Their companies are by law forced to cooperate.
- thephyber 6y ago
  All companies are forced to cooperate by law. We Americans like to think we have the moral high ground against China. For some things, we do. For many others, they are just following in our footsteps. The US has scarcely not been at war since I've been alive and the 2001 Authorization for the Use of Force has no end in sight. Wartime powers vested in the Executive Branch are far more expansive than we would like to think. Who do you think re-routes shipments of Cisco networking hardware to the NSA TAO group? Cisco and FedEx/UPS. Same with any computing hardware and likely many other products. Who do you think complies with National Security Letters? 99%+ of the companies that receive them. QWest tried to challenge their legality and that CEO wasted away in prison. Patriot Act and Anti-Money Laundering statutes require that lots of industries participate with the USA government: financial, travel, hotel, telecom, etc.
- deleted 6y ago
  [deleted]

gpm 6y ago

> so, this would call for even tighter control by Apple, Google, over its app distribution and monopolies? I think it does the opposite. It says "if you're going to vouch for software, really vouch for it". Not "only let users install software you can vouch for". It means that non-app store distribution becomes more of a thing, not less.

apazzolini 6y ago

> The JPEGed giant logo It's almost like they ran it through jpegify.me on purpose as a joke, but really it's just another sign of the US's government technical incompetence.

24gttghh 6y ago
"CleanNetwork_NewCleans-300x169.jpg" 300x169, blown up to at least double that size.
sjs382 6y ago
The site uses WordPress and the post author decided to include a thumbnail, scaled up to regular size, rather than using the original: https://www.state.gov/wp-content/uploads/2020/08/CleanNetwork_NewCleans.jpg https://www.state.gov/wp-content/uploads/2020/08/CleanNetwor...
- munificent 6y ago
  Jesus fucking Christ. I remember when the US government wasn't a complete laughingstock.
  - kfrzcode 6y ago
    Hot take! Interested in helping improve the state of things? Plenty of jobs available with the USDS and various departments from Forestry to HHS!
    - theossuary 6y ago
      Who would take a job anywhere with that type of leadership though?
      - kfrzcode 6y ago
        Tens of thousands of non-partisans who are motivated to improve the technical infrastructure of the government.
      - elliekelly 6y ago
        Every interaction I’ve had with someone from USDS has been top-notch. I obviously can’t speak to the politics that may happen amongst the higher ups behind the scenes but the people they’re recruiting are excellent.
  - Angostura 6y ago
    But this isn't characterised in the text as a US government initiative. It's "The Trump administration's" - see first sentence. Very odd.
cbm-vic-20 6y ago
Or, the government employee tasked with putting this thing up did it intentionally as a subtle form of protest.
reaperducer 6y ago
it's just another sign of the US's government technical incompetence. Not "the government." "A person in the government." The federal government has a very good design system. But for some reason, whoever built this page chose not to follow it. https://designsystem.digital.gov https://designsystem.digital.gov
- saagarjha 6y ago
  > The federal government has a very good design system. Having no knowledge of how the federal government works, but having worked for fairly large organizations, I would still guess that the design system exists and is used in many places but a significant fraction may not even know it exists much less that they are supposed to use it.
  - blaser-waffle 6y ago
    Seconded. Plus many Fed'Gov orgs have explicitly different systems, requirements, and silos. The DOD or NSA would put out something flashy, but this is State...
rtkwe 6y ago
I think it's more a sign of this being hastily thrown together. There's a lot of last minute stuff going on to try to boost Trump's reelection bid.

monoideism 6y ago

> What unusual attack do they get access to by owning or manufacturing the equipment? It is incredibly easy to add almost undetectable backdoors to hardware, particularly inside ICs. Here's one particularly clever attack described by security researchers at U of Michigan, but there are many: https://www.wired.com/2016/06/demonically-clever-backdoor-hides-inside-computer-chip/ https://www.wired.com/2016/06/demonically-clever-backdoor-hi...

supernova87a 6y ago
How would a hardware vulnerability on router equipment handling traffic compromise data flowing over that router which has already been encrypted properly at the source/destination?
- mthoms 6y ago
  I'm no HW guy but when "activated", could it not brick itself? Or, only transmit packets passing to/from certain IP addresses?
  - solstice 6y ago
    That doesn't sound useful or very sophisticated from a spying POV. I guess mass-shutdown of Telco infrastructure would be catastrophic but that could most likely be avoided by having a mix of suppliers and a minimum of known-good hardware in the field.
    - rtkwe 6y ago
      You'd have to maintain that mixture of manufacturers broadly across all the 'critical' bits of infrastructure for it to really matter and there's a lot of infrastructure to defend. Just disrupting payments or mobile data sporadically across the US could deal a big blow to a lot of businesses. Just look how poorly they've fared with the COVID disruptions.
      - solstice 6y ago

matthewaveryusa 6y ago

Denial of service, metadata extraction, easy path to mitm if there's a zero day. Those are just a few attacks possible without decrypting payloads. If I gave you a root CA's private key and my ip address you would not be able to mitm me unless you found a way to inject yourself in my datapath. Good luck with that unless you have nice backdoors to core infrastructure.

glenstein 6y ago

>This really comes off as a hastily prepared political dig against China I think 'Clean net' is a horrific, short sighted, dystopian joke that will be the subject of ridicule and fascination as a historical subject. I also think there's no surveillance operation in the world as vast and as troubling as China's, and there's nothing fundamentally inaccurate or misleading about pointing that out.

colordrops 6y ago
> there's no surveillance operation in the world as vast and as troubling as China's Replace "China" with "US".

MattGaiser 6y ago

> Why is CCP-owned infrastructure uniquely susceptible to this? If we can't protect our transmissions with encryption, secure data storage techniques, what does it matter that the equipment is supplied by China? What unusual attack do they get access to by owning or manufacturing the equipment? Their companies are by law forced to cooperate.

thephyber 6y ago
All companies are forced to cooperate by law. We Americans like to think we have the moral high ground against China. For some things, we do. For many others, they are just following in our footsteps. The US has scarcely not been at war since I've been alive and the 2001 Authorization for the Use of Force has no end in sight. Wartime powers vested in the Executive Branch are far more expansive than we would like to think. Who do you think re-routes shipments of Cisco networking hardware to the NSA TAO group? Cisco and FedEx/UPS. Same with any computing hardware and likely many other products. Who do you think complies with National Security Letters? 99%+ of the companies that receive them. QWest tried to challenge their legality and that CEO wasted away in prison. Patriot Act and Anti-Money Laundering statutes require that lots of industries participate with the USA government: financial, travel, hotel, telecom, etc.
deleted 6y ago
[deleted]