5 ms·

Now consider what this suggests about Intel processors (IME) and GAFAM's software (including Raspberry Pi's firmware, ThreadX ?). In completely unrelated news,

Now consider what this suggests about Intel processors (IME) and GAFAM's software (including Raspberry Pi's firmware, ThreadX ?). In completely unrelated news, OVH, Europe's biggest hosting provider, has announced a new partnership : OVH is going to use Google's closed(?) source software, Anthos, for its "Hosted Private Cloud" offering.

fedreserved 6y ago
https://youtu.be/8ZNjUiP0p6I https://youtu.be/8ZNjUiP0p6I Video by Brendan O'Connell showing how Intel is infiltrated and compromised. He would be considered fringe, but there's plenty of info to be gleamed. Don't shoot the messenger
- pc86 6y ago
  First image is literally dramatic music, a menorah, Netanyahu, and flames. How can anyone take this guy seriously?
  - throw0101a 6y ago
    > How can anyone take this guy seriously? In the timeline where flat earthers hold annual conventions, why are you surprised?
  - BuildTheRobots 6y ago
    FYI, the menorah is actually the Mossad logo, though it doesn't change the point you're making. I've not watched the video yet, but as it's entitled "How Russia and Israel Destroyed the Intel Corporation" I'm not sure what else I'd be using as an intro graphic. edit: Having watched about 10min of the video please don't take my defence of the title screen as defence of the contents of the video.
    - pc86 6y ago
      Thanks, I didn't realize that! I'm not sure why that seems "better" (but still pretty bad).
tyingq 6y ago
I used to take some comfort in the fact that big brother wouldn't have the technical capability to save and sift through everything. That you would have to first be on some narrow target list. I think we're now processer/storage/etc, advanced enough that it's no longer the case. They can, now, handle the firehose of everything, or most everything.
- markus_zhang 6y ago
  Can we generate a large batch of fake data to counter this situation? Guess I'm probably wishful thinking...
  - BlueTemplar 6y ago
    Depending on the situation, real data might be statistically fished out of fake data.
  - dredmorbius 6y ago
    Data poisoning is 1) hard and 2) largely ineffective especially if 3) much of the data- or metadata-stream is cleartext or interpretable by your adversary/ies, meaning actual signal is available. Cory Doctorow: https://old.reddit.com/r/privacy/comments/j444u4/how_to_destroy_surveillance_capitalism_an_ama/g7je6qs/ https://old.reddit.com/r/privacy/comments/j444u4/how_to_dest...
    - glenneroo 6y ago
      What about using GPT-3 (et al.) to generate plausible fake data?
      - dredmorbius 6y ago
        Variously: - You're emitting side-channel metadata all the time, most especially location and activity data (especially if you have any mobile devices) which is 1) useful 2) identifying and 3) very expensive to spoof. - Purchase and other commercial / financial activity likewise. These are literally expensive, and hence credible signals. - Unless you're spamming your contacts regularly, your social networks and interactions are also highly reliable and difficult to spoof. - Dang would not be pleased by a sudden influx of GPT-3 posters on HN. Similar reactions likely for other online services. - So long as your legitimate / semantically significant activity is present with minimal obfuscation, that signal exists and is easy to tease out. - If your activities are interactive and responsive, rather than scheduled, poisoning is less viable and more visible. Data fuzzing / poisoning works fairly well (though not even always then) for systems such ss numbers stations: broadcast-mode distribution, regularly-timed transmissions, consistently encrypted (no cleartext), no location or movement signals from recipients, and no transactional activities --- whether financial mor social. For all else, not so much. I could see some value to, say, search-engine spamming (with spurious searches), or ads networks (fake clicks). For the rest, it's just plain hard. Think threat models; what are you hoping to accomplish/protect, from whom, at what cost(s)?
driverdan 6y ago
> Now consider what this suggests about Intel processors (IME) and GAFAM's software (including Raspberry Pi's firmware, ThreadX ?). It doesn't suggest anything without evidence.
- BlueTemplar 6y ago
  I'm not sure that we have the same definition of 'suggest'... If we're lucky, we'll only get actual evidence after many decades, like with Crypto AG. (But of course we already have some evidence, for instance about ECHELON and PRISM (Skype...)) If we're unlucky, black hats (criminals and/or anti-West countries) are going to lay their hands on those backdoors first, like with the NSA/Shadow Brokers leak : https://news.ycombinator.com/item?id=12302085 https://news.ycombinator.com/item?id=12302085
- roenxi 6y ago
  > It doesn't suggest anything without evidence. We have substantial evidence from this very article: * There exist agencies that are trying to compromise your communications. * They have no scruples. * They are actively causing people to lie about what products do. * They are willing to act through corporations. Waiting until there is overwhelming evidence of a specific act of wrongdoing is a strategy so ineffective it may as well just be saying "I don't care about securing my communications". Not to say that no strategy is unreasonable, maybe people don't care. Assuming everyone is telling the truth about being honest and ruling them out one by one when there is a large report or a Snowden-style leak is all but guaranteed to have the same result as ignoring the problem. Evidence is coming to light years after the event, and the spies in this article used Switzerland as part of a strategy of targeting the most trusted places for corruption.
- pjc50 6y ago
  Quite right. Remember the supermicro fiasco? HN tore the non-evidence apart on that one.
- freeflight 6y ago
  Huawei products have been banned in a number of countries without any evidence, while US manufacturers like CISCO [0] have a pretty rich and regular history of weird backdoors in their products and actively harassing security researchers to suppress the reveal of that information [1]. Now consider the fact how one of the top search results for "Intel me NSA" is this article [2] telling people how they can totally disable that nasty ME thanks to the apparently very well meaning NSA. I don't claim to be nearly well versed enough to understand if that NSA advise is actually useful, but I'm sure as hell skeptical enough when a burglar wants to tell me how to best secure my home from break-ins. [0] https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a... [1] https://www.schneier.com/blog/archives/2005/07/cisco_harasses.html https://www.schneier.com/blog/archives/2005/07/cisco_harasse... [2] https://www.csoonline.com/article/3220476/researchers-say-now-you-too-can-disable-intel-me-backdoor-thanks-to-the-nsa.html https://www.csoonline.com/article/3220476/researchers-say-no...
e40 6y ago
Serious question: how does all this compare to what Apple has offered in the M1?

fedreserved 6y ago

https://youtu.be/8ZNjUiP0p6I https://youtu.be/8ZNjUiP0p6I Video by Brendan O'Connell showing how Intel is infiltrated and compromised. He would be considered fringe, but there's plenty of info to be gleamed. Don't shoot the messenger

pc86 6y ago
First image is literally dramatic music, a menorah, Netanyahu, and flames. How can anyone take this guy seriously?
- throw0101a 6y ago
  > How can anyone take this guy seriously? In the timeline where flat earthers hold annual conventions, why are you surprised?
- BuildTheRobots 6y ago
  FYI, the menorah is actually the Mossad logo, though it doesn't change the point you're making. I've not watched the video yet, but as it's entitled "How Russia and Israel Destroyed the Intel Corporation" I'm not sure what else I'd be using as an intro graphic. edit: Having watched about 10min of the video please don't take my defence of the title screen as defence of the contents of the video.
  - pc86 6y ago
    Thanks, I didn't realize that! I'm not sure why that seems "better" (but still pretty bad).

tyingq 6y ago

I used to take some comfort in the fact that big brother wouldn't have the technical capability to save and sift through everything. That you would have to first be on some narrow target list. I think we're now processer/storage/etc, advanced enough that it's no longer the case. They can, now, handle the firehose of everything, or most everything.

markus_zhang 6y ago
Can we generate a large batch of fake data to counter this situation? Guess I'm probably wishful thinking...
- BlueTemplar 6y ago
  Depending on the situation, real data might be statistically fished out of fake data.
- dredmorbius 6y ago
  Data poisoning is 1) hard and 2) largely ineffective especially if 3) much of the data- or metadata-stream is cleartext or interpretable by your adversary/ies, meaning actual signal is available. Cory Doctorow: https://old.reddit.com/r/privacy/comments/j444u4/how_to_destroy_surveillance_capitalism_an_ama/g7je6qs/ https://old.reddit.com/r/privacy/comments/j444u4/how_to_dest...
  - glenneroo 6y ago
    What about using GPT-3 (et al.) to generate plausible fake data?
    - dredmorbius 6y ago
      Variously: - You're emitting side-channel metadata all the time, most especially location and activity data (especially if you have any mobile devices) which is 1) useful 2) identifying and 3) very expensive to spoof. - Purchase and other commercial / financial activity likewise. These are literally expensive, and hence credible signals. - Unless you're spamming your contacts regularly, your social networks and interactions are also highly reliable and difficult to spoof. - Dang would not be pleased by a sudden influx of GPT-3 posters on HN. Similar reactions likely for other online services. - So long as your legitimate / semantically significant activity is present with minimal obfuscation, that signal exists and is easy to tease out. - If your activities are interactive and responsive, rather than scheduled, poisoning is less viable and more visible. Data fuzzing / poisoning works fairly well (though not even always then) for systems such ss numbers stations: broadcast-mode distribution, regularly-timed transmissions, consistently encrypted (no cleartext), no location or movement signals from recipients, and no transactional activities --- whether financial mor social. For all else, not so much. I could see some value to, say, search-engine spamming (with spurious searches), or ads networks (fake clicks). For the rest, it's just plain hard. Think threat models; what are you hoping to accomplish/protect, from whom, at what cost(s)?

driverdan 6y ago

> Now consider what this suggests about Intel processors (IME) and GAFAM's software (including Raspberry Pi's firmware, ThreadX ?). It doesn't suggest anything without evidence.

BlueTemplar 6y ago
I'm not sure that we have the same definition of 'suggest'... If we're lucky, we'll only get actual evidence after many decades, like with Crypto AG. (But of course we already have some evidence, for instance about ECHELON and PRISM (Skype...)) If we're unlucky, black hats (criminals and/or anti-West countries) are going to lay their hands on those backdoors first, like with the NSA/Shadow Brokers leak : https://news.ycombinator.com/item?id=12302085 https://news.ycombinator.com/item?id=12302085
roenxi 6y ago
> It doesn't suggest anything without evidence. We have substantial evidence from this very article: * There exist agencies that are trying to compromise your communications. * They have no scruples. * They are actively causing people to lie about what products do. * They are willing to act through corporations. Waiting until there is overwhelming evidence of a specific act of wrongdoing is a strategy so ineffective it may as well just be saying "I don't care about securing my communications". Not to say that no strategy is unreasonable, maybe people don't care. Assuming everyone is telling the truth about being honest and ruling them out one by one when there is a large report or a Snowden-style leak is all but guaranteed to have the same result as ignoring the problem. Evidence is coming to light years after the event, and the spies in this article used Switzerland as part of a strategy of targeting the most trusted places for corruption.
pjc50 6y ago
Quite right. Remember the supermicro fiasco? HN tore the non-evidence apart on that one.
freeflight 6y ago
Huawei products have been banned in a number of countries without any evidence, while US manufacturers like CISCO [0] have a pretty rich and regular history of weird backdoors in their products and actively harassing security researchers to suppress the reveal of that information [1]. Now consider the fact how one of the top search results for "Intel me NSA" is this article [2] telling people how they can totally disable that nasty ME thanks to the apparently very well meaning NSA. I don't claim to be nearly well versed enough to understand if that NSA advise is actually useful, but I'm sure as hell skeptical enough when a burglar wants to tell me how to best secure my home from break-ins. [0] https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a... [1] https://www.schneier.com/blog/archives/2005/07/cisco_harasses.html https://www.schneier.com/blog/archives/2005/07/cisco_harasse... [2] https://www.csoonline.com/article/3220476/researchers-say-now-you-too-can-disable-intel-me-backdoor-thanks-to-the-nsa.html https://www.csoonline.com/article/3220476/researchers-say-no...

e40 6y ago

Serious question: how does all this compare to what Apple has offered in the M1?