7 ms·
I wish the NYT would clarify or retract this piece/headline https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html https://www.nytimes.com/2021/
by denimnerd42 6y ago
I wish the NYT would clarify or retract this piece/headline
https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-...
> Widely Used Software Company May Be Entry Point for Huge U.S. Hacking
> Russian hackers may have piggybacked on a tool developed by JetBrains, which is based in the Czech Republic, to gain access to federal government and private sector systems in the United States.
My company has banned Jetbrains now and received questions from regulators about it. Don't see them banning Microsoft anytime soon.
- ZeroCool2u 6y agoGlad someone else brought this example up. Honestly, what a staggeringly low quality piece of journalism.
- whoisstan 6y agoInterestingly I just had an unrelated discussion on goodreads about that. The first mentioned author of the NYT article is supposedly a cybersecurity expert. The article lacked any evidence and called the company russian and obscure, they edited that but it’s still on archive.org https://web.archive.org/web/20210106195835/https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html https://web.archive.org/web/20210106195835/https://www.nytim... I left a goodreads comment on the NYT authors latest cybersecurity book calling her knowledge and practice in question. How can article like this stand, if it cannot be backed up, bad journalism and a lack understanding of the matter?
- notimetorelax 6y agoThis makes me wonder, 3 branches of government exist to balance each other out. Journalism stands on its own, what’s the counter balance to journalism?
- nradov 6y agoSocial media
- seattle_spring 6y agoI wish. It seems like social media largely serves to amplify biased or outright false journalism rather than give it balance.
- nradov 6y agoI've seen plenty of cases where social media users accurately pointed out false or misleading journalism. But I suppose it depends on who you follow.
- ekianjo 6y agoSocial media is just pushing the narrative of mainstream media at this stage.
- wyldfire 6y agoOther journalists.
- Mandatum 6y ago"Journalism" - quotes intended.
- whoisstan 6y agoIt’s other newspapers and online entities such as this. In this case I am sure the company suffered financially, they should be able to pressure the NYT to retract the story, they have some muscle with the google ties.
- 38491239821398 6y agoTheoretically, the judicial branch, via defamation law.
- jimmygrapes 6y agoOnce upon a time, ombudsman and journalist associations, and competitors. These days, those tend to all be the same, if they exist at all and aren't deemed "propaganda" or "fake news" or "disinformation" or similar.
- blahblahblogger 6y agoJournalism, "the 4th estate", in the past was used to go after the powerful but it has recently become the power. It's a concerning change and I don't see it getting better. Maybe it's "corporate journalism" that is problematic.
- roenxi 6y agoThere was never a time when journalists challenged "the powerful" as a collective. They challenged the powerful enemies of their powerful employer. The difference is now we have better information infrastructure and they can't make things that are disagreeable quietly disappear [0] so easily. The disappearing news story isn't a new act; what is new is now the story can linger despite that. [0] https://www.bbc.com/news/world-us-canada-50296742 https://www.bbc.com/news/world-us-canada-50296742
- eyelidlessness 6y agoIf you’re in the US, or any country with comparable speech/press protection: the same rights that give them protection to publish. I know it’s unpopular here but social consequences punishing bad press behavior are effective, just like punishing bad politician or famous people behavior. This is sometimes paraphrased as “vote with your feet” or “vote with your wallet”, but lately it’s been maligned as “cancel culture”. Either way, you’re allowed to just call bullshit on a publication. You’re especially allowed to not consume it.
- concordDance 6y agoI thought cancel culture was about trying to get individuals fired for things unrelated to their work?
- EvilEy3 6y agoIt's evolving. Cancer now wants everyone cancelled.
- xmprt 6y agoReplace "cancelled" with "held accountable for their actions"
- eyelidlessness 6y agoThe fact that you think those things are unrelated to their work tells me I should probably avoid working where you work.
- lordloki 6y ago"Cancel culture" isn't choosing not to consume media. "Cancel culture" is actively trying to destroy it, like advocating lawsuits against Fox News, or deplatforming media hosts. What you describe is how it's always been. Current "cancel culture" is nefarious as it actively tries to remove other's ability to access it. "Cancel culture" is authoritarian and undemocratic.
- GoblinSlayer 6y agoCritical thought. Other journalists and free speech can be censored by private companies that have no obligation to follow any due process. During information war critical thought is the most important asset, without which you're as good as illiterate.
- jimz 6y agoUm, in countries where the government can play the ultimate arbiter of truth in speech they also get to determine what due process is, which usually is exactly what suits them. Private companies reflect the values of their shareholders and customers, which at least is made up of citizens without the coercive and exclusive power to say, lock you up for your reporting, or literally kill you and your loved ones over your reporting, which still happens to this day. If there is demand, and placed out of the state's hands, at least alternate channels, whether more accurate or not, more ethical or less, with or without an agenda, can exist. The alternate scenario easily renders them unable to exist in the first place. "Due process" when applied outside of official government action is simply coercing a standard set by the government upon collectives of private individuals even if - especially if - it is unwanted. It's an illusion of fairness that masks coercion, because there's either enforcement mechanisms for compliance - coercion - or there isn't - which is a charade and meaningless. Neither produces positive outcomes. Those in power will simply use it to cover up mistakes or intentional wrongdoing first. Companies can't literally speak as in vocalize as a person, but they can, as entities, create the equivalence of speech in the societal sense, and shifting the arbiter of truth to the state will simply centralize that power in an entity that, in addition to dominating the marketplace by default - you can't exactly pick where you're born, nor where you can move to realistically for the most part - they can bring real consequences. Deplatforming is child's play compared to actual imprisonment or getting pushed out of an airborne helicopter.
- GoblinSlayer 6y agoAh, that uncensored dark web existed IRL: https://www.npr.org/sections/thesalt/2014/05/27/314961287/how-soviet-kitchens-became-hotbeds-of-dissent-and-culture https://www.npr.org/sections/thesalt/2014/05/27/314961287/ho...
- relaxing 6y ago“Journalism” is not a single entity or even a unified bloc. Journalism exists in the market economy, so other market forces counterbalance - consumers, other corporations. Journalism also exists under government regulation, despite strong legal protections.
- h2odragon 6y agoJournalism was "stories without religion" until they succeeded in killing religion. Now they've become priests and built a Temple to no god.
- Twixes 6y agoWow, that is dramatic.
- _cs2017_ 6y agoYou can't even sue them for libel. It's the kind of article that's perfectly legal, and yet does tremendous damage. Yes, HN and Reddit comments can point out the flaws, but that's not going to make a dent on the public opinion. So what options do we have to counter-balance "journalism" like that?
- ViViDboarder 6y agoOut of curiosity, what would you want to see clarified? They said that it “may” be an entry point for the SW hack and, according to some National Security folks, it is being investigated. Is there reason to believe this is incorrect in some way? It may be premature and amount to nothing if Team City had nothing to do with the breach, but it doesn’t appear to be misleading or false. If it was, I’d imagine JetBrains would have filed a lawsuit.
- deleted 6y ago[deleted]
- rst 6y agoThe weasel-wording still left most readers with a clear impression that flaws in JetBrains software were directly implicated in the hack, and many US companies proceeded on that basis. But it wasn't -- the attackers had reconfigured the build servers to add malicious code to product builds, but their malware was targeting MSBUILD.EXE processes on startup, and would have worked just the same if SolarWinds wasn't using JetBrains at all, and those processes were started instead by Jenkins, CircleCI, or a human typing at a command line. Here's a technical writeup: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/ https://www.crowdstrike.com/blog/sunspot-malware-technical-a... As to the lawsuit: JetBrains is not based in the US; a lawsuit would probably take years to reach resolution, and be a massive, expensive distraction.
- GoblinSlayer 6y agoReaders interpret the article with prejudice, the resulting understanding is what needs to be clarified.
- mr_toad 6y agoIf your company bases security decisions on articles in the NYT then they’re beyond helping. Frankly that’s both laughable and incompetent. No professional (in any field) should base a decision solely on something written in any secondary source. Even if it was a specialist publication, a competent professional should do their own research, and look at the primary sources. Imagine if a doctor or civil engineer based professional decisions on what they read in magazines and newspapers. The thought is horrifying. The problem is not that the NYT article is factually incorrect (if in fact Jet Brains were being investigated, which seems plausible). The problem is that anyone who’s reasoning skills exceed that of a five year old child should realise that there is a good possibility that the investigation would turn out to be a red herring.
- denimnerd42 6y agoIn our field it is actually a reputational risk issue, but you're right. The fact they couldn't come up with a better solution than banning Jetbrains doesn't speak well.
- kortilla 6y ago> The problem is that anyone who’s reasoning skills exceed that of a five year old child should The problem is that many companies have lots of clients that don’t have this reasoning capability. The reputation damage is much worse than the actual harm if you’re a “known contractor compromised by Russia” or whatever the dumb narrative is. It’s literally easier to drop it immediately “pending investigation”.
- buisi 6y agoIs it really that obvious? If a company gets a bad rap for being insecure, is it rational to go for them? Sure, you should do your due diligence, when picking any solution, but it's certainly a factor which could discount someone from a shortlist. You're not always the one to make a decision. When you are, there are a number of stakeholders who can influence your course of actions, and when solutions are similar enough, it is easier to take the path of least notoriety.
- 6y ago
- cyberlurker 6y agoI have a similar experience, where Jetbrains is effectively banned. Do you have any updated source that I could circulate to clear their name?
- rst 6y agoWriteup of the actual attack malware running on the build servers: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/ https://www.crowdstrike.com/blog/sunspot-malware-technical-a... It attacked MSBUILD.EXE processes on startup, and it didn't matter if they were started by TeamCity or by a homebrew script in Powershell.
- mike_hearn 6y agoThey wrote about it on their blog. https://blog.jetbrains.com/blog/2021/01/07/an-update-on-solarwinds/ https://blog.jetbrains.com/blog/2021/01/07/an-update-on-sola... https://blog.jetbrains.com/blog/2021/01/08/january-8th-update-on-solarwinds/ https://blog.jetbrains.com/blog/2021/01/08/january-8th-updat... Summary: they have no idea what anyone is talking about, nobody has told them anything and there are no known issues with TeamCity. Later they did a blog post with security tips for locking it down but they're all pretty generic things that'd apply to any CI system. These companies that are banning JetBrains and thus locking themselves out of some of the best software tools out there are now suffering the consequences of years of mass hysteria over Russia, largely promoted by the New York Times. Every time someone read or quoted the New York Times as an authority on something and did not receive major pushback, it was another brick in the wall that has now led to this. It was all entirely predictable. In 2017 I wrote about an even more deceptive and malicious article in the New York Times on the topic of "Russian Twitter bots" and Brexit. The story was based on an academic paper that superficially made it seems like credible expertise, but was intellectual fraud from beginning to end. https://blog.plan99.net/did-russian-bots-impact-brexit-ad66f08c014a https://blog.plan99.net/did-russian-bots-impact-brexit-ad66f... After that I started compiling a list of stories I read about Russia that fell apart when fact checked. I gave up after doing sixteen of them because it was just endless. https://blog.plan99.net/%D0%BF%D1%80%D0%B0%D0%B2%D0%B4%D0%B0-6e24757a67ba https://blog.plan99.net/%D0%BF%D1%80%D0%B0%D0%B2%D0%B4%D0%B0... The thread article starts by saying, "Most educated people believe that premier news outlets are inherently trustworthy". This is probably true but just makes it clear that education doesn't make people smart. The total unreliability of anything Russia-related in the "educated" press has been obvious for years. The only way for things to get better are for people to repeatedly attack the credibility of these outlets, in public, on any topic where they engage in deceptive practices, in front of the sort of decision makers who are now making snap anti-Russian decisions on the basis of prior articles.
- keyle 6y ago"Hacker used linux." ipso facto linux is dangerous ipso facto ban linux. "Hacker was breathing oxygen" oxygen aids cyber terrorism ...
- jrochkind1 6y agoI remember that one. They did change the headline in fact. The original version erroneously said Russian Software Company May Be Entry Point for Huge U.S. Hack They changed "Russian" to "Widely Used"... Oddly the version the wayback machine caches has "Russian" in the headline as well as "based in the Czech Republic" in the first sentence. https://web.archive.org/web/20210106195835/https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html https://web.archive.org/web/20210106195835/https://www.nytim... It is clearly an alarmist "yellow journalism" kind of article, I agree. The headline swap is a bit revealing; they never would have framed the article this way in a similar situation for a U.S. company, even if "may be entry point for huge hack" would be just as accurate. I'm not sure there is anything technically incorrect in the current version of it though. Also holy cow is Internet Archive doing god's work, I'm gonna go send em some money right now.
- inglor_cz 6y agoCzech here. JetBrains is really incorporated as a Czech corp., but in the same way that many ships are registered in Liberia. I have some paid licences of JetBrains, I have e-mailed back and forth with JetBrains employees in different positions, and all were Russians.
- deleted 6y ago[deleted]
- kodah 6y agoI agree there's a hint of yellow journalism afloat here. > My company has banned Jetbrains now and received questions from regulators about it. Don't see them banning Microsoft anytime soon. It was their collaboration software that got hit iirc. I also recall the delivery method being very smart, something along the lines of inserting code during compilation. While it's certainly reasonable to ask JetBrains to prove their releases are infection free among other things, banning all of their software seems excessive.
- caffeine 6y agoCould that sort of misrepresentation qualify as libel? Or are newspapers somehow immune to that?