4 ms·

It's not really. SolarWind uses a JetBrains component as a critical piece of infrastructure in the government which may have basically been built by Russia. No

by sjg007 6y ago

It's not really. SolarWind uses a JetBrains component as a critical piece of infrastructure in the government which may have basically been built by Russia. Now maybe everything is above board but JetBrains does employ developers in Russia and was originally a Russian company. We don't run Kaspersky in the government either. More to the point this should never have happened.

kodah 6y ago
JetBrains was started in the Czech Republic [0] by three Russians. The same people who started it no longer run it. Calling it a "Russian" company would be totally inaccurate. The hack that I saw cited, though I believe it was an unidentified source, was one that was injected at compile time. That would be very difficult to notice for any programmer. So, here's my question: Why did you refer to them as "Russian" when it's obviously not true? [0] https://en.m.wikipedia.org/wiki/JetBrains https://en.m.wikipedia.org/wiki/JetBrains
- sjg007 6y ago
  The CEO operates from St. Petersburg. I mean check his Twitter. They also have three dev offices in Russia. "Among its customers is SolarWinds, JetBrains Chief Executive Maxim Shafirov said from St. Petersburg, Russia, where JetBrains has offices." https://www.reuters.com/article/us-global-cyber-jetbrains/fbi-probe-of-major-hack-includes-project-management-software-from-jetbrains-sources-idUSKBN29B2RR https://www.reuters.com/article/us-global-cyber-jetbrains/fb... I mean everything might be above board but it's probably bad or lax US policy and/or regulations that Solarwinds was deployed through out the government.
  - kodah 6y ago
    Yeah, none of that is accurate to the phrasing of "a Russian company" as a rhetorical device. This kind of quasi-hyperbole about Russians is also getting old. Russia has been an ideological enemy for a long time, maybe even as long as time. I've never second guessed the motivations of business owners and citizens from Russia the way certain crowds do. That's pretty tantamount to something dubious. Does the government need to be scrupulous in whatever open and closed source software it chooses to vend? Yes. Do we need to be chiding about the motivations of every day Russians as one of our first order investigations? Probably not.
    - sjg007 6y ago
      Yet you clearly second guess and misunderstand my intentions. The real problem is the threat vector. Where is it is easier for intelligence services to operate?
      - kodah 6y ago
        > Yet you clearly second guess and misunderstand my intentions I can only go off of what you put in plaintext. > The real problem is the threat vector So, explain to me the threat vector. If we have a threat vector that is substantiated by, "is Russian" then I think we have a problem. If we have a threat vector of, "Government vets first order software dependencies, but not the second order and soft dependencies of software vendors" then we have something more akin to analysis. It took Kaspersky being affiliated with, cooperating (and serving) the FSB in order for it to be banned, not because it was established by Russians.
        sjg007 6y ago
        I am not going to engage further with moved goalposts. It’s clear what the threat vectors are: Russian intelligence and a lack of due diligence.
        kodah 6y ago
        I wasn't trying to move goal posts. Admittedly I might be sensitive to all the question of anything affiliated with Russia is now a conspiracy style thinking that has come from certain crowds. If I unfairly lumped you in with these folks, then I apologize. > Russian intelligence Someone will need to prove that there is a link between JetBrains as a company and Russian intel (aka the FSB) just as what happened with Kaspersky. I doubt that this is the case. It could certainly be a rogue employee, but that's a good amount of speculation. We've seen that the FSB has no issue hacking into companies and organizations without a mole. > and a lack of due diligence. I described the attack. What due diligence protects against something that injects itself during compile time and only triggers on specific events?

by sjg007 6y ago

kodah 6y ago

JetBrains was started in the Czech Republic [0] by three Russians. The same people who started it no longer run it. Calling it a "Russian" company would be totally inaccurate. The hack that I saw cited, though I believe it was an unidentified source, was one that was injected at compile time. That would be very difficult to notice for any programmer. So, here's my question: Why did you refer to them as "Russian" when it's obviously not true? [0] https://en.m.wikipedia.org/wiki/JetBrains https://en.m.wikipedia.org/wiki/JetBrains

sjg007 6y ago
The CEO operates from St. Petersburg. I mean check his Twitter. They also have three dev offices in Russia. "Among its customers is SolarWinds, JetBrains Chief Executive Maxim Shafirov said from St. Petersburg, Russia, where JetBrains has offices." https://www.reuters.com/article/us-global-cyber-jetbrains/fbi-probe-of-major-hack-includes-project-management-software-from-jetbrains-sources-idUSKBN29B2RR https://www.reuters.com/article/us-global-cyber-jetbrains/fb... I mean everything might be above board but it's probably bad or lax US policy and/or regulations that Solarwinds was deployed through out the government.
- kodah 6y ago
  Yeah, none of that is accurate to the phrasing of "a Russian company" as a rhetorical device. This kind of quasi-hyperbole about Russians is also getting old. Russia has been an ideological enemy for a long time, maybe even as long as time. I've never second guessed the motivations of business owners and citizens from Russia the way certain crowds do. That's pretty tantamount to something dubious. Does the government need to be scrupulous in whatever open and closed source software it chooses to vend? Yes. Do we need to be chiding about the motivations of every day Russians as one of our first order investigations? Probably not.
  - sjg007 6y ago
    Yet you clearly second guess and misunderstand my intentions. The real problem is the threat vector. Where is it is easier for intelligence services to operate?
    - kodah 6y ago
      > Yet you clearly second guess and misunderstand my intentions I can only go off of what you put in plaintext. > The real problem is the threat vector So, explain to me the threat vector. If we have a threat vector that is substantiated by, "is Russian" then I think we have a problem. If we have a threat vector of, "Government vets first order software dependencies, but not the second order and soft dependencies of software vendors" then we have something more akin to analysis. It took Kaspersky being affiliated with, cooperating (and serving) the FSB in order for it to be banned, not because it was established by Russians.
      - sjg007 6y ago
        I am not going to engage further with moved goalposts. It’s clear what the threat vectors are: Russian intelligence and a lack of due diligence.
        kodah 6y ago
        I wasn't trying to move goal posts. Admittedly I might be sensitive to all the question of anything affiliated with Russia is now a conspiracy style thinking that has come from certain crowds. If I unfairly lumped you in with these folks, then I apologize. > Russian intelligence Someone will need to prove that there is a link between JetBrains as a company and Russian intel (aka the FSB) just as what happened with Kaspersky. I doubt that this is the case. It could certainly be a rogue employee, but that's a good amount of speculation. We've seen that the FSB has no issue hacking into companies and organizations without a mole. > and a lack of due diligence. I described the attack. What due diligence protects against something that injects itself during compile time and only triggers on specific events?