4 ms·

I am not going to engage further with moved goalposts. It’s clear what the threat vectors are: Russian intelligence and a lack of due diligence.

by sjg007 6y ago

kodah 6y ago
I wasn't trying to move goal posts. Admittedly I might be sensitive to all the question of anything affiliated with Russia is now a conspiracy style thinking that has come from certain crowds. If I unfairly lumped you in with these folks, then I apologize. > Russian intelligence Someone will need to prove that there is a link between JetBrains as a company and Russian intel (aka the FSB) just as what happened with Kaspersky. I doubt that this is the case. It could certainly be a rogue employee, but that's a good amount of speculation. We've seen that the FSB has no issue hacking into companies and organizations without a mole. > and a lack of due diligence. I described the attack. What due diligence protects against something that injects itself during compile time and only triggers on specific events?
- sjg007 6y ago
  The risk here is that Jetbrains has significant operations in Russia. It is likely a lot easier to get an FSB agent hired into a Russian office. And in fact the Russian government can just order and enforce cooperation. The USA does this all the time and every operation is classified. I would not expect anything less from Russia or China. The companies registration in the Czech Republic (or anywhere) does not prevent this. Kasperkey is even more obvious because the founder was involved with the KGB even before the 2017 ban. It should never have been used. Now maybe Kasperkey's affiliation is akin to a "communist youth party" card and not necessarily a genuine affiliation but the point is that you can't trust and then verify in these situations. You have to assume that everyone is hostile unless proven safe.
  - kodah 6y ago
    > the point is that you can't trust and then verify in these situations. You have to assume that everyone is hostile unless proven safe. Are you getting this from somewhere or are you explaining how you perceive the standards? The laws I'm familiar with generally have to do with pretty specific criteria for delivering software that touches specific types/classifications of data. None of that would've caught how the JetBrains software was allegedly used to exploit the SolarWinds product. This was some pretty sophisticated stuff.

I am not going to engage further with moved goalposts. It’s clear what the threat vectors are: Russian intelligence and a lack of due diligence.

by sjg007 6y ago

I am not going to engage further with moved goalposts. It’s clear what the threat vectors are: Russian intelligence and a lack of due diligence.

kodah 6y ago

I wasn't trying to move goal posts. Admittedly I might be sensitive to all the question of anything affiliated with Russia is now a conspiracy style thinking that has come from certain crowds. If I unfairly lumped you in with these folks, then I apologize. > Russian intelligence Someone will need to prove that there is a link between JetBrains as a company and Russian intel (aka the FSB) just as what happened with Kaspersky. I doubt that this is the case. It could certainly be a rogue employee, but that's a good amount of speculation. We've seen that the FSB has no issue hacking into companies and organizations without a mole. > and a lack of due diligence. I described the attack. What due diligence protects against something that injects itself during compile time and only triggers on specific events?

sjg007 6y ago
The risk here is that Jetbrains has significant operations in Russia. It is likely a lot easier to get an FSB agent hired into a Russian office. And in fact the Russian government can just order and enforce cooperation. The USA does this all the time and every operation is classified. I would not expect anything less from Russia or China. The companies registration in the Czech Republic (or anywhere) does not prevent this. Kasperkey is even more obvious because the founder was involved with the KGB even before the 2017 ban. It should never have been used. Now maybe Kasperkey's affiliation is akin to a "communist youth party" card and not necessarily a genuine affiliation but the point is that you can't trust and then verify in these situations. You have to assume that everyone is hostile unless proven safe.
- kodah 6y ago
  > the point is that you can't trust and then verify in these situations. You have to assume that everyone is hostile unless proven safe. Are you getting this from somewhere or are you explaining how you perceive the standards? The laws I'm familiar with generally have to do with pretty specific criteria for delivering software that touches specific types/classifications of data. None of that would've caught how the JetBrains software was allegedly used to exploit the SolarWinds product. This was some pretty sophisticated stuff.