6 ms·

Two things can be true simultaneously: 1) The US and China have lots of espionage going both ways and both countries are always trying to do something like th

Two things can be true simultaneously: 1) The US and China have lots of espionage going both ways and both countries are always trying to do something like this. 2) The Bloomberg story had no evidence whatsoever for any of the specific claims they made, not even "the nice NSA man told me to trust him". And for a bonus, 3), there are probably other stories that happened and didn't get reported in media.

Lammy 6y ago
> 3), there are probably other stories that happened and didn't get reported in media. Agreed 100%, that's why it feels so weird that conversation around this story always seems to drift toward reasons it must not have happened instead of looking for the islands of truth in a story that's probably way way way worse than any of us realize.
- mr_toad 6y ago
  > instead of looking for the islands of truth in a story You’re shifting the burden of proof. https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy) https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy)
  - tlb 6y ago
    If you’re running sensitive servers, you might put the burden of proof on the vendor to convince you that the equipment they’re selling you isn’t backdoored. (You should also do your own checks)
    - simonh 6y ago
      Nobody can prove a negative like that. We're talking about data centre servers here, that's what the Bloomberg story is about. For a backdoor like this to work it has to be able to phone home, and that means getting transmissions out of the DC network. This would require knowledge about the target network infrastructure (which isn't impossible if there are specific targets) but there's no way to do that without the transmissions being visible. I think a hack like this is much more likely to be viable against consumer and mobile devices. Given that this is all a genuine risk, the Bloomberg story is particularly harmful. It creates the real risk that reports of genuine hacks or vulnerabilities will be sidelined due to reporting on issues like this being tarnished by association. Crying wolf is not good preparation for dealing with real wolves.
      - tremon 6y ago
        For a backdoor like this to work it has to be able to phone home, and that means getting transmissions out of the DC network. This would require knowledge about the target network infrastructure I don't think knowledge about the target network is required, just the ability to detect what default route is used by the OS. It also wouldn't need to "phone home", just phone into a controlled network. It wouldn't be a complete fantasy to assume that some software telemetry/update endpoints are compromised. And steganography using TCP sequence numbers is a real possibility, so once a link to a friendly endpoint is established, the backdoor wouldn't even need to generate its own packets.
- rcxdude 6y ago
  Because looking for 'islands of truth' is basically the behaviour of conspiracy theorists: wade through mountains of evidence, ignoring everything to the contrary to find the few scraps which support their theory. You can't just ignore the huge numbers of things in this story which straight up don't add up. It would be great to have more credible examples of such compromises, but this ain't it.
  - rbanffy 6y ago
    That's true, but if you find one such island, you can take it in isolation and see what it actually proves without considering the overall theory. If you find an ethernet connector with a tiny SoC inside it, I'd say it's pretty bad. State actors are constantly doing this to each other. Never trust a nice wooden sculpture the boy scouts give you.
    - webmaven 6y ago
      > That's true, but if you find one such island, you can take it in isolation and see what it actually proves without considering the overall theory. Except that isn't what happens in practice, rather the island is taken as confirmation of the rest of the theory.
      - koheripbal 6y ago
        ...but now we're arguing that we should throw away a logical reasoning process because other people take it too far. That doesn't make sense. We should care what irrational players use to draw their own conclusions when we are drawing OUR OWN conclusions.
        webmaven 6y ago
        In trying to make rational decisions, it is foolish to pretend that one's own decisions (past, present, or future) are always (or even mostly) rational, let alone other people's. Rather, most purportedly rational or logical decisions are instead rationalized ones, and it is rational to acknowledge this. I'm not suggesting throwing the baby out with the bathwater, just awareness that as decision makers our ability to apply logic is limited (in economic terms 'bounded'). In fact, perhaps our limited ability to reason is best imagined as a baby: full of endless potential, yet weak and fragile, easily perturbed, and requiring near constant care, attention, even vigilance.

Lammy 6y ago

> 3), there are probably other stories that happened and didn't get reported in media. Agreed 100%, that's why it feels so weird that conversation around this story always seems to drift toward reasons it must not have happened instead of looking for the islands of truth in a story that's probably way way way worse than any of us realize.

mr_toad 6y ago
> instead of looking for the islands of truth in a story You’re shifting the burden of proof. https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy) https://en.wikipedia.org/wiki/Burden_of_proof_(philosophy)
- tlb 6y ago
  If you’re running sensitive servers, you might put the burden of proof on the vendor to convince you that the equipment they’re selling you isn’t backdoored. (You should also do your own checks)
  - simonh 6y ago
    Nobody can prove a negative like that. We're talking about data centre servers here, that's what the Bloomberg story is about. For a backdoor like this to work it has to be able to phone home, and that means getting transmissions out of the DC network. This would require knowledge about the target network infrastructure (which isn't impossible if there are specific targets) but there's no way to do that without the transmissions being visible. I think a hack like this is much more likely to be viable against consumer and mobile devices. Given that this is all a genuine risk, the Bloomberg story is particularly harmful. It creates the real risk that reports of genuine hacks or vulnerabilities will be sidelined due to reporting on issues like this being tarnished by association. Crying wolf is not good preparation for dealing with real wolves.
    - tremon 6y ago
      For a backdoor like this to work it has to be able to phone home, and that means getting transmissions out of the DC network. This would require knowledge about the target network infrastructure I don't think knowledge about the target network is required, just the ability to detect what default route is used by the OS. It also wouldn't need to "phone home", just phone into a controlled network. It wouldn't be a complete fantasy to assume that some software telemetry/update endpoints are compromised. And steganography using TCP sequence numbers is a real possibility, so once a link to a friendly endpoint is established, the backdoor wouldn't even need to generate its own packets.
rcxdude 6y ago
Because looking for 'islands of truth' is basically the behaviour of conspiracy theorists: wade through mountains of evidence, ignoring everything to the contrary to find the few scraps which support their theory. You can't just ignore the huge numbers of things in this story which straight up don't add up. It would be great to have more credible examples of such compromises, but this ain't it.
- rbanffy 6y ago
  That's true, but if you find one such island, you can take it in isolation and see what it actually proves without considering the overall theory. If you find an ethernet connector with a tiny SoC inside it, I'd say it's pretty bad. State actors are constantly doing this to each other. Never trust a nice wooden sculpture the boy scouts give you.
  - webmaven 6y ago
    > That's true, but if you find one such island, you can take it in isolation and see what it actually proves without considering the overall theory. Except that isn't what happens in practice, rather the island is taken as confirmation of the rest of the theory.
    - koheripbal 6y ago
      ...but now we're arguing that we should throw away a logical reasoning process because other people take it too far. That doesn't make sense. We should care what irrational players use to draw their own conclusions when we are drawing OUR OWN conclusions.
      - webmaven 6y ago
        In trying to make rational decisions, it is foolish to pretend that one's own decisions (past, present, or future) are always (or even mostly) rational, let alone other people's. Rather, most purportedly rational or logical decisions are instead rationalized ones, and it is rational to acknowledge this. I'm not suggesting throwing the baby out with the bathwater, just awareness that as decision makers our ability to apply logic is limited (in economic terms 'bounded'). In fact, perhaps our limited ability to reason is best imagined as a baby: full of endless potential, yet weak and fragile, easily perturbed, and requiring near constant care, attention, even vigilance.