There's a lot of baseless conjecture in this as far as I can tell. >The SolarWind backdoor was deeply integrated into the code, it was injected during their bu

There's a lot of baseless conjecture in this as far as I can tell. >The SolarWind backdoor was deeply integrated into the code, it was injected during their build process, and there is no way that the server having a weak password was the pivotal factor. As if Russian Intelligence would just give up if there were a strong password instead! If this was a wikipedia article there'd be a [citation needed] every other word. I also wonder if they're not overplaying the skill of Russian cybersecurity agents. I'm sure they're good, I'm sure some of them are very, very good but the idea that basically they don't care about passwords is going too far IMO. The main advantage of being a state-sponsored hacker is that you have access to resources most other black hats couldn't dream of (like sending a team of burglars to ransack somebody's house, or physically threaten an employee) but that doesn't mean that they can stop obeying the laws of physics and algorithmics. >There is practically no chance that the server’s password was in anyway relevant to the hack overall. Source: my behind. I think the author has a good point that it's probably best to have a holistic approach about these hacks instead of focusing exclusively on some details, but the details do matter. After all, the big picture is nothing but a long series of details, isn't it? >Close does not count in security. In offensive security you’re either successful or not. When you’re dealing with access then the only possible states are: did it work? Yes or no. Whether you need 5 minutes or 5 weeks to get a shell, once you have that shell, it is the same level of game over. That’s what we’re talking about here. The technique used to gain access is a minor issue. Reductio ad absurdum. So what does the author want us to do then? Set our passwords to qwerty1234 and just give up? It's especially weird when the author a few paragraphs earlier states: >Could SolarWind have been too difficult for the KGB to use them in an enablement operation? Yes, it is possible to achieve that level of security. Creating a strong fast detection capability with rapid remediation and incident response will make it hard for attackers to dwell for any length of time, or persist on the system after they gain access. So it turns out that 5 minutes or 5 weeks does matter after all? I find very little of substance in this entire rant. Also the KGB doesn't exist anymore, I don't know if the author doesn't know that or decides to keep using it for stylistic reasons but real life is not an 80s American B movie.