5 ms·

These supposed messages between him and the state department lead me to believe it's either all or mostly exagerations or lies: https://imgur.com/a/s-lX6inGA ht

by vasco 2y ago

These supposed messages between him and the state department lead me to believe it's either all or mostly exagerations or lies: https://imgur.com/a/s-lX6inGA https://imgur.com/a/s-lX6inGA Maybe it's just my lack of knowledge of some regionalism, but doesn't it seem very odd that a technical person would use "in the open source", to refer not to code, but to a PR article on some news website?

shzhdbi09gv8ioi 2y ago
See OSINT. It's well established terminology. https://en.wikipedia.org/wiki/Open-source_intelligence https://en.wikipedia.org/wiki/Open-source_intelligence
- vasco 2y ago
  Thanks, never heard this in just technical circles but haven't been close to any security work.
- TeMPOraL 2y ago
  It's a weird term. My impression is that it mostly means "randos LARPing spies", though there's a commercial angle too, it being to intelligence what PMCs are to the military. May or may not be called after "Open Source Publishing, Incorporated", featured here: [0]. -- [0] - https://irp.fas.org/congress/2005_hr/062105jardines.pdf https://irp.fas.org/congress/2005_hr/062105jardines.pdf
  - red-iron-pine 2y ago
    it is not a weird term, and is absolutely a thing. a big deal in 2024, really. back in the day it was just "reading the newspapers and talking to the local cab drivers", but on 2024 you're scanning forums and social media, on top of news sites. go to a military-related subreddit and start asking questions about stuff, and you'll eventually get an expert to chime in. Make wrong & stupid claims and then have them slap you down and spill some details -- that's how they got dudes to release classified tank info in Warthunder. dudes in Palestine and in Ukraine are getting killed because they post selfies and tweets that have GPS coordinates in the metadata. Not hidden behind any top secret firewall, easy to find if you're checking VK or Instagram, but very real implications for dropping bombs. OSINT is also absolutely a thing in Cyber, where you can get a lot of details about a target by reading their press releases -- "Corp X signs big new deal with Oracle" -- which can give you a new attack surface. Phishing, on a long, broad timeline, has a very high success rate, so go onto Linkedin and start connecting to people. Figure out their tech stack, create a Sales Guy account, and start reaching out to Architects and Managers, and then map out the teams that might have elevated access...
    - jolmg 2y ago
      > OSINT is also absolutely a thing in Cyber First time I see "cyber" used as a noun. Is that short for "cyberspace", i.e. the internet, or is it something else?
      - cwillu 2y ago
        Five-sided thought is a hell of a drug, are you _sure_ you want to know?
      - Suppafly 2y ago
        the military uses it to describe all things relating to the internet, the rest of us used to use it to mean cybersex, which why you mostly only ever hear it from military folks and c-suite type people now and the rest of us kinda chuckle under our breath every time they mention it.
      - wkat4242 2y ago
        Cybersecurity i think.
  - rightbyte 2y ago
    Ye they are larpers that sell security consulting etc. It is a scam. Especially attribution of hacks to states that are on the Washington shit list. There is just no way to know.
  - jjmarr 2y ago
    https://www.foreignaffairs.com/world/open-secrets-ukraine-intelligence-revolution-amy-zegart https://www.foreignaffairs.com/world/open-secrets-ukraine-in... To summarize, there are many people in government who are interested in open source intelligence. Traditional sources of intelligence are gathered with secret means and therefore must be restricted in distribution to prevent burning the source. This means you can have the best possible intelligence but be unable to a) act on it or b) distribute it to people who can. The value proposition of using open-source intelligence is that you can distribute it very widely to decisionmakers since it's already "out in the open". Intelligence isn't about hoarding secrets for the sake of such; it's about getting information to people who can use it. The political issue is that people assume that "secret = higher quality" when there's no inherent value to secrecy. So, spy agencies overinvest in secret-gathering, get a ton of info, and are unable to do anything with it. Meanwhile, if someone posts a tank manual on the WarThunder gaming forums you can give that to every soldier that might encounter that tank. This is doubly important in tech because many big tech companies play a significant role in national security but cannot get intelligence that would help protect them, and by extension, American interests.
deleted 2y ago
[deleted]
everforward 2y ago
I was getting kind of similar vibes. When they reveal the story, it’s basically “traceroute identifies 2 choke point routers, and I DDoSed them with traffic”. That’s cool and neat for guerrilla warfare, but I would assume the NSA and DoD are already aware of that possibility? I wouldn’t even be surprised if they saw the DDoS happening on network monitoring tools. Why clandestine meetings for that? I get why the media is interested, it’s an awesome story.
- vasco 2y ago
  I imagine the NSA has a fully mapped out network layout for most major foes continuously updated in some sort of inventory database but for enemies, the same way they track large military gear and in which bases its at for their enemies. So yeah this seems very strange.
  - csunbird 2y ago
    NSA and similar agencies are probably even mad at him, because he exposed the weakness that they could have exploited when needed, which is probably now patched.
    - consumer451 2y ago
      > NSA and similar agencies are probably even mad at him, because he exposed the weakness that they could have exploited when needed, which is probably now patched. Then they should have caught this when he came forward to multiple agencies, and was told that no one cared. Please see my related comment as to why I submitted his AMA to HN. It's to bring to light this egregious lapse in US gov procedures: https://news.ycombinator.com/item?id=40733355 https://news.ycombinator.com/item?id=40733355 Disclaimer: I do see the possible benefits for citizen liberty, where all agencies do not share every interaction with citizens. However, when a US citizen volunteers something actionable, there should be a special cross-agency path.
      - everforward 2y ago

by vasco 2y ago

shzhdbi09gv8ioi 2y ago

See OSINT. It's well established terminology. https://en.wikipedia.org/wiki/Open-source_intelligence https://en.wikipedia.org/wiki/Open-source_intelligence

vasco 2y ago
Thanks, never heard this in just technical circles but haven't been close to any security work.
TeMPOraL 2y ago
It's a weird term. My impression is that it mostly means "randos LARPing spies", though there's a commercial angle too, it being to intelligence what PMCs are to the military. May or may not be called after "Open Source Publishing, Incorporated", featured here: [0]. -- [0] - https://irp.fas.org/congress/2005_hr/062105jardines.pdf https://irp.fas.org/congress/2005_hr/062105jardines.pdf
- red-iron-pine 2y ago
  it is not a weird term, and is absolutely a thing. a big deal in 2024, really. back in the day it was just "reading the newspapers and talking to the local cab drivers", but on 2024 you're scanning forums and social media, on top of news sites. go to a military-related subreddit and start asking questions about stuff, and you'll eventually get an expert to chime in. Make wrong & stupid claims and then have them slap you down and spill some details -- that's how they got dudes to release classified tank info in Warthunder. dudes in Palestine and in Ukraine are getting killed because they post selfies and tweets that have GPS coordinates in the metadata. Not hidden behind any top secret firewall, easy to find if you're checking VK or Instagram, but very real implications for dropping bombs. OSINT is also absolutely a thing in Cyber, where you can get a lot of details about a target by reading their press releases -- "Corp X signs big new deal with Oracle" -- which can give you a new attack surface. Phishing, on a long, broad timeline, has a very high success rate, so go onto Linkedin and start connecting to people. Figure out their tech stack, create a Sales Guy account, and start reaching out to Architects and Managers, and then map out the teams that might have elevated access...
  - jolmg 2y ago
    > OSINT is also absolutely a thing in Cyber First time I see "cyber" used as a noun. Is that short for "cyberspace", i.e. the internet, or is it something else?
    - cwillu 2y ago
      Five-sided thought is a hell of a drug, are you _sure_ you want to know?
    - Suppafly 2y ago
      the military uses it to describe all things relating to the internet, the rest of us used to use it to mean cybersex, which why you mostly only ever hear it from military folks and c-suite type people now and the rest of us kinda chuckle under our breath every time they mention it.
    - wkat4242 2y ago
      Cybersecurity i think.
- rightbyte 2y ago
  Ye they are larpers that sell security consulting etc. It is a scam. Especially attribution of hacks to states that are on the Washington shit list. There is just no way to know.
- jjmarr 2y ago
  https://www.foreignaffairs.com/world/open-secrets-ukraine-intelligence-revolution-amy-zegart https://www.foreignaffairs.com/world/open-secrets-ukraine-in... To summarize, there are many people in government who are interested in open source intelligence. Traditional sources of intelligence are gathered with secret means and therefore must be restricted in distribution to prevent burning the source. This means you can have the best possible intelligence but be unable to a) act on it or b) distribute it to people who can. The value proposition of using open-source intelligence is that you can distribute it very widely to decisionmakers since it's already "out in the open". Intelligence isn't about hoarding secrets for the sake of such; it's about getting information to people who can use it. The political issue is that people assume that "secret = higher quality" when there's no inherent value to secrecy. So, spy agencies overinvest in secret-gathering, get a ton of info, and are unable to do anything with it. Meanwhile, if someone posts a tank manual on the WarThunder gaming forums you can give that to every soldier that might encounter that tank. This is doubly important in tech because many big tech companies play a significant role in national security but cannot get intelligence that would help protect them, and by extension, American interests.

deleted 2y ago

[deleted]

everforward 2y ago

I was getting kind of similar vibes. When they reveal the story, it’s basically “traceroute identifies 2 choke point routers, and I DDoSed them with traffic”. That’s cool and neat for guerrilla warfare, but I would assume the NSA and DoD are already aware of that possibility? I wouldn’t even be surprised if they saw the DDoS happening on network monitoring tools. Why clandestine meetings for that? I get why the media is interested, it’s an awesome story.

vasco 2y ago
I imagine the NSA has a fully mapped out network layout for most major foes continuously updated in some sort of inventory database but for enemies, the same way they track large military gear and in which bases its at for their enemies. So yeah this seems very strange.
- csunbird 2y ago
  NSA and similar agencies are probably even mad at him, because he exposed the weakness that they could have exploited when needed, which is probably now patched.
  - consumer451 2y ago
    > NSA and similar agencies are probably even mad at him, because he exposed the weakness that they could have exploited when needed, which is probably now patched. Then they should have caught this when he came forward to multiple agencies, and was told that no one cared. Please see my related comment as to why I submitted his AMA to HN. It's to bring to light this egregious lapse in US gov procedures: https://news.ycombinator.com/item?id=40733355 https://news.ycombinator.com/item?id=40733355 Disclaimer: I do see the possible benefits for citizen liberty, where all agencies do not share every interaction with citizens. However, when a US citizen volunteers something actionable, there should be a special cross-agency path.
    - everforward 2y ago