4 ms·

Please don't refer to that NYT article as "data" (noun: Facts and statistics collected together for reference or analysis). The it-must-have-been-us presumptive

Please don't refer to that NYT article as "data" (noun: Facts and statistics collected together for reference or analysis). The it-must-have-been-us presumptive mentality despite the absolute lack of concrete evidence bothers me to the point of contempt.

mmaunder 14y ago
Dear "forgotusername". David Sanger is a Pulitzer prize winning reporter and Chief White House correspondent for the NY Times where he has been for a spectacular 30 year career. He worked with the US administration to determine what data in that article was safe to publish and what would compromise ongoing ops.
- forgotusername 14y ago
  Making an appeal to authority doesn't change anything. Most people seem to fail to grasp that there is an $8bn industry spanning the globe who thrive on secret software vulnerabilities. Beyond the presence of these, the only surprising fact surrounding either worm is that Stuxnet targeted Siemens PLCs. If it weren't for that, there is nothing to demonstrate either of these worms weren't written by an entity as relatively benign as an acutely talented, bored teenager. But ignore reality, pepper dramatic terms like Iran, cyber war, espionage, license to kill around liberally and see what effect it has on your freedom to use your computer in coming years. That may be the only tangible result of all this hot air. You should also be aware that same industry stands to make the most direct gain from any increase in public perception of information security, and any resulting regulation.
  - Xylakant 14y ago
    > Beyond the presence of these, the only surprising fact surrounding either worm is that Stuxnet targeted Siemens PLCs. If it weren't for that, there is nothing to demonstrate either of these worms weren't written by an entity as relatively benign as an acutely talented, bored teenager. Apart from the fact that flame used a previously unknown chosen prefix collision attack against MD5? I'd love to meet that bored teenager... [see http://news.ycombinator.com/item?id=4080240 http://news.ycombinator.com/item?id=4080240]
  - tptacek 14y ago
    The raw compute time to calculate the MD5 collision used in Flame costs tens to hundreds of thousands of dollars --- there's a window of time within which the calculation has to complete --- and does not appear to have used the HashClash code that Marc Stevens published after the RapidSSL exploit. Flame wasn't a bored teenager.
- deleted 14y ago
  [deleted]
- uvdiv 14y ago
  So a sufficiently famous and prestigious scientist could get away with keeping all his data, methodology, and calculations secret, publishing only his conclusions, and have the world accept it all unquestioningly because of his "career" and "status"? No wonder journalism is such a disaster, if this is all we except of it.
jonknee 14y ago
The gov't seems to be taking it as fact.
lawnchair_larry 14y ago
It's not presumptive. It came from the whitehouse. It's basically a press release.
Spooky23 14y ago
You're being fed the government story re: leaks. They are leaking because the administration wants to be able to technically deny that it happened and avoid deeper questioning in public. At the same time, they get to control the timing, tempo and content of reporting in the mainstream press. From the Sanger story: "...according to participants in the program." "...based on interviews over the past 18 months with current and former American, European and Israeli officials involved in the program, as well as a range of outside experts. None would allow their names to be used because the effort remains highly classified, and parts of it continue to this day." "...according to participants in the many Situation Room meetings on Olympic Games" "Mr. Obama, according to officials in the room, asked a series of questions, fearful that the code could do damage outside the plant." "...the focus of attention, as one administration official put it, "has been overwhelmingly on one country."" Each one of these quotes indicates that an official senior enough in the US administration to be attending meetings on the topic with the President was willing to commit a serious crime by leaking this information to the press. Do you seriously think that a person crazy enough to leak secrets that would land him in prison would also take great pains to describe the President's deliberations on the topic as generously as this account does?
forgotusername 14y ago
Replying again since this is getting downvoted so hard. I made two distinct points, one of which was corrected by tptacek, the other, which is the above, I still stand by. There is a huge leap from "this is a technologically advanced piece of software" to "this is a virus written by the US government in collaboration with Mossad targeting evil regimes." I fail to see why people believe it so irrational to practice caution here - some of the most technically sophisticated code ever written happened in darkened bedrooms on a school night; David Huffman invented what to this day remains one of the most efficient coding systems working alone on a term paper while still at school. This is the only example that comes to mind, but computing, perhaps more than any other field is littered with examples of small groups having huge effects. Is it so hard to imagine some 20mb binary bundling SQLite and Lua might have been written outside of a heavily funded, super secret mountain base? I would posit more interesting than the existence of the code itself, is the behavior of otherwise seasoned computer nerds grasping desperately to the belief that this "weapon" could only be the creation of their own government, perhaps it is testament to little more than a failure of imagination.

mmaunder 14y ago

Dear "forgotusername". David Sanger is a Pulitzer prize winning reporter and Chief White House correspondent for the NY Times where he has been for a spectacular 30 year career. He worked with the US administration to determine what data in that article was safe to publish and what would compromise ongoing ops.

forgotusername 14y ago
Making an appeal to authority doesn't change anything. Most people seem to fail to grasp that there is an $8bn industry spanning the globe who thrive on secret software vulnerabilities. Beyond the presence of these, the only surprising fact surrounding either worm is that Stuxnet targeted Siemens PLCs. If it weren't for that, there is nothing to demonstrate either of these worms weren't written by an entity as relatively benign as an acutely talented, bored teenager. But ignore reality, pepper dramatic terms like Iran, cyber war, espionage, license to kill around liberally and see what effect it has on your freedom to use your computer in coming years. That may be the only tangible result of all this hot air. You should also be aware that same industry stands to make the most direct gain from any increase in public perception of information security, and any resulting regulation.
- Xylakant 14y ago
  > Beyond the presence of these, the only surprising fact surrounding either worm is that Stuxnet targeted Siemens PLCs. If it weren't for that, there is nothing to demonstrate either of these worms weren't written by an entity as relatively benign as an acutely talented, bored teenager. Apart from the fact that flame used a previously unknown chosen prefix collision attack against MD5? I'd love to meet that bored teenager... [see http://news.ycombinator.com/item?id=4080240 http://news.ycombinator.com/item?id=4080240]
- tptacek 14y ago
  The raw compute time to calculate the MD5 collision used in Flame costs tens to hundreds of thousands of dollars --- there's a window of time within which the calculation has to complete --- and does not appear to have used the HashClash code that Marc Stevens published after the RapidSSL exploit. Flame wasn't a bored teenager.
deleted 14y ago
[deleted]
uvdiv 14y ago
So a sufficiently famous and prestigious scientist could get away with keeping all his data, methodology, and calculations secret, publishing only his conclusions, and have the world accept it all unquestioningly because of his "career" and "status"? No wonder journalism is such a disaster, if this is all we except of it.

jonknee 14y ago

The gov't seems to be taking it as fact.

lawnchair_larry 14y ago

It's not presumptive. It came from the whitehouse. It's basically a press release.

Spooky23 14y ago

You're being fed the government story re: leaks. They are leaking because the administration wants to be able to technically deny that it happened and avoid deeper questioning in public. At the same time, they get to control the timing, tempo and content of reporting in the mainstream press. From the Sanger story: "...according to participants in the program." "...based on interviews over the past 18 months with current and former American, European and Israeli officials involved in the program, as well as a range of outside experts. None would allow their names to be used because the effort remains highly classified, and parts of it continue to this day." "...according to participants in the many Situation Room meetings on Olympic Games" "Mr. Obama, according to officials in the room, asked a series of questions, fearful that the code could do damage outside the plant." "...the focus of attention, as one administration official put it, "has been overwhelmingly on one country."" Each one of these quotes indicates that an official senior enough in the US administration to be attending meetings on the topic with the President was willing to commit a serious crime by leaking this information to the press. Do you seriously think that a person crazy enough to leak secrets that would land him in prison would also take great pains to describe the President's deliberations on the topic as generously as this account does?

forgotusername 14y ago

Replying again since this is getting downvoted so hard. I made two distinct points, one of which was corrected by tptacek, the other, which is the above, I still stand by. There is a huge leap from "this is a technologically advanced piece of software" to "this is a virus written by the US government in collaboration with Mossad targeting evil regimes." I fail to see why people believe it so irrational to practice caution here - some of the most technically sophisticated code ever written happened in darkened bedrooms on a school night; David Huffman invented what to this day remains one of the most efficient coding systems working alone on a term paper while still at school. This is the only example that comes to mind, but computing, perhaps more than any other field is littered with examples of small groups having huge effects. Is it so hard to imagine some 20mb binary bundling SQLite and Lua might have been written outside of a heavily funded, super secret mountain base? I would posit more interesting than the existence of the code itself, is the behavior of otherwise seasoned computer nerds grasping desperately to the belief that this "weapon" could only be the creation of their own government, perhaps it is testament to little more than a failure of imagination.