4 ms·

Why not judge on the merit. Unlike PRC's deepseek or tiktok which were shown and admitted to collect all sorts of data and specifically influence public opinio

Why not judge on the merit. Unlike PRC's deepseek or tiktok which were shown and admitted to collect all sorts of data and specifically influence public opinion to favor a foreign interest this is literally just information, white hat infosec research

shakna 2y ago
You cannot divorce the company from their other actions. They are engaged in cyber warfare with various nations. That means that all of their actions need to be weighed and judged. They put it on their website, which makes it company PR, regardless of how it might be seen. Good things have been done by terrible actors, since the dawn of time. It is not information alone.
- 2Gkashmiri 2y ago
  careful or you would have to divorce google because of their actions but the larger question is, will you?
  - shakna 2y ago
    I don't believe Google has directly caused the leaking of classified information, or attacking vital infrastructure, as of yet. Kaspersky, yes [0]. TikTok, yes [1]. Google do, however, publish information on commercial spy networks [2]. However, it is likely that I would do so if they show themselves to be an enemy of my nation. If you've found Google attacking a government, I'm sure plenty of people would love to see the evidence. [0] https://securityaffairs.com/174586/intelligence/australia-bans-kaspersky-over-national-security-concerns.html https://securityaffairs.com/174586/intelligence/australia-ba... [1] https://www.nytimes.com/2022/12/22/technology/byte-dance-tik-tok-internal-investigation.html https://www.nytimes.com/2022/12/22/technology/byte-dance-tik... [2] https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors_-_TAG_report.pdf https://storage.googleapis.com/gweb-uniblog-publish-prod/doc...
    - TheSpiceIsLife 2y ago
      Your first link doesn't show any evidence of, or even suggest that, Kaspersky has attacked Australia. It shows only that the Australian government expresses concern over the capability, which doesn't seem entirely unreasonable and also politically motivated. Oceania has always been at war Eastasia, and all that.
      - shakna 2y ago
        > Entities must manage the risks arising from Kaspersky Lab, Inc.’s extensive collection of user data and exposure of that data to extrajudicial directions from a foreign government that conflict with Australian law. That's not concern of possibility. That's acknowledgement of exfiltration of data, back to Russia. Past tense. This is political, yes. But only insofar as all actions of one nation against another is political. Australia go to some lengths not to piss Russia off. If things were not so political, then the response would likely be much greater, not less.
        TheSpiceIsLife 2y ago
        What user data? Telemetry from using their antivirus products? Is that what they’re talking about?
        throwaway290 2y ago
        Uhm if you read the kind of thing Aussie government hackers were doing lately... They are perfectly fine pissing off Russia:) (There are plenty of actual threats from there, just kaspersky doesn't seem one)
- archerx 2y ago
  Are you weighing and judging thAt USA has killed millions of innocent people because of American Military Industrial complex before buying American products? You can’t divorce a company from it’s countries politics as you say. If you are not judging the USA at the same standards as you do other countries then that would be very hypocritical.
  - shakna 2y ago
    The first few years of my life were in Bolivia. Where our prime minister, for the sin of being elected by the people, was shot dead on the streets of the capital, a street I lived on, by the CIA. I still have friends, who serve Morales today. I am well aware of the sins of the US. Until Trump, the USA was not a direct threat to the nation I now live in. However, nuance is lacking in your response. You cannot divorce a company serving its government, from the politics it lives in. There's little evidence of Y-Combinator, for example, of endeavouring to upend their entire business to serve as spies for the USA. If Kaspersky was divorced from the KGB, politics would not be as considerable a context for understanding their actions.
    - throwawayqqq11 2y ago
      > You cannot divorce a company serving its government I would extend that to "a company bound by law", since governments can change. [0] Most people here argue that google, etc. have not been caught stealing/leaking data yet, as if Snowden didnt happen. And as if any foreign citizen data isnt fair game to US juristiction. [1] 0: https://en.m.wikipedia.org/wiki/Protect_America_Act_of_2007 https://en.m.wikipedia.org/wiki/Protect_America_Act_of_2007 1: https://www.dni.gov/files/icotr/ACLU%2016-CV-8936%20(RMB)%20001001-001049%20-%20Doc%2017.%20NSA%E2%80%99s%20Training%20on%20FISA%20Amendments%20Act%20Section%20702.pdf https://www.dni.gov/files/icotr/ACLU%2016-CV-8936%20(RMB)%20...
    - archerx 2y ago
      So it only matters when it’s direct threat to you huh? All those people who suffered in the Middle East don’t matter? Cool story bro.
- jajko 2y ago
  In that vein Europe should have 0% trust in any US software or hardware. We are not that much friends anymore, in fact US is currently actively helping our existential enemy and subverting us. Remember of scandal with US spying directly all European top politicians? This was in quiet times compared to now. To paraphrase you, terrible things have been done by good actors. You cannot divorce state from its other actions in same area neither. I don't think I need to bring up numerous fuckups of US 'defense' and secret services that literally killed tens of millions civilians in past 100 years across whole globe, with very little to show for and claim 'it was worth it because we achieved XYZ'.
  - shakna 2y ago
    As of now? I am making noise with my government on the US. The nation has dismantled their protections, they have an unhinged preacher of hatred in the White House, and he has a proven record of breaking international agreements. Starlink and Tesla are security concerns. The US' current attitudes suggest that they would very much like to see world war three. And would like to ally with Russia to make it happen. Recklessly endangering international agreements will not be without consequences.
- throwaway290 2y ago
  > You cannot divorce the company from their other actions. They are engaged in cyber warfare with various nations. If there is source with evidence of that warfare, that can change my mind
ajross 2y ago
The whole point to reading an article like this is to get the considered opinions of an expert, though, not to "judge it on the merit". Only an elite handful of security folks here on HN (and this is one of the few forums where you can find them!) are capable of doing that. So sure, when another security wonk comes along and says "Kaspersky is right about this", I think it's worth discussing. Until then, we need to assume that any communication from the company is compromised by unstated interests. Not all of it is, surely, but some probably is, and "judge it on the merit" isn't a good standard to detect the bullshit.
- throwaway290 2y ago
  I think you overmystify, this kind of research is not exclusive to a handful of folks, and it's all verifiable and clear
  - ajross 2y ago
    It's not about "mysitification", it's about laziness. I read security reviews and blog posts because it's easier than trying to follow CVEs and the like myself. And the way that works is that I trust the source to give me a reasonably unadulterated good faith summary of the facts on the ground. We can't trust Kaspersky. They're compromised by a government that's known to lie and manipulate. Again, they may be telling the truth here (certainly doesn't seem controversial), but I'm going to wait for someone I trust to tell me that.
    - throwaway290 2y ago
      I still don't get why you think I suggest you should "trust" anything
      - ajross 2y ago
        I still don't get why you think I should read something I don't trust.

shakna 2y ago

You cannot divorce the company from their other actions. They are engaged in cyber warfare with various nations. That means that all of their actions need to be weighed and judged. They put it on their website, which makes it company PR, regardless of how it might be seen. Good things have been done by terrible actors, since the dawn of time. It is not information alone.

2Gkashmiri 2y ago
careful or you would have to divorce google because of their actions but the larger question is, will you?
- shakna 2y ago
  I don't believe Google has directly caused the leaking of classified information, or attacking vital infrastructure, as of yet. Kaspersky, yes [0]. TikTok, yes [1]. Google do, however, publish information on commercial spy networks [2]. However, it is likely that I would do so if they show themselves to be an enemy of my nation. If you've found Google attacking a government, I'm sure plenty of people would love to see the evidence. [0] https://securityaffairs.com/174586/intelligence/australia-bans-kaspersky-over-national-security-concerns.html https://securityaffairs.com/174586/intelligence/australia-ba... [1] https://www.nytimes.com/2022/12/22/technology/byte-dance-tik-tok-internal-investigation.html https://www.nytimes.com/2022/12/22/technology/byte-dance-tik... [2] https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors_-_TAG_report.pdf https://storage.googleapis.com/gweb-uniblog-publish-prod/doc...
  - TheSpiceIsLife 2y ago
    Your first link doesn't show any evidence of, or even suggest that, Kaspersky has attacked Australia. It shows only that the Australian government expresses concern over the capability, which doesn't seem entirely unreasonable and also politically motivated. Oceania has always been at war Eastasia, and all that.
    - shakna 2y ago
      > Entities must manage the risks arising from Kaspersky Lab, Inc.’s extensive collection of user data and exposure of that data to extrajudicial directions from a foreign government that conflict with Australian law. That's not concern of possibility. That's acknowledgement of exfiltration of data, back to Russia. Past tense. This is political, yes. But only insofar as all actions of one nation against another is political. Australia go to some lengths not to piss Russia off. If things were not so political, then the response would likely be much greater, not less.
      - TheSpiceIsLife 2y ago
        What user data? Telemetry from using their antivirus products? Is that what they’re talking about?
      - throwaway290 2y ago
        Uhm if you read the kind of thing Aussie government hackers were doing lately... They are perfectly fine pissing off Russia:) (There are plenty of actual threats from there, just kaspersky doesn't seem one)
archerx 2y ago
Are you weighing and judging thAt USA has killed millions of innocent people because of American Military Industrial complex before buying American products? You can’t divorce a company from it’s countries politics as you say. If you are not judging the USA at the same standards as you do other countries then that would be very hypocritical.
- shakna 2y ago
  The first few years of my life were in Bolivia. Where our prime minister, for the sin of being elected by the people, was shot dead on the streets of the capital, a street I lived on, by the CIA. I still have friends, who serve Morales today. I am well aware of the sins of the US. Until Trump, the USA was not a direct threat to the nation I now live in. However, nuance is lacking in your response. You cannot divorce a company serving its government, from the politics it lives in. There's little evidence of Y-Combinator, for example, of endeavouring to upend their entire business to serve as spies for the USA. If Kaspersky was divorced from the KGB, politics would not be as considerable a context for understanding their actions.
  - throwawayqqq11 2y ago
    > You cannot divorce a company serving its government I would extend that to "a company bound by law", since governments can change. [0] Most people here argue that google, etc. have not been caught stealing/leaking data yet, as if Snowden didnt happen. And as if any foreign citizen data isnt fair game to US juristiction. [1] 0: https://en.m.wikipedia.org/wiki/Protect_America_Act_of_2007 https://en.m.wikipedia.org/wiki/Protect_America_Act_of_2007 1: https://www.dni.gov/files/icotr/ACLU%2016-CV-8936%20(RMB)%20001001-001049%20-%20Doc%2017.%20NSA%E2%80%99s%20Training%20on%20FISA%20Amendments%20Act%20Section%20702.pdf https://www.dni.gov/files/icotr/ACLU%2016-CV-8936%20(RMB)%20...
  - archerx 2y ago
    So it only matters when it’s direct threat to you huh? All those people who suffered in the Middle East don’t matter? Cool story bro.
jajko 2y ago
In that vein Europe should have 0% trust in any US software or hardware. We are not that much friends anymore, in fact US is currently actively helping our existential enemy and subverting us. Remember of scandal with US spying directly all European top politicians? This was in quiet times compared to now. To paraphrase you, terrible things have been done by good actors. You cannot divorce state from its other actions in same area neither. I don't think I need to bring up numerous fuckups of US 'defense' and secret services that literally killed tens of millions civilians in past 100 years across whole globe, with very little to show for and claim 'it was worth it because we achieved XYZ'.
- shakna 2y ago
  As of now? I am making noise with my government on the US. The nation has dismantled their protections, they have an unhinged preacher of hatred in the White House, and he has a proven record of breaking international agreements. Starlink and Tesla are security concerns. The US' current attitudes suggest that they would very much like to see world war three. And would like to ally with Russia to make it happen. Recklessly endangering international agreements will not be without consequences.
throwaway290 2y ago
> You cannot divorce the company from their other actions. They are engaged in cyber warfare with various nations. If there is source with evidence of that warfare, that can change my mind

ajross 2y ago

The whole point to reading an article like this is to get the considered opinions of an expert, though, not to "judge it on the merit". Only an elite handful of security folks here on HN (and this is one of the few forums where you can find them!) are capable of doing that. So sure, when another security wonk comes along and says "Kaspersky is right about this", I think it's worth discussing. Until then, we need to assume that any communication from the company is compromised by unstated interests. Not all of it is, surely, but some probably is, and "judge it on the merit" isn't a good standard to detect the bullshit.

throwaway290 2y ago
I think you overmystify, this kind of research is not exclusive to a handful of folks, and it's all verifiable and clear
- ajross 2y ago
  It's not about "mysitification", it's about laziness. I read security reviews and blog posts because it's easier than trying to follow CVEs and the like myself. And the way that works is that I trust the source to give me a reasonably unadulterated good faith summary of the facts on the ground. We can't trust Kaspersky. They're compromised by a government that's known to lie and manipulate. Again, they may be telling the truth here (certainly doesn't seem controversial), but I'm going to wait for someone I trust to tell me that.
  - throwaway290 2y ago
    I still don't get why you think I suggest you should "trust" anything
    - ajross 2y ago
      I still don't get why you think I should read something I don't trust.