5 ms·

What are the odds 3fs is backdoored?

huntaub 1y ago
I think that's a pretty odd concern to have. What would you imagine that looks like? If you're running these kinds of things securely, you should be locking down the network access to the hosts (they don't need outbound internet access, and they shouldn't need inbound access from anything except your application).
- xpe 1y ago
  > I think that's a pretty odd concern to have. Thinking about security risks is an odd concern to have?
  - huntaub 1y ago
    I think that worrying that a self-hosted file system has a backdoor to exfiltrate data is an odd concern. Security concerns are (obviously) normal, but you should not be exposing these kinds of services to the public internet (or giving them access to the public internet), eliminating the concern that it's giving your data away.
    - antonvs 1y ago
      Backdoors in self-hosted systems are one of the major state-level attack vectors, and there are many known examples of this. The idea that "you should not be exposing these kinds of services to the public internet (or giving them access to the public internet)" is naive. Aside from the fact that this requires every user to show that level of diligence - a completely unrealistic expectation - if a system is backdoored, it can also have means of exfiltrating data beyond just sending it out on the public internet. And then there's the obvious point that if you suspect a device is compromised, it's completely irresponsible to use it anyway and assume that you're going to be able to prevent unauthorized access. As some examples, there are documented concerns about Huawei/ZTE routers, which have been banned in Australia, New Zealand, Japan, Taiwan and the US for that reason. Unauthorized third-party code was found in Juniper Networks firewalls. Fortinet had hardcoded admin credentials in its firewalls and VPNs - probably a self-inflicted mistake, but still useful to attackers. Similarly, Western Digital NAS devices had a hardcoded backdoor account. D-Link routers had such a backdoor in their device web interface. There are many more examples like this. Snowden revealed some of the US government activities in this area. The US, Russia, China, North Korea and other countries have all been involved in attacks involving BIOS/UEFI firmware, router firmware, NAS, and manufacturing supply chains. Covert exfiltration has been involved in many of these cases, using techniques other than transmitting over the internet. And of course there was the recent (reported late 2024 Salt Typhoon attack by China on US and other Western telecom networks, which relied on these kinds of techniques, and gained access to large amounts of data, including audio and text of targeted people.
    - deleted 1y ago
      [deleted]
    - xpe 1y ago
      > I think that worrying that a self-hosted file system has a backdoor to exfiltrate data is an odd concern. Great security teams get paid to "worry", by which I mean "make a plan" for a given attack tree. Your use of "odd" looks like a rhetorical technique to downplay legitimate security considerations. From my point of view, you are casually waving away an essential area of security. See: https://www.paloaltonetworks.com/cyberpedia/data-exfiltration https://www.paloaltonetworks.com/cyberpedia/data-exfiltratio... > but you should not be exposing these kinds of services to the public internet (or giving them access to the public internet), eliminating the concern that it's giving your data away. Let's evaluate the following claim: "a "properly" isolated system would, in theory, have no risk of data exfiltration. Now we have to define what we mean. Isolated from the network? Running in a sandbox? What happens when that system can interact with a compromised system? What happens when people mess up? From a security POV, any software could have some component that is malicious, compromised, or backdoored. It might be in the project itself or in the supply chain. And so on. Defense in depth matters. None of the above concerns are "odd". A good security team is going to factor these in. P.S. If you mean "low probability" then just say that.
      - xmprt 1y ago
        I agree with the parent commenter. I think it's fair to be concerned with backdoors but this is a distributed file system which can be completely isolated from the outside world. If you're so worried, you could run it in an airgapped Faraday cage and do all your training in that environment. Just don't run it on any centrifuges. I think these kinds of concerns are more valid for storage systems which serve online traffic or have some kind of connection to the outside world.
        antonvs 1y ago
        Attackers, whether state-level, corporate, or criminal, all rely on ignorance like this. It also probably involves denial: you want to believe your systems are safe, so you delude yourself into thinking that minimal protections are sufficient. I wrote a longer comment about this here: https://news.ycombinator.com/item?id=43745423 https://news.ycombinator.com/item?id=43745423
        1y ago
MaxPock 1y ago
By, NSA or Britain's GCHQ which wants all software backdoored?
- xpe 1y ago
  Don't forget to add the CCP to the party. (DeepSeek has ties to the CCP.)

I think that's a pretty odd concern to have. What would you imagine that looks like? If you're running these kinds of things securely, you should be locking down the network access to the hosts (they don't need outbound internet access, and they shouldn't need inbound access from anything except your application).

xpe 1y ago
> I think that's a pretty odd concern to have. Thinking about security risks is an odd concern to have?
- huntaub 1y ago
  I think that worrying that a self-hosted file system has a backdoor to exfiltrate data is an odd concern. Security concerns are (obviously) normal, but you should not be exposing these kinds of services to the public internet (or giving them access to the public internet), eliminating the concern that it's giving your data away.
  - antonvs 1y ago
    Backdoors in self-hosted systems are one of the major state-level attack vectors, and there are many known examples of this. The idea that "you should not be exposing these kinds of services to the public internet (or giving them access to the public internet)" is naive. Aside from the fact that this requires every user to show that level of diligence - a completely unrealistic expectation - if a system is backdoored, it can also have means of exfiltrating data beyond just sending it out on the public internet. And then there's the obvious point that if you suspect a device is compromised, it's completely irresponsible to use it anyway and assume that you're going to be able to prevent unauthorized access. As some examples, there are documented concerns about Huawei/ZTE routers, which have been banned in Australia, New Zealand, Japan, Taiwan and the US for that reason. Unauthorized third-party code was found in Juniper Networks firewalls. Fortinet had hardcoded admin credentials in its firewalls and VPNs - probably a self-inflicted mistake, but still useful to attackers. Similarly, Western Digital NAS devices had a hardcoded backdoor account. D-Link routers had such a backdoor in their device web interface. There are many more examples like this. Snowden revealed some of the US government activities in this area. The US, Russia, China, North Korea and other countries have all been involved in attacks involving BIOS/UEFI firmware, router firmware, NAS, and manufacturing supply chains. Covert exfiltration has been involved in many of these cases, using techniques other than transmitting over the internet. And of course there was the recent (reported late 2024 Salt Typhoon attack by China on US and other Western telecom networks, which relied on these kinds of techniques, and gained access to large amounts of data, including audio and text of targeted people.
  - deleted 1y ago
    [deleted]
  - xpe 1y ago
    > I think that worrying that a self-hosted file system has a backdoor to exfiltrate data is an odd concern. Great security teams get paid to "worry", by which I mean "make a plan" for a given attack tree. Your use of "odd" looks like a rhetorical technique to downplay legitimate security considerations. From my point of view, you are casually waving away an essential area of security. See: https://www.paloaltonetworks.com/cyberpedia/data-exfiltration https://www.paloaltonetworks.com/cyberpedia/data-exfiltratio... > but you should not be exposing these kinds of services to the public internet (or giving them access to the public internet), eliminating the concern that it's giving your data away. Let's evaluate the following claim: "a "properly" isolated system would, in theory, have no risk of data exfiltration. Now we have to define what we mean. Isolated from the network? Running in a sandbox? What happens when that system can interact with a compromised system? What happens when people mess up? From a security POV, any software could have some component that is malicious, compromised, or backdoored. It might be in the project itself or in the supply chain. And so on. Defense in depth matters. None of the above concerns are "odd". A good security team is going to factor these in. P.S. If you mean "low probability" then just say that.
    - xmprt 1y ago
      I agree with the parent commenter. I think it's fair to be concerned with backdoors but this is a distributed file system which can be completely isolated from the outside world. If you're so worried, you could run it in an airgapped Faraday cage and do all your training in that environment. Just don't run it on any centrifuges. I think these kinds of concerns are more valid for storage systems which serve online traffic or have some kind of connection to the outside world.
      - antonvs 1y ago
        Attackers, whether state-level, corporate, or criminal, all rely on ignorance like this. It also probably involves denial: you want to believe your systems are safe, so you delude yourself into thinking that minimal protections are sufficient. I wrote a longer comment about this here: https://news.ycombinator.com/item?id=43745423 https://news.ycombinator.com/item?id=43745423
      - 1y ago

MaxPock 1y ago

By, NSA or Britain's GCHQ which wants all software backdoored?

xpe 1y ago
Don't forget to add the CCP to the party. (DeepSeek has ties to the CCP.)