7 ms·

Cool post. One thing that rubbed me the wrong way: Their response was better than 98% of other companies when it comes to reporting vulnerabilities. Very welcom

• mmastrac 1y ago
  I agree they could have worked more closely with the team, but the chat logging is actually pretty concerning. It's not sinophobia when they're logging _everything_ you say. (in fairness pervasive logging by American companies should probably be treated with the same level of hostility these days, lest you be stopped for a Vance meme)
  • rvnx 1y ago
    No, it was only in DAN mode
  • oceanplexian 1y ago
    This might come as a weird take but I'm less concerned about the Chinese logging my private information than an American company. What's China going to do? It's a far away country I don't live in and don't care about. If they got an American court order they would probably use it as toilet paper. On the other hand, OpenAI would trivially hand out my information to the FBI, NSA, US Gov, and might even do things on behalf of the government without a court order to stay in their good graces. This could have a far more material impact on your life.
    • dubcanada 1y ago
      That's rather naive, considering China has a international police unit, that is stationed in several countries https://en.wikipedia.org/wiki/Chinese_police_overseas_service_stations https://en.wikipedia.org/wiki/Chinese_police_overseas_servic...
      • ceejayoz 1y ago
        There's also the Mossad's approach to "you're out of our jurisdiction". https://en.wikipedia.org/wiki/Mordechai_Vanunu https://en.wikipedia.org/wiki/Mordechai_Vanunu https://en.wikipedia.org/wiki/Adolf_Eichmann https://en.wikipedia.org/wiki/Adolf_Eichmann
        • wongarsu 1y ago
          Also the CIA's approach https://en.wikipedia.org/wiki/Extraordinary_rendition https://en.wikipedia.org/wiki/Extraordinary_rendition Russia is more known for poisoning people. But of all of them China feels the least threatening if you are not Chinese. If you are Chinese you aren't safe from the Chinese government no matter where you are
          • bigiain 1y ago
            And the Saudi Bone Saw Diplomatic Team.
      • simlevesque 1y ago
        They only arrest chinese citizens.
      • Bjartr 1y ago
        Right, but the vast majority of people living in the USA as citizens have threat models that rightly do not include "Being disappeared by China"
        • CamperBob2 1y ago
          What about the threat model that goes, "Trump threatens to impose 1000% tariffs if Chinese don't immediately turn over copies of all data captured by their AI products from users in the US?" Compounding the difficulty of the question: half of HN thinks this would be a good idea.
          • WJW 1y ago
    • mschuster91 1y ago
      > What's China going to do? It's a far away country I don't live in and don't care about. Extortion is one thing. That's how spy agencies have operated for millennia to gather HUMINT. The Russians, the ultimate masters, even have a word for it: kompromat. You may not care about China, Russia, Israel, the UK or the US (the top nations when it comes to espionage) - but if you work at a place they're interested, they care about you. The other thing is, China has been known to operate overseas against targets (usually their own citizens and public dissidents), and so have the CIA and Mossad. Just search for "Chinese secret police station" [1], these have cropped up worldwide. And, even if you personally are of no interest to any foreign or national security service, sentiment analysis is a thing. Listen in on what people talk about, run it through a STT engine and a ML model to condense it down, and you get a pretty broad picture of what's going on in a nation (aka, what are potential wedge points in a society that can be used to fuel discontent). Or proximity gathering stuff... basically the same thing the ad industry [2] or Strava does [3], that can then be used in warfare. And no, I'm not paranoid. This, sadly, is the world we live in - there is no privacy any more, nowhere, and there are lots of financial and "national security" interest in keeping it that way. [1] https://www.bbc.com/news/world-us-canada-65305415 https://www.bbc.com/news/world-us-canada-65305415 [2] https://techxplore.com/news/2023-05-advertisers-tracking-thought-off-limits-expert.html https://techxplore.com/news/2023-05-advertisers-tracking-tho... [3] https://www.theguardian.com/world/2018/jan/28/fitness-tracking-app-gives-away-location-of-secret-us-army-bases https://www.theguardian.com/world/2018/jan/28/fitness-tracki...
      • Sanzig 1y ago
        > but if you work at a place they're interested, they care about you. And also worth noting that "place a hostile intelligence service may be interested in" can be extremely broad. I think people have this skewed impression they're only after assets that work for goverment departments and defense contractors, but really, everything is fair game. Communications infrastructure, social media networks, cutting edge R&D, financial services - these are all useful inputs for intelligence services. These are also softer targets: someone working for a defense contractor or for the government will have had training to identify foreign blackmail attempts and will be far more likely to notify their country's counterintelligence services (having the penalties for espionage clearly explained on the regular helps). Someone who works for a small SaaS vendor, though? Far less likely to understand the consequences.
    • mensetmanusman 1y ago
      China has a policy of chilling free speech in the west with political pressure.
      • immibis 1y ago
        So does the west.
        • rvnx 1y ago
          The censorship in the West is directly in the models
    • dylan604 1y ago
      These threads always seem to be what can China do to me in a limited way of thinking that China cannot jail you or something. However, do you think all of the Chinese data scrapers are not doing something similar to Facebook where every source of data gathering ultimately gets tied back to you? Once China has a dosier on every single person on the planet regardless of country they live, they can then start using their algos to influence you in ways well beyond advertising. If they can have their algos show you content that causes you to change your mind on who you are voting for or some other method of having you do something to make changes in your local/state/federal elections, then that's much worse to me than some feigned threat of Chinese advertising making you buy something
      • drawfloat 1y ago
        They probably will do that, but I think it’s naive to think the US military/intelligence/tech sector wouldn’t happily do the same. Given many of us likely see the hand of the US already trying to tip the scale in our local politics more than China, why would we be more worried of China?
        • dylan604 1y ago
          So flip the script, what do I care if the US is trying to influence the minds of adversary's citizens? If people are saying they don't care what China knows about them (not being a Chinese citizen), why should I (not a Chinese citizen) care what my gov't knows about Chinese citizens?
          • drawfloat 1y ago
            Nobody said they don’t care, they said it worries them less than America.
            • dylan604 1y ago
              The "don't care" is implied when someone says that "China knowing about me when I'm not in China nor a Chinese citizen"
    • IncreasePosts 1y ago
      Carry this package and deliver it to person X with you next time you fly. Go to the outskirts of this military base and take a picture and send it to us. You wouldn't want your mom finding out your weird sexual fetish, would you?
  • mrheosuper 1y ago
    i like to give them benefit of doubt. I bet that decision is decided solely by dev team. All the CEO care is "I want the chat log sync between devices, i don't care how you do this". They won't even know the chat log is stored on their server.
    • rvnx 1y ago
      It is only in DAN mode, so most likely it is not to spy but to be able to debug whether answers violate the laws in China (aka: that the prompt is efficient in all scenarios) as this is a serious crime
• transcriptase 1y ago
  >everything Chinese is spying on you When you combine the modern SOP of software and hardware collecting and phoning home with as much data about users as is technologically possible with laws that say “all orgs and citizens shall support, assist, and cooperate with state intelligence work”… how exactly is that Sinophobia?
  • Vilian 1y ago
    USA does the same thing, but uses tax money to pay for the information, between wasting taxpayer money and forcing companies to give the information for free, China is the least morally incorrect
  • ixtli 1y ago
    its sinophobia because it perfectly describes the conditions we live in in the US and many parts of europe, but we work hard to add lots of "nuance" when we criticize the west but its different and dystopian when They do it over there.
    • transcriptase 1y ago
      Do you remember that Sesame Street segment where they played a game and sang “One of these things is not like the others”? I’ll give you a hint: In this case it’s the one-party unitary authoritarian political system with an increasingly aggressive pursuit of global influence.
      • standardly 1y ago
        > one-party unitary authoritarian political system with an increasingly aggressive pursuit of global influence. The United States?
        • wombatpm 1y ago
          Global Bully maybe. The current administration has no concept of soft power, otherwise they would have kept USAID
• derac 1y ago
  I mean, at the end of the article they neglected to fix most of the issues and stopped responding.
• hnrodey 1y ago
  If all of the details in this post are to be believed, the vendor is repugnantly negligent for anything resembling customer respect, security and data privacy. This company cannot be helped. They cannot be saved through knowledge. See ya.
  • repelsteeltje 1y ago
    +1 Yes, even when you know what you're doing security incidents dan happen. And in those cases, your response to a vulnerable matters most. The point is there are so many dumb mistakes and worrying design flaws that neglect and incompetence seems ample. Most likely they simply don't grasp what they're doing
• repelsteeltje 1y ago
  > Overall simple security design flaws but it's good to see a company that cares to fix them, even if they didn't take security seriously from the start. It depends on what you mean by simple security design flaws. I'd rather frame it as, neglect or incompetence. That isn't the same as malice, of course, and they deserve credits for their relatively professional response as you already pointed out. But, come on, it reeks of people not understanding what they're doing. Not appreciating the context of a complicated device and delivering a high end service. If they're not up to it, they should not be doing this.
  • memesarecool 1y ago
    Yes I meant simple as in "amateur mistakes". From the mistakes (and their excitement and response to the report) they are clueless about security. Which of course is bad. Hopefully they will take security more seriously on the future.
• wyager 1y ago
  Note that the world-model "everything Chinese is spying on you" actually produced a substantially more accurate prediction of reality than the world-model you are advocating here. As far as being "very welcoming", that's nice, but it only goes so far to make up for irresponsible gross incompetence. They made a choice to sell a product that's z-tier flaming crap, and they ought to be treated accordingly.
  • thfuran 1y ago
    What world model exactly do you think they're advocating?
• butlike 1y ago
  They'll only patch it in the military model /s
• deleted 1y ago
  [deleted]
• billyhoffman 1y ago
  > Their response was better than 98% of other companies when it comes to reporting vulnerabilities. Very welcoming and most of all they showed interest and addressed the issues This was the opposite of a professional response: * Official communication coming from a Gmail. (Is this even an employee or some random contractor?) * Asked no clarifying questions * Gave no timelines for expected fixes, no expectations on when the next communication should be * No discussion about process to disclose the issues publicly * Mixing unrelated business discussions within a security discussion. While not an outright offer of a bribe, ANY adjacent comments about creating a business relationship like a sponsorship is wildly inappropriate in this context. These folks are total clown shoes on the security side, and the efficacy of their "fix", and then their lack of communication, further proves that.
• plorntus 1y ago
  To be honest the responses sounded copy and pasted straight from ChatGPT, it seemed like there was fake feigned interest into their non-existent youtube channel. > Overall simple security design flaws but it's good to see a company that cares to fix them, even if they didn't take security seriously from the start I don't think that should give anyone a free pass though. It was such a simple flaw that realistically speaking they shouldn't ever be trusted again. If it had been a non-obvious flaw that required going through lots of hoops then fair enough but they straight up had zero authentication. That isn't a 'flaw' you need an external researcher to tell you about. I personally believe companies should not be praised for responding to such a blatant disregard for quality, standards, privacy and security. No matter where they are from.
• jekwoooooe 1y ago
  It’s not sinophobia to point out an obvious pattern. It’s like saying talking about how terrorism (the kind that will actually affect you) is solely an Islamic issue, and then calling that islamophobic. It’s okay to recognize patterns my man.
• mensetmanusman 1y ago
  Nipponophobia is low because Japan didn’t successfully weaponize technology to make a social credit score police state for minority groups.
  • ixtli 1y ago
    they already terrorize minority groups there just fine: no need for technology.
• demarq 1y ago
  Same here. Also once it turned out to be an android device in debug mode the rest of the article was less interesting. Evil maid stuff
• dylan604 1y ago
  > And of course the usual sinophobia (e.g. everything Chinese is spying on you) to assume it is not spying on you is naive at best. to address your sinophobia label, personally, I assume everything is spying on me regardless of country of origin. I assume every single website is spying on me. I assume every single app is spying on me. I assume every single device that runs an app or loads a website is spying on me. Sometimes that spying is done for me, but pretty much always the person doing the spying is benefiting someway much greater than any benefit I receive. Especially the Facebook example of every website spying on me for Facebook, yet I don't use Facebook.
  • immibis 1y ago
    And, importantly, the USA spying can actually have an impact on your life in a way that the Chinese spying can't. Suppose you live in the USA and the USA is spying on you. Whatever information they collect goes into a machine learning system and it flags you for disappearal. You get disappeared. Suppose you live in the USA and China is spying on you. Whatever information they collect goes into a machine learning system and it flags you for disappearal. But you're not in China and have no ties to China so nothing happens to you. This is a strictly better scenario than the first one. If you're living in China with a Chinese family, of course, the scenarios are reversed.
• Aeolun 1y ago
  I think the response wouldn’t be so hostile if they had continued to engage. One round of fixes clearly wasn’t enough.
• throw10920 1y ago
  > And of course the usual sinophobia This is factually not sinophobia, by the literal definition of it - "prejudice, hatred, hostility, and discrimination that is directed towards Chinese people or Chinese culture" This tactic is straight out of the PRC influence playbook, badly breaks the HN guidelines, is extremely anti-intellectual and profoundly uninteresting. Please don't do it.