4 ms·

The title of the register article is completely disgusting > Putin on the code: DoD reportedly relies on utility written by Russian dev then in the article:

The title of the register article is completely disgusting > Putin on the code: DoD reportedly relies on utility written by Russian dev then in the article: > Hunted Labs told us that it didn't speak to Malinochkin prior to publication of its report today, and that it found no ties between him and any threat actor.

actionfromafar 1y ago
Aren't Russian developers on average more susceptible to the "wrench attack" though?
- em-bee 1y ago
  they would probably still fake their identity to hide their tracks.
- ChrisMarshallNY 1y ago
  Many of them don't live in Russia. Some of the best engineers that I've worked with (in the US and Europe) are Russian. I've also been quite impressed with other former Iron Curtain developers. A lot of Chinese folks I've worked with have been good. I know that some nations are known for threatening the relatives of expats, to get them to work on their behalf. Not very nice. But state-sponsored Russian (or other nations, as well) is definitely something to be concerned about. I suspect a number of folks are concerned about the influence of American programmers. The CIA is known for using fairly innocuous employees of NPOs. My father was one.
  - kube-system 1y ago
    > Many of them don't live in Russia. Well Malinochkin does. His GitHub profile says he is located in a suburb 30 minutes from the Kremlin. Of course, there's a lot of smart software engineers in major cities all around the world.
    - oneshtein 1y ago
      The FSB is looking for people they can recruit, even here, on HackerNews, too. Look at the HN news history. You will find stories about Russian history or culture. In comments, some people are expressing their fascination with Russia or its culture. This is how FSB identifies potential sympathizers, who are easy to recruit. Most likely, some of those, who expressed their sympathy under such news articles a year or two ago, are already recruited by FSB.
- pabs3 1y ago
  Not necessarily, Australia has a law allowing the government to compel software devs to add backdoors and gag them to prevent people hearing about the backdoors. https://scarff.id.au/blog/2023/state-actors-can-add-a-backdoor-to-signal/ https://scarff.id.au/blog/2023/state-actors-can-add-a-backdo...
  - int_19h 1y ago
    While Russia doesn't need laws for that. You just get arrested for something else (e.g. planted drugs) and then tortured in detention.
aurareturn 1y ago
The title of the register article is completely disgusting Nearly all The Register articles are clickbaits or rage baits.
- nwellnhof 1y ago
  They're also from Great Britain which seems to have the most irrational hatred for everything Russian.
weirdpickles 1y ago
Yeah, it is pretty amazing but not surprising. The Register has taken to a certain kind of sensationalism as of late. I found this interesting: > "Every piece of code written by Russians isn't automatically suspect, but popular packages with no external oversight are ripe for the taking by state or state-backed actors looking to further their aims," Smith told us in an email. "As a whole, the open source community should be paying more attention to this risk and mitigating it." Uh, I guess? The nature of open source is supposed to be that the dev provides the effort and the code, and that's where the guarantee stops. It is up to the people who uses it to implement and ensure security. People treat OSS like it is a business product that must have drop-in replacement ready at all times. The modern nature of development is perhaps my biggest gripe as a professional. There is little care given. Projects begin with importing dozens of other packages and libraries that we never look at, let alone fully understand. And it is normalized.
shark1 1y ago
Yeah, the subtle way to plant an idea. It's a crime again to a person have "certain nationalities".
- int_19h 1y ago
  The real concern isn't the nationality per se, it's the vulnerability to blackmail by the state that has jurisdiction over you. It's not a matter of personal responsibility, but nevertheless it has to be accounted for. For example, I am an American citizen, but I have extended family in Russia, and I would fully expect a place like DoD to be wary of that solely on the basis that it makes me susceptible to blackmail by Russian govt agencies by threatening my family.
  - shark1 1y ago
    Yes, I know. My point is that writers could easily do it better.

actionfromafar 1y ago

Aren't Russian developers on average more susceptible to the "wrench attack" though?

em-bee 1y ago
they would probably still fake their identity to hide their tracks.
ChrisMarshallNY 1y ago
Many of them don't live in Russia. Some of the best engineers that I've worked with (in the US and Europe) are Russian. I've also been quite impressed with other former Iron Curtain developers. A lot of Chinese folks I've worked with have been good. I know that some nations are known for threatening the relatives of expats, to get them to work on their behalf. Not very nice. But state-sponsored Russian (or other nations, as well) is definitely something to be concerned about. I suspect a number of folks are concerned about the influence of American programmers. The CIA is known for using fairly innocuous employees of NPOs. My father was one.
- kube-system 1y ago
  > Many of them don't live in Russia. Well Malinochkin does. His GitHub profile says he is located in a suburb 30 minutes from the Kremlin. Of course, there's a lot of smart software engineers in major cities all around the world.
  - oneshtein 1y ago
    The FSB is looking for people they can recruit, even here, on HackerNews, too. Look at the HN news history. You will find stories about Russian history or culture. In comments, some people are expressing their fascination with Russia or its culture. This is how FSB identifies potential sympathizers, who are easy to recruit. Most likely, some of those, who expressed their sympathy under such news articles a year or two ago, are already recruited by FSB.
pabs3 1y ago
Not necessarily, Australia has a law allowing the government to compel software devs to add backdoors and gag them to prevent people hearing about the backdoors. https://scarff.id.au/blog/2023/state-actors-can-add-a-backdoor-to-signal/ https://scarff.id.au/blog/2023/state-actors-can-add-a-backdo...
- int_19h 1y ago
  While Russia doesn't need laws for that. You just get arrested for something else (e.g. planted drugs) and then tortured in detention.

aurareturn 1y ago

The title of the register article is completely disgusting Nearly all The Register articles are clickbaits or rage baits.

nwellnhof 1y ago
They're also from Great Britain which seems to have the most irrational hatred for everything Russian.

weirdpickles 1y ago

Yeah, it is pretty amazing but not surprising. The Register has taken to a certain kind of sensationalism as of late. I found this interesting: > "Every piece of code written by Russians isn't automatically suspect, but popular packages with no external oversight are ripe for the taking by state or state-backed actors looking to further their aims," Smith told us in an email. "As a whole, the open source community should be paying more attention to this risk and mitigating it." Uh, I guess? The nature of open source is supposed to be that the dev provides the effort and the code, and that's where the guarantee stops. It is up to the people who uses it to implement and ensure security. People treat OSS like it is a business product that must have drop-in replacement ready at all times. The modern nature of development is perhaps my biggest gripe as a professional. There is little care given. Projects begin with importing dozens of other packages and libraries that we never look at, let alone fully understand. And it is normalized.

shark1 1y ago

Yeah, the subtle way to plant an idea. It's a crime again to a person have "certain nationalities".

int_19h 1y ago
The real concern isn't the nationality per se, it's the vulnerability to blackmail by the state that has jurisdiction over you. It's not a matter of personal responsibility, but nevertheless it has to be accounted for. For example, I am an American citizen, but I have extended family in Russia, and I would fully expect a place like DoD to be wary of that solely on the basis that it makes me susceptible to blackmail by Russian govt agencies by threatening my family.
- shark1 1y ago
  Yes, I know. My point is that writers could easily do it better.