3 ms·

Can we even safely assume that the memo was scathing? That's an interpretation by the reporter. You would think that they would be able to quote some damning fa

by dkarl 1y ago

Can we even safely assume that the memo was scathing? That's an interpretation by the reporter. You would think that they would be able to quote some damning fact or accusation from it, or at least some harsh language, if it really was "scathing."

toss1 1y ago
Yes, we can safely assume that, since I was largely ignoring the press piece and directly using only the quotes from the Army Report. Below are some of the direct quotes from the Army Report quoted in the article. >> “fundamental security” problems and vulnerabilities, >> should be treated as a “very high risk >> “We cannot control who sees what, we cannot see what users are doing, and we cannot verify that the software itself is secure,” >> “very high risk” because of the “likelihood of an adversary gaining persistent undetectable access,” wrote Gabrielle Chiulli, the Army chief technology officer authorizing official. >> Any user can potentially access and misuse sensitive” >> One application revealed 25 high-severity code vulnerabilities. Three additional applications under review each contain over 200 vulnerabilities requiring assessment, according to the document. >> “Any user can potentially access and misuse sensitive” classified information, the memo states, with no logging to track their actions. The report on a supposedly secure communications system prototype contains these exact criticisms about 1) fundamental lack of access control for users of classified info at multiple levels, 2) complete lack of logging for any access authorized or unauthorized, and 3) likelihood of an adversary gaining persistent undetectable access. To anyone with a clue, this is exactly the opposite of what a secure military communications system needs. For people on a site who supposedly care about software quality to defend such obvious slop is ... surprising. It looks from this collection of quotes that Palantir and Anduril just tossed over some Slack/Discord clone and thought they'd "wow" the Army with the new (presumably to those backwards customers) tech and slap on some security later, and are now finding out their customer is a bit more sophisticated than they expected. There are very good reasons consumer tech is often unsuited for military use. (OFC, if the press piece is lying about the direct quotes and numbers from the document, we have an entirely different discussion, but no one here has argued that is the case)

by dkarl 1y ago

toss1 1y ago

Yes, we can safely assume that, since I was largely ignoring the press piece and directly using only the quotes from the Army Report. Below are some of the direct quotes from the Army Report quoted in the article. >> “fundamental security” problems and vulnerabilities, >> should be treated as a “very high risk >> “We cannot control who sees what, we cannot see what users are doing, and we cannot verify that the software itself is secure,” >> “very high risk” because of the “likelihood of an adversary gaining persistent undetectable access,” wrote Gabrielle Chiulli, the Army chief technology officer authorizing official. >> Any user can potentially access and misuse sensitive” >> One application revealed 25 high-severity code vulnerabilities. Three additional applications under review each contain over 200 vulnerabilities requiring assessment, according to the document. >> “Any user can potentially access and misuse sensitive” classified information, the memo states, with no logging to track their actions. The report on a supposedly secure communications system prototype contains these exact criticisms about 1) fundamental lack of access control for users of classified info at multiple levels, 2) complete lack of logging for any access authorized or unauthorized, and 3) likelihood of an adversary gaining persistent undetectable access. To anyone with a clue, this is exactly the opposite of what a secure military communications system needs. For people on a site who supposedly care about software quality to defend such obvious slop is ... surprising. It looks from this collection of quotes that Palantir and Anduril just tossed over some Slack/Discord clone and thought they'd "wow" the Army with the new (presumably to those backwards customers) tech and slap on some security later, and are now finding out their customer is a bit more sophisticated than they expected. There are very good reasons consumer tech is often unsuited for military use. (OFC, if the press piece is lying about the direct quotes and numbers from the document, we have an entirely different discussion, but no one here has argued that is the case)