7 ms·

By releasing the documents in this order, they give government officials just enough rope to hang themselves by prompting them to defend themselves by making st

by mef 13y ago

By releasing the documents in this order, they give government officials just enough rope to hang themselves by prompting them to defend themselves by making statements about what they do and do not do, and then releasing new documents directly contradicting those statements. In a weird way, it actually motivates them to tell the "whole truth" because they don't know what documents will be released later so they don't know what lies to tell.

cromwellian 13y ago
Yea, but as collateral damage, the rope hung the tech companies and damaged their brands by who knows how much.
- selmnoo 13y ago
  They deserve to have their brands damaged. They didn't do their due diligence in encrypting data going through leased fibers -- they should have had the foresight to realize what a phenomenally bad thing this was. They didn't, hence why I'll never trust them again.
  - cromwellian 13y ago
    Do you also blame your car company when a thief breaks into it? Do you never trust banks again if a bank robbery happens? They were working on it, but full-on encryption everywhere within your internal network is expensive, and one tends to not imagine that buried dark fiber is dug up and tapped by one's own government. Let's say that they encrypted everything, and then you learn the NSA had kidnapped the children of one of their network engineers and forced him to turn over some keys. Again, whose brand deserves to be damaged here, the company, or the immoral nation state with vast military industrial resources at its disposal? Why do I sometimes get the feeling that people specifically want to hate on these companies when the real outrage should be for the government spooks.
    - selmnoo 13y ago
      What an unbelievably stupid line of thinking. Kidnapped their children? Get a hold of yourself here. Google is a tech company, it is a perfectly reasonable expectation that they get the big parts of their security model right. Not encrypting data going through leased (or even their own) fibers? Big, big mistake. NSA and US government aside, Google dropped the ball big-time here. > Why do I sometimes get the feeling that people specifically want to hate on these companies when the real outrage should be for the government spooks. Funny you say that. Because I was pretty much a Google fanboy before all of this happened (oh, and their recent changes wrt privacy policies). I am very angry at the government, but that is a separate issue.
      - cromwellian 13y ago
        Security is based on threat model. The spooks have capabilities that far exceed the threat models most companies assume from private blackhats. You think it is obvious to assume in hindsight that the government would dig up and tap your dark fiber, but you don't think it obvious the government would plant spies to do in-side-the-data-center taps. Now what? Encrypt all data between switches? The Soviets didn't think their undersea cables could be tapped either, and no one can claim they were insufficiently paranoid. My point is, I don't want Silicon Valley in an arms race with the US government. The government is supposed to protect its citizens and companies, not work to undermine them. Google is working on rolling out better security, just like they eventually rolled out SSL everywhere before most other companies. They are at the forefront on this, but it still takes time and costs money. But even though they are spending time and resources on this, I would still like the US government to cut it out.
        selmnoo 13y ago
        I'm not getting through to you. At the end of the day, Google lost. To a considerable extent, cloud lost. People who were trusting Google with their data lost. What is ostensibly true at this point at is that Google could have done something to have prevented this. All else is immaterial. Just like I would expect to lose business if I made a mistake and had data compromised (because doing X and Y was too difficult or too costly for me to do, because it was 'outside' my control, because I was too inept, or whatever else), Google should expect to lose some business the same way. If security is based on a threat model -- and it eventually loses, it was bad security.
  - toomuchtodo 13y ago
    Supposedly the US government is tapping fiber they own. Would you fault someone for not having security between rooms in their home?
  - madaxe 13y ago
    They also gave the NSA and co. front-door access, and probably knew about the back-door access, but couldn't do anything about it.
- obstacle1 13y ago
  It may be the case that the tech companies need to have their brands damaged for the greater good, at this point. If it turns out that G and Y are operating in an environment (USA) where a rogue government endangers consumers and prevents legit business from being done, G and Y need to either remove themselves from that environment or fall.

by mef 13y ago

cromwellian 13y ago

Yea, but as collateral damage, the rope hung the tech companies and damaged their brands by who knows how much.

selmnoo 13y ago
They deserve to have their brands damaged. They didn't do their due diligence in encrypting data going through leased fibers -- they should have had the foresight to realize what a phenomenally bad thing this was. They didn't, hence why I'll never trust them again.
- cromwellian 13y ago
  Do you also blame your car company when a thief breaks into it? Do you never trust banks again if a bank robbery happens? They were working on it, but full-on encryption everywhere within your internal network is expensive, and one tends to not imagine that buried dark fiber is dug up and tapped by one's own government. Let's say that they encrypted everything, and then you learn the NSA had kidnapped the children of one of their network engineers and forced him to turn over some keys. Again, whose brand deserves to be damaged here, the company, or the immoral nation state with vast military industrial resources at its disposal? Why do I sometimes get the feeling that people specifically want to hate on these companies when the real outrage should be for the government spooks.
  - selmnoo 13y ago
    What an unbelievably stupid line of thinking. Kidnapped their children? Get a hold of yourself here. Google is a tech company, it is a perfectly reasonable expectation that they get the big parts of their security model right. Not encrypting data going through leased (or even their own) fibers? Big, big mistake. NSA and US government aside, Google dropped the ball big-time here. > Why do I sometimes get the feeling that people specifically want to hate on these companies when the real outrage should be for the government spooks. Funny you say that. Because I was pretty much a Google fanboy before all of this happened (oh, and their recent changes wrt privacy policies). I am very angry at the government, but that is a separate issue.
    - cromwellian 13y ago
      Security is based on threat model. The spooks have capabilities that far exceed the threat models most companies assume from private blackhats. You think it is obvious to assume in hindsight that the government would dig up and tap your dark fiber, but you don't think it obvious the government would plant spies to do in-side-the-data-center taps. Now what? Encrypt all data between switches? The Soviets didn't think their undersea cables could be tapped either, and no one can claim they were insufficiently paranoid. My point is, I don't want Silicon Valley in an arms race with the US government. The government is supposed to protect its citizens and companies, not work to undermine them. Google is working on rolling out better security, just like they eventually rolled out SSL everywhere before most other companies. They are at the forefront on this, but it still takes time and costs money. But even though they are spending time and resources on this, I would still like the US government to cut it out.
      - selmnoo 13y ago
        I'm not getting through to you. At the end of the day, Google lost. To a considerable extent, cloud lost. People who were trusting Google with their data lost. What is ostensibly true at this point at is that Google could have done something to have prevented this. All else is immaterial. Just like I would expect to lose business if I made a mistake and had data compromised (because doing X and Y was too difficult or too costly for me to do, because it was 'outside' my control, because I was too inept, or whatever else), Google should expect to lose some business the same way. If security is based on a threat model -- and it eventually loses, it was bad security.
- toomuchtodo 13y ago
  Supposedly the US government is tapping fiber they own. Would you fault someone for not having security between rooms in their home?
- madaxe 13y ago
  They also gave the NSA and co. front-door access, and probably knew about the back-door access, but couldn't do anything about it.
obstacle1 13y ago
It may be the case that the tech companies need to have their brands damaged for the greater good, at this point. If it turns out that G and Y are operating in an environment (USA) where a rogue government endangers consumers and prevents legit business from being done, G and Y need to either remove themselves from that environment or fall.