4 ms·

So, I was making the correct determination when requiring that all server and desktop hardware puchased by my companies originate from BRICS nations. Avoiding d

So, I was making the correct determination when requiring that all server and desktop hardware puchased by my companies originate from BRICS nations. Avoiding dell/cisco/juniper/hp for networking equipment, and opting for Custom RK3188 and AllWinner A23-based routers/switches and desktop thin clients running (Debian/Angstrom) linux are gonna throw more than one wrench in any surveillance plans. I wonder how many exploits the Five Eyes have for Tahoe-LAFS running on LVM disks. I'm betting on very few.

lobotryas 12y ago
Isn't this changing the devil you know for one you don't? Instead of potentially having NSA spy on your org, you have potential of China and Russia doing the spying? Or is there solid evidence that these countries aren't engaging in the same stuff as the NSA?
- oafitupa 12y ago
  Engineers have to work with what they have. Do you disagree that he made the right decision? Is there solid evidence that these countries are engaging in the same stuff as the NSA?
  - mikeash 12y ago
    There was plenty of solid evidence of those countries spying on US citizens long before there was solid evidence of the US spying on US citizens.
  - lobotryas 12y ago
    Yes, I disagree. If there's an almost guaranteed chance that my org will be spied on, I would rather have the US do the spying. Unlike a BRICS country, at least the US has the occasional Snowden to shed light on things. The resulting scandal may do little to change the status quo, but it'll lead to a discussion and maybe a civil suit my company can win. I have never heard of a similar public leaker from Russia or China (I imagine those people just quickly get disappeared). As for BRICS country spying, we have some very solid evidence that China is engaging in cyber espionage of both US military and corporate targets.
    - smm2000 12y ago
      If you are working on US based consumer web site, spying by NSA could be much more harmful than spying by China or Russia for vast majority of users. NSA is known to provide leads to police that then reconstructed evidence to exclude any links to NSA and still arrest/harass the person. There are people who are not national security risk in US jails because of NSA (mostly drug busts). BRICS countries have zero interest whether you smoke dope in your free time and won't rat you out to local police. PS. I am not arguing that they should not be in jail. Just that NSA used semi-legal (waterboarding!=torture kind) methods to obtain initial leads.
      - ohashi 12y ago
        What if dissidents are using your service because it's outside their country of origin and they get disappeared because of it?
        smm2000 12y ago
        As I said it's better to be located outside of country where majority of your users are. If your service targets american market, you can minimize risk to majority of your users by locating service outside of US. Dissident disappearing is mostly red herring - people disappear in US too (Guantanomo).
  - ohashi 12y ago
    Lack of evidence is not proof they aren't doing it. You can still say there is risk of it and ponder how much risk that means. There's definitely some concern of Chinese hardware.
    - oafitupa 12y ago
      Can you answer the question?
- Padding 12y ago
  > Isn't this changing the devil you know for one you don't? I don't think so. How likely is it that China spying on you will actually impact your life, if you're living somewhere in the US or Europe? Compare this to How likely is it that the US spying on you will actually impact your life, if you're living somewhere in the US or Europe... I mean sure, this may be a relevant consideration for actual terrorists, but hardly for "regular" people that are more concerned about mundane details like their unhealthy dietary habbits being leaked to insurance companies, or their downloading of youtube videos being leaked to copyright holders.
  - safeaim 12y ago
    Well, one of the risks that you face in a state-sponsored advisory is industrial espionage, and that is as likely to come from China [1] as it is coming from the NSA [2]. [1] http://money.cnn.com/2014/05/20/news/china-espionage-business/ http://money.cnn.com/2014/05/20/news/china-espionage-busines... [2] http://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras http://www.theguardian.com/world/2013/sep/09/nsa-spying-braz...
    - Padding 12y ago
      This may just be paranoia on my part, but wouldn't being a target of industrial espionage by the Chinese make you already important/big enough to have the NSA working for rather than against you?
      - safeaim 12y ago
        Not if you're in a competing country to both US and China. The world is bigger than the US :-)
sargun 12y ago
I would be surprised if India, China, or Russia did not have similar sorts of surveillance programs. But, I think you're right, you're unlikely to be caught in dragnet-style surveillance by the Five Eyes nations, but this style of attack sounds like it has to be targeted.
higherpurpose 12y ago
Dell especially seems to be targeted a lot by NSA - easy target? Or something more?
- psykovsky 12y ago
  Edward Snowden worked for Dell, maintaining NSA infrastructure. They NSA is deep into Dell, easy access to specs and maybe the NSA even engineered those backdoors themselves.
Padding 12y ago
> requiring that all server and desktop hardware puchased by my companies originate from BRICS nations How exactly did you do this? Obviously the company assembling the pieces (like CPUs and chipsets) into the final PC isn't really the issue, but rather the companies producing those pieces - and virtually none of them are outside the US, seeing as how there's only Intel (and maybe AMD). Your idea sounds good, and I'd like to adopt it, but I just don't see how, with x86 hardware. Then again, maybe this'll be a major selling point for ARM-based Servers and Desktops at some point in the future? :x
- anonbanker 12y ago
  Get on alibaba.com, and find a supplier. Most allow customization of the boards you purchase. And the above-mentioned chipsets have full Linux support. Getting arm-based boards with 4+ 10gigE ports is easier than you'd think. The desktops are all arm-based thin clients running X servers with all apps hosted remotely. If a device fails, plug in another one and keep working. Richard Stallman abandoned Five Eyes-based chipsets for the same reason, long before I ever did. We should look to him more for inspiration on how to remain free during these draconian times.
ablankst 12y ago
What about this exploit really requires a US supply chain? Why do you believe that the Five Eyes have fewer exploits for hardware originating from BRICS nations? Don't intelligence agencies have explicit missions to spy on those countries? If you think that because you are running less popular hardware, that the NSA wouldn't bother obtaining exploits for them, you may be right. In that case, though, you're simply making a popularity trade-off. (And it is a trade-off, more popular hardware is more popular for a reason.)
- anonbanker 12y ago
  From all documents released by snowden thus far, it is clear that the Five Eyes are targeting their own supply chains. They're using arm7 and arm9 chips in their hardware bugs, but it's clear that they have no focus at all on arm exploits. Both the RK3xxx and A23 chips are fully supported in Linux 3.16, so I see no trade-off. Just low wattage and a bit of peace of mind that my government has to custom-tailor exploits for me and my companies, which isn't very cost-effective. :-)

lobotryas 12y ago

Isn't this changing the devil you know for one you don't? Instead of potentially having NSA spy on your org, you have potential of China and Russia doing the spying? Or is there solid evidence that these countries aren't engaging in the same stuff as the NSA?

oafitupa 12y ago
Engineers have to work with what they have. Do you disagree that he made the right decision? Is there solid evidence that these countries are engaging in the same stuff as the NSA?
- mikeash 12y ago
  There was plenty of solid evidence of those countries spying on US citizens long before there was solid evidence of the US spying on US citizens.
- lobotryas 12y ago
  Yes, I disagree. If there's an almost guaranteed chance that my org will be spied on, I would rather have the US do the spying. Unlike a BRICS country, at least the US has the occasional Snowden to shed light on things. The resulting scandal may do little to change the status quo, but it'll lead to a discussion and maybe a civil suit my company can win. I have never heard of a similar public leaker from Russia or China (I imagine those people just quickly get disappeared). As for BRICS country spying, we have some very solid evidence that China is engaging in cyber espionage of both US military and corporate targets.
  - smm2000 12y ago
    If you are working on US based consumer web site, spying by NSA could be much more harmful than spying by China or Russia for vast majority of users. NSA is known to provide leads to police that then reconstructed evidence to exclude any links to NSA and still arrest/harass the person. There are people who are not national security risk in US jails because of NSA (mostly drug busts). BRICS countries have zero interest whether you smoke dope in your free time and won't rat you out to local police. PS. I am not arguing that they should not be in jail. Just that NSA used semi-legal (waterboarding!=torture kind) methods to obtain initial leads.
    - ohashi 12y ago
      What if dissidents are using your service because it's outside their country of origin and they get disappeared because of it?
      - smm2000 12y ago
        As I said it's better to be located outside of country where majority of your users are. If your service targets american market, you can minimize risk to majority of your users by locating service outside of US. Dissident disappearing is mostly red herring - people disappear in US too (Guantanomo).
- ohashi 12y ago
  Lack of evidence is not proof they aren't doing it. You can still say there is risk of it and ponder how much risk that means. There's definitely some concern of Chinese hardware.
  - oafitupa 12y ago
    Can you answer the question?
Padding 12y ago
> Isn't this changing the devil you know for one you don't? I don't think so. How likely is it that China spying on you will actually impact your life, if you're living somewhere in the US or Europe? Compare this to How likely is it that the US spying on you will actually impact your life, if you're living somewhere in the US or Europe... I mean sure, this may be a relevant consideration for actual terrorists, but hardly for "regular" people that are more concerned about mundane details like their unhealthy dietary habbits being leaked to insurance companies, or their downloading of youtube videos being leaked to copyright holders.
- safeaim 12y ago
  Well, one of the risks that you face in a state-sponsored advisory is industrial espionage, and that is as likely to come from China [1] as it is coming from the NSA [2]. [1] http://money.cnn.com/2014/05/20/news/china-espionage-business/ http://money.cnn.com/2014/05/20/news/china-espionage-busines... [2] http://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras http://www.theguardian.com/world/2013/sep/09/nsa-spying-braz...
  - Padding 12y ago
    This may just be paranoia on my part, but wouldn't being a target of industrial espionage by the Chinese make you already important/big enough to have the NSA working for rather than against you?
    - safeaim 12y ago
      Not if you're in a competing country to both US and China. The world is bigger than the US :-)

sargun 12y ago

I would be surprised if India, China, or Russia did not have similar sorts of surveillance programs. But, I think you're right, you're unlikely to be caught in dragnet-style surveillance by the Five Eyes nations, but this style of attack sounds like it has to be targeted.

higherpurpose 12y ago

Dell especially seems to be targeted a lot by NSA - easy target? Or something more?

psykovsky 12y ago
Edward Snowden worked for Dell, maintaining NSA infrastructure. They NSA is deep into Dell, easy access to specs and maybe the NSA even engineered those backdoors themselves.

Padding 12y ago

> requiring that all server and desktop hardware puchased by my companies originate from BRICS nations How exactly did you do this? Obviously the company assembling the pieces (like CPUs and chipsets) into the final PC isn't really the issue, but rather the companies producing those pieces - and virtually none of them are outside the US, seeing as how there's only Intel (and maybe AMD). Your idea sounds good, and I'd like to adopt it, but I just don't see how, with x86 hardware. Then again, maybe this'll be a major selling point for ARM-based Servers and Desktops at some point in the future? :x

anonbanker 12y ago
Get on alibaba.com, and find a supplier. Most allow customization of the boards you purchase. And the above-mentioned chipsets have full Linux support. Getting arm-based boards with 4+ 10gigE ports is easier than you'd think. The desktops are all arm-based thin clients running X servers with all apps hosted remotely. If a device fails, plug in another one and keep working. Richard Stallman abandoned Five Eyes-based chipsets for the same reason, long before I ever did. We should look to him more for inspiration on how to remain free during these draconian times.

ablankst 12y ago

What about this exploit really requires a US supply chain? Why do you believe that the Five Eyes have fewer exploits for hardware originating from BRICS nations? Don't intelligence agencies have explicit missions to spy on those countries? If you think that because you are running less popular hardware, that the NSA wouldn't bother obtaining exploits for them, you may be right. In that case, though, you're simply making a popularity trade-off. (And it is a trade-off, more popular hardware is more popular for a reason.)

anonbanker 12y ago
From all documents released by snowden thus far, it is clear that the Five Eyes are targeting their own supply chains. They're using arm7 and arm9 chips in their hardware bugs, but it's clear that they have no focus at all on arm exploits. Both the RK3xxx and A23 chips are fully supported in Linux 3.16, so I see no trade-off. Just low wattage and a bit of peace of mind that my government has to custom-tailor exploits for me and my companies, which isn't very cost-effective. :-)