This article is full of inaccuracies, alarmist FUD and sensationalism. If I could downvote an article, I would this one. >I was always under the impression the

This article is full of inaccuracies, alarmist FUD and sensationalism. If I could downvote an article, I would this one. >I was always under the impression they were just pretending that they owned large blocks of public IP space from a networking perspective, blocking everything and selectively turning on outbound traffic via access control lists. Apparently not It was always public knowledge that NK has more or less one publicly routed /22. That's far removed from "large blocks of public IP space". > This microtime is easily enough information to decloak people, which is presumably the same reason Google built it into the browser I doubt that was Google's intention behind the Safe Browsing API (https://developers.google.com/safe-browsing/developers_guide_v3 https://developers.google.com/safe-browsing/developers_guide...) >So every time the browser fails for some reason they get information about it. Useful for debugging and also for finding exploits in Firefox, without necessarily giving that information back to Mozilla – a U.S. company Or if could be that most of the users of the browser in question do not in fact have full internet access and thus no reports would be sent anyways. Also, FF 3.6 is long out of support, so by getting access to these crash reports, the people behind Naenara get a chance at fixing issues (I'm not saying they do or don't, but getting the crash reports directly is the only way for remaining crashes to actually be fixed) >. Could the mothership be acting as a proxy? Is that how people are actually visiting the Internet – through a big proxy server? very likely, but not because of the way the URL for the startpage is formatted. That's just a convenience thing I guess where they ran wget or any other crawler against the original site and then they could just prepend their internal server to to URL and keep the patch to Firefox minimal. >it’s still very odd that they haven’t bothered using HTTPS internally They just don't care if "normal" people could potentially sniff each other calendars. If the government wants access to the calendar, they just look the data up I guess and because this is all a big intranet, the traffic doesn't cross any non-goverment-owned routers anyways. >This one blew my mind. Either it’s a mistake or a bizarre quirk of the way DPRK’s network works but the wifi URL for GEO still points to https://www.google.com/loc/json* https://www.google.com/loc/json* Likely none of the sites the browser is actually able to visit actually use the geolocation API, so they just forgot to change the URL. It's an interesting bug, but far removed from mind-blowing IMHO. >That’s actually a good security measure, but given how old this browser is, I doubt they use it often, and therefore it’s probably not designed to protect the user, but rather allow the government to quickly install malware should they feel the need. Wonderful.* I'm sure they have other methods of installing malware that then would run as a privileged account, not the unprivileged user account running Firefox itself (their OS doesn't officially allow root access as we've seen in yesterdays article). >It is odd that they can do all of this off of one IP address. Perhaps they have some load balancing but ultimately running anything off of one IP address for a whole country is bad for many reasons. when you have fewer than 10000 total users, that doesn't seem like such a bad idea - it's certainly convenient.