Hacker News Reader

Comment by dqpb | Hacker News Reader

What's the point of classifying national security threats?

When a threat is discovered it can be very helpful if the attacker does not know you've discovered the threat.

Now you can observe them and only intervene when absolutely necessary, thus giving you time to learn more about the attackers and their methods.

Right. So, if this hack is real, the attacker now knows we know.

They might actually know for much longer: if your spying devices suddenly stop communicating to you, that's likely you've been discovered.

If that story is true (and I personnaly think it has a high probability to be), what would a gov or a large org do? Investigate, confirm they have been compromised but then.... leave the hw in place and data flowing back to the alien mothership? Unlikely.

The previously reported issue was alleged to take place in 2013-2015.

This issue in this thread is alleged to have taken place in August 2018.

In the intervening time, much could have happened.

Yes, it was made public at this time for a reason. I have no idea about who made it public and why, but you can be sure there is a bigger game here.

Did the journalist and/or their friends and family make money on the massive drop in Supermicro stock?

Is the Trump administration asking to push this information out to earn favor in the trade war?

Are the investigators stumped and using this in an attempt to flush out new leads?

No idea.

If you know that something is compromised, you can use that knowledge to feed misinformation. You don't want them to know that you know.

I don't necessarily agree with the below, but one could argue that classification is necessary to prevent mass panic/prevent attempted vigilante justice/protect the government's image/buy the government time to investigate/respond appropriately.

Things get voted on and positions change so I have no idea what you're referring to with "the below," but it's much simpler than trying to protect "the government's image."

If you're attempting to hack me or steal data from me and I know you're trying (specifically as would be the case with this chip if the story holds up) then I'm in a much better position to try to figure out how, or provide misinformation, or try to turn someone in the chain of custody if anything needs to be physically handled. Or at the very least, if it's an espionage or military situation, it makes it easier to know who to kill.

All of that goes out the window if you immediately disclose every threat. Whoever is attacking you will simply use the means you haven't discovered yet and stop using the ones you have.

Perhaps I should've written "the following" - I just meant the list that I provided in the rest of the sentence.

I believe you covered more in-depth content that could be filed under "buy the government time to investigate/respond appropriately."

To not give away other nation that their capabilities are mitigated.

power

Reply on news.ycombinator.com