Hacker News Reader

Yeah - when I add to it that, as a non-American, I can (annectodaly) observe a rise in different kinds of news that involve China in a negative context for the last 6m especially, it's hard to form an opinion.

In terms of security concerns also - come on, we know by now to which lengths the US goes in this area, and they're surely doing worse stuff than this, I'd expect no one would doubt it any more. So, either they are genuinely surprised by this, which would be silly (a politically adversarial nation using an obvious opportunity - cheaper stuff being produced there for decades - and doing the same), or it's a part of a broader narrative that's being built.

And, to be clear, I don't think we (the world outside China) shouldn't be a bit worried given in what position _we've_ put China and how strong they are now - it's just that this kind of mass-manipulation and propaganda is the most-detested way of doing it for me...

Still doesn’t mean you shouldn’t be concerned by China’s super position in the global supply chain...

You should, but China rarely cares about people beyond its own boarders. They don't have the power of the U.S. to reach for anyone across the globe, so I think NSA doing this is a tad more worrisome.

I think the main difference between the US and China, the Chinese have no mission to convert every country to their thinking. Not that they influence countries through their investments, see Greece as an example.

"... don't ..."

Ummm other than Silk Road pulling tons of countries into their sphere, using it to push new Chinese standards for people to switch towards, making HK/Taiwan/Tibet fully incorporated and culturally homogenous, taking islands away from other countries across SE Asia and calling it all china’s sea, etc etc.

They’re just more subtle, until they’re not. They have a very long term outlook on their efforts.

China is not pushing countries to become 'communist' states.

China does have ambitions, sure, but they're mostly local ones. I was mainly talking about cases like Kim Dotcom, where the U.S. reached all the way to NZ. China doesn't have Five Eyes, has not attacked a foreign country etc. It does not mean this cannot change, but I get the feeling China strives for a more local "sphere of influence" strategy, (hence the things like you mentioned), whereas the US strives to maintain "global dominance". As someone sitting in Western Europe, I don't think China has that much interest to dominate here.

You need to be a citizen of a nation neighbouring China to know the severe pressure that China exerts on borders, trade and geo-politics. You just don't hear about it much in the world-news as it doesn't affect the US.

China is not pushing countries to become 'communist' states.

They kidnap people from other places who are dissidents including from Hong Kong, Malaysia, and even the us.

Here's an article discussing this worldwide kidnapping. https://foreignpolicy.com/2018/03/29/the-disappeared-china-r...

> I don't think we (the world outside China) shouldn't be a bit worried given in what position _we've_ put China and how strong they are now

At least China won't be as dangerous as the US or the Soviet Union in that it has absolutely no interest in enforcing its political ideals on other places or becoming a world police. I see no real reason why people should be worried about the rise of China as if this will turn the whole world Orweillian. China has its own way of organizing the vast and complex country and it's hard to come up with better practical solutions. Still if one doesn't like it they can just live somewhere else, and the authorities don't care, as long as it doesn't hurt Chinese business.

> .. no interest in enforcing its political ideals on other places or becoming a world police

Not yet. But becoming a banker for whole third-world is almost done. And when your debts are big, you lose sovereignty.

This claim seems like a big dilemma for US white-hat security researchers:

1. As a white-hat security researcher, you have an ethical responsibility to publicly disclose vulnerabilities after doing the necessary due diligence (informing the affected parties privately, and giving them the necessary time to respond, investigate, and come up with an acceptable solution).

2. As a US citizen, you can't report attacks carried out by US intelligence agencies.

I can definitely see the responsibility that patriotic duty would entail, but a citizen with no links to their country's intelligence agency being held responsible for the said agency's failure in maintaining operational discretion doesn't seem sensible to me.

Edit: update formatting.

> As a US citizen, you can't report attacks carried out by US intelligence agencies.

Who says? Unless you've received a National Security Letter, a gag order from a court, or have a pre-existing relationship with the government that governs disclosure (e.g. security clearance), there's nothing preventing a researcher from disclosing lawfully obtained information. Stumbling upon a secret investigation doesn't make the information unlawfully obtained, even if you suspect it might be a secret investigation.

Are you sure that the Espionage Act (1917) doesn't cover this? In Australia we have many recent laws that completely restrict our ability to whistleblow on any government issue (though it's not illegal if we ensure that non-Australian nationals know about it -- which is obviously an impossible and stupid standard).

It might (particularly subsections (d) and (e))[1], but only because the wording is so broad. Whether such an application would be legal is another matter. I suspect it would not absent specific intent (i.e. you're deliberately seeking out secrets to share) or a duty (security clearance).

I suppose intent could be there if you share information about a device that says, "Warning: national defense injured if you disclose". But absent a duty I don't think a court would impute intent, especially considering the Free Speech issues (somewhat peculiar to the U.S.).

Notice that nobody has seriously suggested (AFAIK) that the journalists who assisted Snowden should be charged under the Espionage Act, even though their acts would seem to fit multiple provisions. I think that's because unlike Snowden they had no duty, which means the bar for the requisite intent and knowledge (i.e. whether something is really going to harm national defense) is incredibly high.

But who knows? It's a good point and it poses a ton of questions. Still, personally if I found a spying device on something I wouldn't hesitate to disclose it if it seemed noteworthy. I wouldn't feel chilled by the Espionage Act. The same law in some other country? Probably would think twice.

[1] https://www.law.cornell.edu/uscode/text/18/793

> As a US citizen, you can't report attacks carried out by US intelligence agencies.

Sure you can. Short of a gag order (and maybe not even then) you can report intrusions all you like.

In any event, how does one determine the nationality of hardware that shouldn't be there? It's not like there's going to be a snarky "Designed by the NSA in Fort Meade" logo on the chips in question.

If (IF!) you hold a civilian or military clearance, then you have a legal Duty to Report (DTR). That holds true whether its data in your clearance level or not.

You also abide by a whole slew of laws regarding sensitive, secret, top secret, or SCIF information. If I knowingly, or even suspect, some information if classified, and I transmit it to anyone else than my federal assigned contact, I'm breaking major federal laws.

A lot of security professionals in the US have such clearances. So finding a NSA implant or such proof makes it dangerous to talk about by default.

So yeah, a gag order by profession.

Are you really a white-hat if you have to disclose vulnerabilities to an organisation known to exploit (or at least hoard) them?

Please quote me where I claimed to be a white hat.

You didn't, but the context was:

> This claim seems like a big dilemma for US white-hat security researchers

It seems like the two are mutually exclusive.

“Are you really” => “Is one really”

https://dictionary.cambridge.org/grammar/british-grammar/pro...

https://www.quickanddirtytips.com/education/grammar/one-vers...

Vulnerabilities and weaponized implants are very different things.

> But Bloomberg is a serious news organization and they are holding strong on this story as well. So what to think?

Are they? The authors of this story published an unverified and in corroborated story about Heartbleed a few years ago, claiming that the NSA knew about it and was exploiting it (https://www.washingtonpost.com/blogs/erik-wemple/wp/2014/04/...).

And here's someone else calling out Bloomberg for an "unethical hatchet job" when reporting on a technical issue: https://www.semiaccurate.com/2012/10/08/bloomberg-wrong-abou...

To be fair, Clover Trail had all sorts of driver issues that never got resolved. I personally had to deal with the shitty GPU drivers for work. I can't speak to the power management since we were using the chip in a place where power management didn't matter, but I can see those being shit too.

I think the issue is that they're a serious news organization about some subjects, and a dumpster fire for others. It's hard for the general public to recall which subjects they are authoritative on and which not.

It would not surprise me if the NSA did know about it but it's a shame they didn't have any proof.

It seems that the author of the research is not happy with Bloomberg's spin on the story: https://www.servethehome.com/yossi-appleboum-disagrees-bloom...

> But Bloomberg is a serious news organization and they are holding strong on this story as well. So what to think?

When the articles published by those "serious news organizations" concerns China, disinformation / lack of evidence are really common place if you carefully examine their source. I used to do so from time to time but grew tired of that

That's not a conspiracy theory. It's standard type of policy and it would be surprising otherwise.

If information, ideas, knowledge were shared openly we wouldnt have these kinds of ridoculous events. This kind of news is what keeps nations siloed and prevents collaboration. At the same time maybe this will also force us to abandon trust all together and move towards verifying.

Indeed. I saw a brilliant presentation in 2012 by Michael Mitzenmacher from Harvard on verifiable computing in the cloud. It was based on this paper:

https://arxiv.org/pdf/1202.1350v3.pdf

I think we should judge by facts,not by stereotypes. In my opinion, newspapers are all propaganda machines driven by some their benefit.

> I think we should judge by facts,not by stereotypes.

Cool. Let us test.

Error: Line 2:

> In my opinion, newspapers are all propaganda machines driven by some their benefit.

> I hate to dream up conspiracy theories.

No conspiracy theory needed, traditional media is dying, and in their last gasps of air they are destroying their credibility for the sake of clickbait articles without proper facts and coberation. They are being deceptive, because they know outrage and politically dividing stories are still working.

It's really said, but transparent. No way, Apple officially writes that rebuttle on their website if the story is true.