Hacker News Reader

> Since then, with the advent of the likes of Stuxnet, the NSA's ubiquitous surveillance apartus, and the Great Firewall of China, we've been taught a hard lesson that governments are perfectly capable of developing technology expertise or contracting it out, if need be.

Unfortunately it can still be both at the same time. The NSA can hire some smart hackers at the same time as OPM gets breached and legislators pass laws putting all of everybody's data into the hands of the likes of Equifax which then also gets breached.

His next line was:

>It's even a truism now that computer defence against a well funded nation state is hopeless.

Which definitely agrees with your example. The pentagon officially operates on a doctrine that says "We may be able to have a whelming advantage in cyberspace, but we will never be able to operate with the overwhelming advantage that we enjoy in the physical space"

Your point stands, but the OPM breach was done by the Chinese government: https://www.fedsmith.com/2018/09/21/bolton-confirms-china-be....

It seems like governments have gotten good at cyber attacks but not so good at cyber defense.

The Chinese government did it but the public information about the attack does not show any advanced techniques or resources which would limit it to a nation state.

> It's even a truism now that computer defence against a well funded nation state is hopeless.

This was arguably true (in the case of targeted attacks) even back then. That some civilian law enforcement agencies (and apparently the Secret Service) were clueless about SIGINT back then, doesn't mean that the same was ever really true for major spy agencies.

Here is 1945's Stuxnet, for example: https://en.wikipedia.org/wiki/The_Thing_(listening_device)

> It's even a truism now that computer defence against a well funded nation state is hopeless.

It's interesting how many of those same early hackers [1] went on to working for those same governments or selling them exploits/offensive tools to make sure this stay true. None of that could have been accomplished by any gov without real legitimate talent joining on. Especially in the early days.

Largely because the governments of the world decided they were far, far more interested in the offensive side because of the mountains of intelligence they were getting. Which then filtered down to industry to where all the money, fun, and very importantly, how much easier it is to break something than to protect it. Or maybe it was a side-effect of all the vast majority of talent/money going into the intelligence community and defence contractors instead of just the "government" in general. Probably a combination of both.

The talent that did end up working on the defensive side (that was actually useful) was, and is, usually some super complicated and expensive systems that only big companies could afford. And/or you have a major budget to hire, or pay consultancies, with equal/superior talent than the adversary. Which leaves out the vast majority of companies and almost all civilians with useless or negative utility anti-virus software, or nothing at all besides the odd operating system, software, and public crypto progress.

That's not to say great strides haven't been made on the civilian side in recent years, since the public has caught on to the true scale of the surveillance/offensive stuff and the implications that has given the general weakness of the technology we use everyday.

The significance of WhatsApp adopting Signal's E2E, Telegrams popularity, and people moving to iMessage and other encrypted non-SMS text, emailing properly adopting transit encryption, and the Google TLS charts [2] reaching ~90% from around 40-60% only 7yrs ago is a really, really big deal IMO.

[1] https://www.wired.com/story/cult-of-the-dead-cow-at-stake-ha...

[2] https://transparencyreport.google.com/https/overview?hl=en

This is also a consequence of how much technology knowledge was easily obtainable by anyone interested in it.

Even black hats were eager to spread their knowledge around, from 2600 and Phrack to the thousands of filez on BBS's and the early internet.

That in turn was a consequence of both the open hacker ethos, born in the cradle of academia, and of "information wants to be free".

As a result, those in the security and surveillance parts of the government who had an interest could easily learn pretty much whatever they wanted from the mouths of the very people they wanted to survey.

Not that I'd have it any other way, being a fan of the free flow of information, but it's interesting to see what unintended consequences this has.

Of course, this information flow was mostly one way.

It's interesting how many of those same early hackers [1] went on to working for those same governments or selling them exploits/offensive tools to make sure this stay true.

Every man’s got a price.

It sounds cynical, but I think it is just being pragmatic. Once you recognize that the state holds a overwhelimng resources and only one mistake can land you in a world of hurt, joining a state hacking team seems like less annoying option.

You do sell your soul, but.. you get to test your black hat skills with the backing of state resources and immunities afforded to it all the while learning how to really not make that one mistake. Steady paycheck is just a bonus.

It is a price and a high one, but I can understand the motivations behind it.

There are many things I know I could do, that most people would find distasteful even if they are perfectly legal. Like working in the ad industry. I would prefer not to do them - but for the right price, why not? It'd better be damn high, because I can't easily see myself accepting. Still I can envision that in theory.

But working for a government? I can't. I put that on the same ethical scale as murder.

No. Never. For no price whatsoever.

It comes full circle I guess. Most of the technology we use today came from military research first. SV, for all of its recent boom, really has contributed the boring bits to make it all work. Things like GPS, cellular tech, the internet, Wi-Fi, AI, crypto, all stem from government research. Was the tech sector ever really in the control of the idealistic academics or was that all just an illusion?

If that's an interesting question to you, I'd recommend the book "The Entrepreneurial State"

https://en.wikipedia.org/wiki/The_Entrepreneurial_State

The author has a good talk at the Long Now Foundation, as well.

http://longnow.org/seminars/02014/mar/24/entrepreneurial-sta...

> It's even a truism now that computer defence against a well funded nation state is hopeless.

For some, it is still worthwhile to harden defenses against nation-state threat actors. Raising the cost for those nation-states is sufficient justification on its own.

For example, opaque binary distributions are more easily compromised than either source code distributions or verifiable reproducible builds. As an industry we should migrate away from opaque binaries, and major open source organizations should bear that in mind while designing their processes.

> against a well funded nation state

Why do people specifically state 'nation state' in these circumstances? What do you think makes a nation state a particularly notable adversary relative to countries which aren't nation states like the UK or the US, which seem to have more capability in this area not less?

When people say country, they mean the whole decentralised group of people, and the physical area, and a bunch of other stuff.

When they say nation state, the mean a government.

> When they say nation state, the mean a government.

That's not what 'nation state' means at all - a nation state is an international state that is also a nation. So pretty much orthogonal as to whether they're a competent cyber force or not.

Why don't they just say 'a government', then? The only other rationale I can think of is that 'nation state' sounds much cooler and cyberpunk.

The reason that it's usually used in this context is that a nation state has a monopoly on violence within its borders. It's a natural extension in "cyberpunk" circles to apply this to digital violence.

> a nation state has a monopoly on violence within its borders

But this isn’t unique to nation states.

Because cities, provinces, and states (as in one of the 50 comprising the United States) all have governments, and most of them do not have the resources for an international cyber-attack. Nation-states are by definition country-level governments.

No, nation states are states which are also nations. For example Japan is a nation state but the UK is not.

Specifically, nation states set their own foreign policy and have their own military. Usually APTs are associated with military or intelligence agencies, which only nation states have, though some (e.g. the Bears in Russia) aren't formally tied to the government (as much as being allowed to make money on the side.)

I favor APTs as a term, since it denotes any actor with lots of technical means and a political/strategic rather than financial agenda. Many APTs belong to nation states, but that's not always true!

The confusion seems to come from most people seeing nation and country as synonyms. The older traditional definition of nation has mostly faded except in the context of the modern use of the word nationalism, but even that has been perverted to mostly mean extremists.

"nation state" in the infosec industry means "sovereign government". Yes, it's wrong and it's very unfortunate, but it seems it's too late to change, though Maciej Cegłowski has been trying for about a year [1].

1 - https://twitter.com/Pinboard/status/1121893376557633537

It isn’t what nation state has traditionally meant because of the differing definition of nation, true.. but it has some reason for existing... Nation here means national (as in internationally sovereign) and state means the government of that nation (or state :-) — these words can all be synonyms in English) specifically. It concretely means “national government” as you basically mention but with fewer syllables (3) vs (5 or 6) and it’s shorter to type.

Do you have any creative alternatives that don’t step on the traditional use?

Why are those not nations? For further clarification, are the ROC or Israel nation states?

The UK is four nations (four nations united into one kingdom, hence the name), and the US is a mix of people from many nationalities. Israel is probably a nation state. I don't know much about Chinese cultural identity.

This may be your opinion, but I'm not sure it implies a clear general rule that you could even hope to have people accept.

I'm sure a lot of people from the UK would pedantically insist on the multiple nations point, based on my past experience on the internet. On the other hand, in the US, people declare it to be "one nation..." and so saying it is not a nation suggests that the determination is made more from an outside vantage point than a traditional American one.

The Wikipedia page on Taiwan has some information on how people there view themselves. It seems that basically, people may be largely divided between those who came from mainland China after WWII, those who came in earlier waves of immigration, like the 19th century, and "aborigines" who came much longer ago (but it seems there were people from China on the island even before them) These may not seem like large differences, but it seems like they are tied up with the overarching question of the status of the ROC as being separate from China or not, of whether people are Chinese, Taiwanese, or both. And the question remains, do people determine for themselves if they are a nation, or do outsiders do it "objectively"?

A definition can be stated without it being practical to use.

> Why are those not nations?

They are, as the term is usually used; the United Kingdom and U.S. are nations. In the former case, it is sometimes argued that the constituent countries of the UK are nations rather than the UK itself; they certainly are historically nations and may be so presently, but nationhood isn't exclusive; the UK definitely has a national identity whether or not England, Scotland, Wales, and/or Northern Ireland also do.

The US is a more clear case of a Nation with a strong national identity and without anything even arguably competing the way the constituent countries of the UK do; yes, it's people have many ancestral nationalities (which is true in many nation-states), but that's hardly relevant to whether it's a nation-state. Since the advent of the idea of nation-states as a general norm, many polities have built national identities to form nations that coincided with the State and displaced ancestral nationalities as the locus of attachment for subjects of the state, often as deliberate projects.

It sounds reasonable to me to call the US a nation state, and the UK maybe a nation state if they feel like it today.

However, what I was responding to seemed to imply that they weren't under some self-consistent definition that everyone really should use.

"Nation state" is more of a verbal tic from people who need to distinguish that they don't mean US state, than a statement about ethno nationalism.

Yeah, I'd prefer the bike shed to be painted green.