Hacker News Reader

Comment by nimbius | Hacker News Reader

It's official If you are stupid enough to accept the advanced persistent state sponsored threat argument

And you're dense enough to give these guys a second chance

Then you should just fire your engineers and base your entire life out of the Gartner trade rag magic quadrants.

Solarwinds was dumb, but this definitely was an advanced attacker who hit FireEye, DHS, and Treasury. They had ownership of over 18,000 solarwinds servers and went after 10 or less orgs. When they did, the attacks they used were complex. It was very clearly as a state sponsored action and I don't understand why you would dismiss that.

You seem to be asserting that it’s “very clear” with basically zero justification for why it’s so clear.

It's clear that the justification is in the two sentences preceding the "very clear" comment.

OP’s first sentence says Solarwinds was dumb. If anything, isn’t that evidence of the attack requiring less sophistication than one that excludes all but well funded attackers?

It would be impossible for this to be the attack vector used.

While these credentials let you push things to the download servers, the actual malware was inserted much earlier during the build process before the code was signed.

This flaw is from a year ago and had nothing to do with the recent hack. The discourse in these posts that often involve a certain country tend to always lean more towards people's political beliefs rather than anything actually being reported in the story.

I'm either too old or too young to understand anything of what you've just said.

Not OP, but pretty sure he’s saying that if you’re eg a CISO who’s naive enough to accept whatever argument is fed to you for why this is a “state sponsored attack” (implying that it’s not), then you may as well reduce your professional decision making to favoring whatever Gartner recommends in their “magic quadrant” marketing materials.

> base your entire life out of the Gartner trade rag magic quadrants

Seems to work pretty well for a lot of the CIO/CTO level people who I have worked with.

Unfortunately.

Remember that these individuals are usually hired and given responsibility based on their ability to game class signalling games; they exist to justify the status quo.

If the status quo were more justifiable their actual job responsibilities to other people within the organization ( conflict resolution, scheduling, resource allocation, and personnel management) are things that could be automated in a hot minute.

I don’t know about full automation, but I can confirm that in large f500 companies, Gartner holds a lot of weight. Most follow their recommendations. I’m guilty too of using that argument: “According to Gartner...” to give weight to my position when talking to C-level folks. I wish I didn’t have to, but lots of folks trust their recommendations.

"base your entire life out of the Gartner trade rag magic quadrants."

You just described the CIO of a billion dollar revenue NYSE traded company I was with briefly a few years back. The CIO had no degree and thought the Gartner organization could do no wrong, so they were his guide and trusted confidant. It was a nightmare, a total disaster. Everyone in IT there were so used to constant chaos no one seemed to notice or mind. Yikes.

Reply on news.ycombinator.com