Hacker News Reader

Comment by tdhz77 | Hacker News Reader

I work at the courts and manage our ECF system. Our government was very quick to respond, but not sure it matters considering Russians were in the system for 8 months. On top of that, several vendors were exploited VMware and Microsoft. I’ve fought for the federal government to create instead of buy. I continue to fail. It’s becoming increasing obvious the United States needs a privacy branch for data breaches and also for a whole bunch of engineers building out the next generation of apps for a better/smarter government. This is my life’s work, and I will keep trying.

View on HN

> On top of that, several vendors were exploited VMware and Microsoft.

I haven't really kept up on the latest news about this hack so perhaps I missed an "official announcement" but I had assumed that both Microsoft and VMware were likely additional "attack vectors" as well (after initially "getting in" via Orion).

Microsoft had that NETLOGON issue (CVSS 10.0) a while back and VMware has had at least two (CVSS ~9.8+) "critical" (a.k.a. "drop everything and patch now") issues that I know of in the last several months as well.

Any one of those issues would almost certainly have given an attacker "the keys to the kingdom" (and, from my own experience at least, domain controllers, ESXi hypervisors, and vCenter servers don't typically get updated immediately!).

> I’ve fought for the federal government to create instead of buy.

Unfortunately, that just leads to the Government paying way too much for designed by committee software that isn't compatible with anything that anyone else uses. We've been there before and, IMO, the shift to COTS software was one of the best things to ever happen to U.S. Government agencies.

(On a side note, I've lost a lot of faith in VMware. For something they claim to be "secure by default", there sure have been a shitload of CVEs in the last year or two! Also, just a few months ago, they had to "re-release" patches for a 9.8 because the original patches didn't completely fix the issue!)

VMware is preoccupied with stealing Linux code, not fixing bugs.

Yep, it seems like 90% or more of "their" products are simply open-source code with a web-based front-end that they've slapped on (which is why I refuse to give them any money).

The federal government should not create its own operating system, or log system, but it should pour all of its resources into properly securing the systems it uses; weighted by its security risk. Systems running in root or hypervisor space deserve the most scrutiny and sandboxing. A JS app, less so, assuming its run in a secure sandboxed browser in a secure sandboxed operating system.

Attack vectors like Intel ME must die. (There are already DoD- mandated high-assurance flags to disable parts of ME; but megabyte blobs running on ring -1 must go completely so we can secure ring 0).

Isn't that what the NSA is supposed to do? They failed. They seem to have a big enough budget. I don't think they are incompetent. If they stopped stockpiling vulnerabilities and instead actually tried to defend the country, we might get somewhere. I don't think it is for lack of resources, but lack of principle that we are in this problem.

The NSA has conflicting mandates. Better to think of them as two agencies, red team and blue team. Unfortunately too much red, not enough blue.

They don't need to create it...just have a variant of Linux. It's what the Chinese government does, and there's probably a good reason for it. However, as long as some Microsoft lobbyist can line the pockets of politicians, or politicians say it's "creating jobs" and government should not interfere w/ private sector business...it won't happen.

https://en.wikipedia.org/wiki/Kylin_(operating_system)

Can we just designate Russia as a rogue state and sanction the fuck out of them already? Annexing Crimea, shooting down MH17, Meddling in the '16 US election, meddling in the Brexit vote, poisoning Navalny, meddling in the '20 US election and now this massive hack. A government should not be able to act like that and still get to to interact normally with the rest of international society.

One day the USA is gonna start getting slapped with sanctions for all the stuff it does. I don’t think they’re prepared for that.

Absolutely, the world should not tolerate aggression or deceitfulness like that from any country. Oh, I nearly forgot about Russia's polonium poisoning in the UK, and the massive state-funded doping program for the 2014 Sochi Winter Olympics where the majority of Russian athletes were doped. It really does feel like the past 7 years, Putin has really been testing the limits of what he can get away with, and sadly the answer so far is "as much backstabbing as he wants". Time for that to change

That would take the USD falling from world currency reserve status - which would be the end of modern finance. That kind of economic collapse would make sanctions irrelevant.

That’s hyperbole. The USD has been losing its power as a reserve currency, continuously, for the past several decades. See: Yuan.

Modern finance still exists.

tell me who wants to hold yuan as a currency (not just a little bit for liquidity of trading), instead of holding USD.

The hundreds of millions sanctioned by the US are a good start.

Not so much now perhaps but a digital Yuan exists. Where that is headed is not clear but it has the possibility of disrupting the current order.

US is a hegemony and the strongest nation in every respect. Who would dare slap sanctions on US without being retaliated upon? Consider the Nord Stream[1] for instance - Russians and Germans want it, US does not want it so Nord Stream is dead in the water (literally in this case).

There is not a nation on this planet that could so much as think of sanctioning US and come out ahead.

1 - https://en.wikipedia.org/wiki/Nord_Stream

If you think these are bad, you should see the list of things they did during the Cold War.

Also, how many other countries behave badly and should be "sanctioned the fuck out of"? Once you start looking at each country under a microscope, your list of countries that deviate from "interact normally" is going to get so long that you're really just walling off the G7 from the rest of the world economy - which is something Russia would love us to do.

It should work like the criminal system in most countries do - do a crime, go to prison for X years. Don't do the crime again, and you get to stay out of prison. Sure it might sting a bit until countries learned that doing things like that hurts them more than it gains them. But slightly longer term, the preventive effects should kick in, and we might get some semblance of civility in international affairs. So we wouldn't wall off the G7 from the rest of the world unless they were very stupid and kept committing crimes.

What would a country "going to prison" involve?

Either way, this system is not feasible without basically a UN replacement. Until then, remember the US' long list of crimes before you call for economically crippling the Russian citizens.

Da comrade, we must discuss the US's transgressions before it would make sense to discuss Russia's.

Edit: Tostino, in case it wasn't clear, this was meant sarcastically, and I precisely wanted to call out the whataboutism, since that is doing Putin's errand, whether trough ignorance or malice.

No. It makes sense to discuss Russia's as well as the US's. Stop cutting in while we are doing the former. Start your own thread about how terrible the US is. Stop with the whataboutism.

You are calling to "sanction the fuck out of" Russia, not discuss the country. Before wishing suffering and death upon the Russian people, remember that we are guilty of equivalent or worse crimes.

Here's a hypothetical. Imagine the the Solarwinds hack had been performed by the NSA against a Russian company and the equivalent sections of government Would you call for sanctions against the US?

Yes, I believe all countries that invade, murder or interfere in elections should be sanctioned by the rest of the world in proportion to their transgression. There should be a club for those who play by the rules - and those who don't shouldn't get invited. Practically speaking, currently the rest of the world is too dependent on the US and China to be able to effectively sanction them, and I also hope this will change in the future, because sanctions sure are justified. I wish no suffering upon the Russian people, but they are the only ones that can legitimately (i.e. without invasions) replace their government with one that will play by the rules of international law. The rest of the world has no right to change their government, but we do have a choice of whether we will trade with them or not. So yes, basically any government that acts like a terrorist organization should have the same sanctions heaped on them. And finally, the Magnitsky Act shows that we can actually effectively target those in power in Russia without unduly targeting the economy of the Russian people - so I concede that pursuing that line first would be in order for humanitarian reasons.

We're already doing these things with North Korea and Iran. I don't see any compelling argument why the actions of the Russian government shouldn't land them in the same boat.

> There should be a club for those who play by the rules - and those who don't shouldn't get invited What are the rules and who writes them? Is supporting hardliner religious fighters in Syria against a dictator but also against every minority is "playing by the rules" or not?

> What are the rules and who writes them?

I just wrote them in the comment you replied to: Don't "invade, murder or interfere in elections" of other countries.

>I believe all countries that invade, murder or interfere in elections should be sanctioned by the rest of the world in proportion to their transgression

So sanction the fuck out of the US too, as we still regularly engage in all three.

>And finally, the Magnitsky Act shows that we can actually effectively target those in power in Russia

>It really does feel like the past 7 years, Putin has really been testing the limits of what he can get away with, and sadly the answer so far is "as much backstabbing as he wants".

The evidence that Magnitsky acts work is dubious in the first placez as your earlier comment shows, but I really don't trust politicians issuing punishments without a trial.

>We're already doing these things with North Korea and Iran. I don't see any compelling argument why the actions of the Russian government shouldn't land them in the same boat

Decades of sanctions in those countries has never led to the kind of political upheaval you're calling for, while causing several hundred thousand deaths. Why subject Russia or yourself to that fate.

Rouge state? Do you mean like invading sovereign nations? Without being provoked? Without declaring war prior to invasion? And ultimately killing thousands of civilians in the process?

Iraq and Afghanistan - who got super power'ed twice - would certainly agree with you. But their most recent concerns are not Russia.

p.s. The USA has quite a history of election meddling as well.

Absolutely, election meddling and invasions are terrible and should be punished no matter who does them. Currently Russia seems to be the primary perpetrator, so they are the ones that we should be discussing sanctions for. (They also did the most recent invasion, in Crimea). All this "but the US also!" is exactly the kind of whataboutism that Glavset trolls routinely engage in, and it's not constructive at all. Yes, the US plays dirty, as does China, but that's no reason to let Russia do so too.

So you understand every state uses similar dirty tools of power. Where do you start changing that? There is no upside for any big state to unilaterally respect and build international law / UN while others take advantage. It is a mere toothless idea now, these states don't have much incentive to follow it.

> Can we just designate Russia as a rogue state and sanction the fuck out of them already?

I have two points on this.

One. The power to sanction is losing the zest it once had. Russia has been building relationships that surpass mere political ties. They'll be fine.

Two. Maybe you don't know you're governments history. Maybe you don't care. I would say ask the middle east and South Americas, the history of any non-EU country that tried building national infrastructure using loans from the world bank and dead democratically elected presidents all over the Levant, Douth Americas and Africa.

Should I especially mention Libya? Did the US want to help Libya from being a top African/Arab nation? What about Venezuela? They're much closer. Are they helping Venezuela?

To your first point: If you look at the kind of reaction the Magnitsky Act got from the Kremlin (cf. that meeting with Don Jr to discuss getting rid of it), it seems that sanctions very much do have an effect on the Putin regime.

To your second point: What kind of whataboutism is this? The US does plenty of dirty deeds and should be called out for it by the rest of the world. That's no reason not to do so with Russia as well. I'm currently reading "The Divide", so I happen to recognize all those coups and dirty deeds you mention - and they are terrible, but also completely inpertinent to the question of holding Russia accountable for its actions on the world stage.

> should be called out for it by the rest of the world

The rest of the world isn't really calling the US out on this out of fear of retaliation. Why aren't you doing it? Are you also afraid of repercussions inside your own country if you call them out? Knowing it's a crime and keeping quiet makes you complicit. Unless you don't actually care about the crime, just the perpetrator, which invalidates the premise of your comment which was:

> A government should not be able to act like that and still get to to interact normally with the rest of international society.

Obviously it can. Other government and the hundreds of millions of people they represent prove it.

> Why aren't you doing it? Are you also afraid of repercussions inside your own country if you call them out?

I am, regularly and to anyone that will listen. And no, I live in a western democracy, so I'm not afraid of the repercussions here for doing so. Please stop your unfounded ad hominem attacks. But for the moment I would like to avoid this whataboutism - if a thread pops up criticizing the transgressions of the US rather than Russia, such as is the topic of this one, then I'll gladly participate there too.

> Please stop your unfounded ad hominem attacks

With an opening like this:

> Can we just designate Russia as a rogue state and sanction the fuck out of them already?

I found my comment and question (which was as honest as possible) rather relevant and in no way an ad hominem attack. Based on your comments I highlighted the fact that it's a biased opinion, thus on very shaky ground and open to be challenged. An opinion that follows people/countries rather than actions/facts is not worth the pixels it's displayed with.

> completely inpertinent to the question of holding Russia accountable for its actions on the world stage

You wave the "whataboutism" flag to get out of any pinch but refuse to accept it's not whataboutism if it hits at your premise. The pertinent reason we can't/shouldn't hold one country (as per your statement) accountable on the world stage is that we don't plan on applying the same treatment fairly to everyone . This degrades the claimed intention of justice, and simply makes this look a blunt tool to be used by some countries against others in order to increase their power, legitimizing any attacks as "defensive" ("They're right to do it after being unfairly punished").

So it's exactly what I said when you "took it personally": we punish the country not the deeds, and this looks less like justice and more like something that justifies any response as defensive. Sure, you can punish selectively with the gun to everyone else's head but it just further strengthens my point.

I stand by my challenge and if you feel that taking it personally or claiming whataboutism at every step helps your case feel free to do it.

And I'll be clear on my position: all superpowers act the same to keep their power. Which is why none of them has to be allowed to get the upper hand over the others. With no checks and balances there's no superpower that will act "decently". At this point the US is the one on top of the pile trying to increase the distance. This makes me feel uneasy not because of the country (of the 3 I feel most comfortable with them there) but because of that "too much power" issue.

> What kind of whataboutism is this? The US does plenty of dirty deeds and should be called out for it by the rest of the world.

If you havent figured out why "the world" doesnt call out the US, then I don't know what to tell you. Perhaps you really do think/believe all that defense spending is just to fight brown people who just a year perviously were herding goats or studying. Maybe you think those gunships and M16s are water cannons and squirt guns respectively.

I don't really know.

> so I happen to recognize all those coups and dirty deeds you mention - and they are terrible,

Do you though?

And who must punish the US and what must the punishment be? Last I checked the US isn't accountable to the ICC or the UN. If you can recommend punishment for a sovereign state on the otherside of planet and claim to understand your shortcomings, what punishment do you deserve and how must it be carried out?

People take a punish the enemy rather than a punish the deed approach so your argument will never make a dent in that. You're fighting against a level of double standards that we haven't seen since the peak of the Cold War. At best you'll be accused of whataboutism.

But this is pervasive in some cultures so it's taken for granted as a valid approach, look at judges even in free, democratic societies who punish people based on color rather than the crime. It's a similar problem albeit with different motives behind it.

Every single one of the "superpowers" is guilty of this, not just Russia. Russia's just easy to target because it's obviously authoritarian, and thus villainous by default.

The problem is obvious. The solution is not. Sanctions won't help, but I'm not knowledgeable enough to say what WOULD help.

Russia's an easy target because of its history and its positioning against the west, the same is true of China. It's obvious that they're taking advantage of this situation - it directly weakens NATO which directly increases their power. It's not because "they're the big bad." It's because it makes the most logical sense and there is a lot of pretty easily verifiable smoke.

The governments of Russia and China are ideologically anathema to me personally. I try very hard to avoid my gut reaction, which is rather... final.

Knowing this reaction of mine, every time I post something about either country, I have to be extra careful that I'm not indulging that.

Also assassinating a person in the middle of Berlin -- coincidentally a walking distance from my apartment.

Can we just designate the United States of America as a rogue state and sanction the fuck out of them already? << Insert numerous citations >>.

What is sauce for the goose is sauce for the gander. Or, to put it another way - One mans' terrorist is anothers' freedom-fighter.

We hear you.

A long time ago I tried to start something similar in UK - http://oss4gov.org/manifesto

My contacts are in the profile if you want to chat / scheme :-)

As long as they can get everyone to trust them every time they shout "Russia" this won't happen. Step one is to not listen to the propaganda machine, otherwise we'll just exchange one broken system with another. I'm amazed at how almost everyone seems to distrust the government except when it points at Russia. If the government points at Russia, PRC or NK I would take a step back and disregard all information from anyone associated with them and then make up my mind. I don't believe for a second that Russia is behind this unless NSA etc. already knew and did nothing for whatever reason and that's far worse than having Russia access your systems.

"Russia" has turned into an "airhorn" term, one that when deployed stops all further thought. Others: "terrorist", "white supremacist/racist", "sex trafficker" and the perennial favorite, "What about the children?"

Any particular reason you don't think it was Russia?

Russia seems to be the go-to nation to be blamed for hacking activity, and so I am by default skeptical. Is there actual evidence of it being a Russian state attack or was Russia blamed out of habit?

Skepticism of course stems from decades of government lies and misrepresentations of truth in order to justify horrendous actions ie. what was done to Iraq, Lybia, Syria.

While I do agree that Russia is use a lot as a scapegoat for the embarrassing failures of our political system; on terms of pure espionage Russia is probably the true culprit. They have been our equals in spycraft through the cold war, and due to the current Russian president being ex-KGB it's safe to say they are probably very favored in their current administration. Espionage is one of Russia's core competencies, it's just how it is.

(Note I'm talking about espionage in the information gathering sense, not the overthrowing of regimes action movie sense)

> . Espionage is one of Russia's core competencies, it's just how it is.

I really question this assessment. Russia is not USSR, not by a long shot. Russia has lost an entire generation of the most educated people it did have, and I see no evidence that it ever recovered or will ever recover. Economically tiny and outright insignificant Russia simply isn't capable of developing serious technological capabilities to rival that of the US.

By focusing on digital warfare, Russia can have a larger impact than their GDP would have you think.

It's not that the USA couldn't match them, it's just that Russia has made it more of a priority. Tactically speaking, it's an excellent force multiplier with (varying degrees of) plausible deniability.

In 2016 I believed the conservative talking point that Russia was just an excuse the Democrats were using for losing the 2016 election.

Then Paul Manafort went on TV and gave the most unconvincing denial in the history of denials (That's what I sai... that's what he sai... that's, uhh, obviously what our position is.) Then Trump Jr preemptively tweeted soon-to-be-leaked emails detailing that they had in fact met with the Russians. Then the Muller investigation turned over a hundred other connections. Then, over the next four years, POTUS lifted the Magnitsky sanctions and turned a stubbornly blind eye every time Russia did something stinky, often directly contradicting public statements made minutes before/after from his own office.

Anyway, point is: there's an extremely powerful propaganda machine dead set on deflecting attention away from Russia, and that's concerning. More proof one way or another is always better, but this whole "there is no amount of evidence that can convince me Russia did it" trend is a problem.

From a WSJ reporter:

> Officials and others w/ knowledge have said the evidence of Russian culpability is overwhelming and that the view in the admin is "pretty unanimous."

https://twitter.com/dnvolz/status/1347298428804587523

And as we all know, anonymous intel sources are never spinning a yarn for their own purposes ;)

Or anonymous interwebz commenters?

(That's a general comment, not directed at you or any other specific person)

Yeah, definitely, such was my point.

I've always been a big fan of believe only half of what you see and none of what you read.

So exactly like back when Iraq had WMD's.

Given that almost all of the intelligence agencies concluded that Iraq did not have WMDs, it was not at all "exactly like" the attribution to Russia.

But welcome to HN

It's not just the federal government — the problems with ransomware in healthcare are the same problem. Similar issues are emerging at the state level in places like universities, which used to roll out platforms all the time, individually or collectively.

Reply on news.ycombinator.com