Hacker News Reader

Comment by denimnerd42 | Hacker News Reader

I wish the NYT would clarify or retract this piece/headline

https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-...

> Widely Used Software Company May Be Entry Point for Huge U.S. Hacking

> Russian hackers may have piggybacked on a tool developed by JetBrains, which is based in the Czech Republic, to gain access to federal government and private sector systems in the United States.

My company has banned Jetbrains now and received questions from regulators about it. Don't see them banning Microsoft anytime soon.

View on HN

I remember that one. They did change the headline in fact. The original version erroneously said

    Russian Software Company May Be Entry Point for Huge U.S. Hack

They changed "Russian" to "Widely Used"... Oddly the version the wayback machine caches has "Russian" in the headline as well as "based in the Czech Republic" in the first sentence.

https://web.archive.org/web/20210106195835/https://www.nytim...

It is clearly an alarmist "yellow journalism" kind of article, I agree. The headline swap is a bit revealing; they never would have framed the article this way in a similar situation for a U.S. company, even if "may be entry point for huge hack" would be just as accurate.

I'm not sure there is anything technically incorrect in the current version of it though.

Also holy cow is Internet Archive doing god's work, I'm gonna go send em some money right now.

Czech here. JetBrains is really incorporated as a Czech corp., but in the same way that many ships are registered in Liberia. I have some paid licences of JetBrains, I have e-mailed back and forth with JetBrains employees in different positions, and all were Russians.

Interestingly I just had an unrelated discussion on goodreads about that. The first mentioned author of the NYT article is supposedly a cybersecurity expert. The article lacked any evidence and called the company russian and obscure, they edited that but it’s still on archive.org

https://web.archive.org/web/20210106195835/https://www.nytim...

I left a goodreads comment on the NYT authors latest cybersecurity book calling her knowledge and practice in question. How can article like this stand, if it cannot be backed up, bad journalism and a lack understanding of the matter?

This makes me wonder, 3 branches of government exist to balance each other out. Journalism stands on its own, what’s the counter balance to journalism?

Journalism, "the 4th estate", in the past was used to go after the powerful but it has recently become the power.

It's a concerning change and I don't see it getting better. Maybe it's "corporate journalism" that is problematic.

There was never a time when journalists challenged "the powerful" as a collective. They challenged the powerful enemies of their powerful employer.

The difference is now we have better information infrastructure and they can't make things that are disagreeable quietly disappear [0] so easily. The disappearing news story isn't a new act; what is new is now the story can linger despite that.

[0] https://www.bbc.com/news/world-us-canada-50296742

It’s other newspapers and online entities such as this. In this case I am sure the company suffered financially, they should be able to pressure the NYT to retract the story, they have some muscle with the google ties.

Once upon a time, ombudsman and journalist associations, and competitors. These days, those tend to all be the same, if they exist at all and aren't deemed "propaganda" or "fake news" or "disinformation" or similar.

If you’re in the US, or any country with comparable speech/press protection: the same rights that give them protection to publish. I know it’s unpopular here but social consequences punishing bad press behavior are effective, just like punishing bad politician or famous people behavior. This is sometimes paraphrased as “vote with your feet” or “vote with your wallet”, but lately it’s been maligned as “cancel culture”. Either way, you’re allowed to just call bullshit on a publication. You’re especially allowed to not consume it.

I thought cancel culture was about trying to get individuals fired for things unrelated to their work?

It's evolving. Cancer now wants everyone cancelled.

Replace "cancelled" with "held accountable for their actions"

The fact that you think those things are unrelated to their work tells me I should probably avoid working where you work.

"Cancel culture" isn't choosing not to consume media. "Cancel culture" is actively trying to destroy it, like advocating lawsuits against Fox News, or deplatforming media hosts.

What you describe is how it's always been. Current "cancel culture" is nefarious as it actively tries to remove other's ability to access it. "Cancel culture" is authoritarian and undemocratic.

Other journalists.

Critical thought. Other journalists and free speech can be censored by private companies that have no obligation to follow any due process. During information war critical thought is the most important asset, without which you're as good as illiterate.

Um, in countries where the government can play the ultimate arbiter of truth in speech they also get to determine what due process is, which usually is exactly what suits them. Private companies reflect the values of their shareholders and customers, which at least is made up of citizens without the coercive and exclusive power to say, lock you up for your reporting, or literally kill you and your loved ones over your reporting, which still happens to this day. If there is demand, and placed out of the state's hands, at least alternate channels, whether more accurate or not, more ethical or less, with or without an agenda, can exist. The alternate scenario easily renders them unable to exist in the first place. "Due process" when applied outside of official government action is simply coercing a standard set by the government upon collectives of private individuals even if - especially if - it is unwanted. It's an illusion of fairness that masks coercion, because there's either enforcement mechanisms for compliance - coercion - or there isn't - which is a charade and meaningless. Neither produces positive outcomes. Those in power will simply use it to cover up mistakes or intentional wrongdoing first.

Companies can't literally speak as in vocalize as a person, but they can, as entities, create the equivalence of speech in the societal sense, and shifting the arbiter of truth to the state will simply centralize that power in an entity that, in addition to dominating the marketplace by default - you can't exactly pick where you're born, nor where you can move to realistically for the most part - they can bring real consequences. Deplatforming is child's play compared to actual imprisonment or getting pushed out of an airborne helicopter.

Ah, that uncensored dark web existed IRL: https://www.npr.org/sections/thesalt/2014/05/27/314961287/ho...

“Journalism” is not a single entity or even a unified bloc.

Journalism exists in the market economy, so other market forces counterbalance - consumers, other corporations.

Journalism also exists under government regulation, despite strong legal protections.

Theoretically, the judicial branch, via defamation law.

"Journalism" - quotes intended.

Social media

I wish. It seems like social media largely serves to amplify biased or outright false journalism rather than give it balance.

I've seen plenty of cases where social media users accurately pointed out false or misleading journalism. But I suppose it depends on who you follow.

Social media is just pushing the narrative of mainstream media at this stage.

If your company bases security decisions on articles in the NYT then they’re beyond helping. Frankly that’s both laughable and incompetent.

No professional (in any field) should base a decision solely on something written in any secondary source. Even if it was a specialist publication, a competent professional should do their own research, and look at the primary sources.

Imagine if a doctor or civil engineer based professional decisions on what they read in magazines and newspapers. The thought is horrifying.

The problem is not that the NYT article is factually incorrect (if in fact Jet Brains were being investigated, which seems plausible). The problem is that anyone who’s reasoning skills exceed that of a five year old child should realise that there is a good possibility that the investigation would turn out to be a red herring.

> The problem is that anyone who’s reasoning skills exceed that of a five year old child should

The problem is that many companies have lots of clients that don’t have this reasoning capability. The reputation damage is much worse than the actual harm if you’re a “known contractor compromised by Russia” or whatever the dumb narrative is. It’s literally easier to drop it immediately “pending investigation”.

Is it really that obvious? If a company gets a bad rap for being insecure, is it rational to go for them? Sure, you should do your due diligence, when picking any solution, but it's certainly a factor which could discount someone from a shortlist.

You're not always the one to make a decision. When you are, there are a number of stakeholders who can influence your course of actions, and when solutions are similar enough, it is easier to take the path of least notoriety.

The "rap" in this case is entirely artificial. There's no evidence TeamCity is insecure, or at least, no more insecure than any other CI system.

In our field it is actually a reputational risk issue, but you're right. The fact they couldn't come up with a better solution than banning Jetbrains doesn't speak well.

I’m a 100% with you, but this is unfortunately not how people in many companies operate. The fact that organizations like Gartner and any one of the Big 4 exist proves that people are very much in the habit of transferring their decision-making risk onto another party.

> No professional (in any field) should base a decision solely on something written in any secondary source. Even if it was a specialist publication, a competent professional should do their own research, and look at the primary sources.

> Imagine if a doctor or civil engineer based professional decisions on what they read in magazines and newspapers. The thought is horrifying.

No, I really really don't want doctors looking at primary sources. They don't have time to find and read all the sources, and they tend not to have expertise to understand specialist papers.

I would much rather we have organisations like NICE or Cochrane who employ experts in evidence based medicine to gather and précis the science and come up with recommendations for assessment and treatment.

The doctors however absolutely should not based their decisions on NYT.

I'm not sure I agree. I'd much rather that doctors base their decisions on what they read in publications in their field rather than do their own research.

> Imagine if a doctor or civil engineer based professional decisions on what they read in magazines and newspapers. The thought is horrifying.

Naaah, don't worry, doctors are only basing their treatment on what their most obnoxious patients are requiring, based on things they have read on Facebook and Twitter. (I mean, how can you trust journalists ? As the linked article says, those people are "wrong" , too.)

You can't even sue them for libel. It's the kind of article that's perfectly legal, and yet does tremendous damage.

Yes, HN and Reddit comments can point out the flaws, but that's not going to make a dent on the public opinion.

So what options do we have to counter-balance "journalism" like that?

Glad someone else brought this example up. Honestly, what a staggeringly low quality piece of journalism.

I have a similar experience, where Jetbrains is effectively banned. Do you have any updated source that I could circulate to clear their name?

Writeup of the actual attack malware running on the build servers:

https://www.crowdstrike.com/blog/sunspot-malware-technical-a...

It attacked MSBUILD.EXE processes on startup, and it didn't matter if they were started by TeamCity or by a homebrew script in Powershell.

They wrote about it on their blog.

https://blog.jetbrains.com/blog/2021/01/07/an-update-on-sola...

https://blog.jetbrains.com/blog/2021/01/08/january-8th-updat...

Summary: they have no idea what anyone is talking about, nobody has told them anything and there are no known issues with TeamCity. Later they did a blog post with security tips for locking it down but they're all pretty generic things that'd apply to any CI system.

These companies that are banning JetBrains and thus locking themselves out of some of the best software tools out there are now suffering the consequences of years of mass hysteria over Russia, largely promoted by the New York Times. Every time someone read or quoted the New York Times as an authority on something and did not receive major pushback, it was another brick in the wall that has now led to this.

It was all entirely predictable. In 2017 I wrote about an even more deceptive and malicious article in the New York Times on the topic of "Russian Twitter bots" and Brexit. The story was based on an academic paper that superficially made it seems like credible expertise, but was intellectual fraud from beginning to end.

https://blog.plan99.net/did-russian-bots-impact-brexit-ad66f...

After that I started compiling a list of stories I read about Russia that fell apart when fact checked. I gave up after doing sixteen of them because it was just endless.

https://blog.plan99.net/%D0%BF%D1%80%D0%B0%D0%B2%D0%B4%D0%B0...

The thread article starts by saying, "Most educated people believe that premier news outlets are inherently trustworthy". This is probably true but just makes it clear that education doesn't make people smart. The total unreliability of anything Russia-related in the "educated" press has been obvious for years. The only way for things to get better are for people to repeatedly attack the credibility of these outlets, in public, on any topic where they engage in deceptive practices, in front of the sort of decision makers who are now making snap anti-Russian decisions on the basis of prior articles.

> decision makers who are now making snap anti-Russian decisions on the basis of prior articles.

This is how you get the public to support hostile actions later, including even armed conflict. We all know the only reason for the relative peace between the West and Russia has been nukes... But Russia is still seen as the enemy and anything criticizing them can go almost completely unchallenged in popular media.

China is also on the same boat. Not that they do not deserve criticism, they certainly do... but when people don't need any fact checking at all to believe whatever allegations come to light (as you mention, examples of fake allegations going unchallenged are endless) you do need to start worrying that the rethoric can go too far and cause undue harm, eventually.

1. Thank you for the response and resources.

2. As a paid NYT subscriber, I am becoming increasingly aware that they make some big mistakes in their reporting. They deserve some criticism, absolutely. I continue to expand my sources outside of the bubble and think critically when reading the NYT.

3. In 2012, Mitt Romney was mocked after a debate with Obama for saying Russia was a threat to the USA. That has aged poorly. Let’s not make the mistake of dismissing Russia as a legitimate cyber threat. Not all of the reporting on Russia is incorrect.

I agree the Russian government (as opposed to all of Russia) is absolutely a legitimate threat to the integrity of US networks, as are the governments of many other countries. And of course the US government is a proven threat to the integrity of both US and non-US networks.

Unfortunately the reporting on purported Russian hacking events seems invariably to collapse when examined. My conclusion from all this is that the Russian equivalent of the NSA or GCHQ (the GRU?) must be pretty good at not leaking and not being caught with obvious fingerprints on its operations. Every plausible connection between a serious hack and Russia I've seen is extremely circumstantial, whereas for the NSA or GCHQ we actually have their internal training materials and presentation slides.

Attribution is always hard but SolarWinds has some obvious fingerprints.

If you consider it hacking, the Russian bot farms (IRA) is well documented too.

Maybe they are good at not leaking, I’m not sure. I will say, I’ve heard some grudging respect for the SolarWinds operation in security circles. They have a functioning offensive cyber organization, that’s for sure.

What are those fingerprints, in the SolarWinds case?

"Hacker used linux."

ipso facto linux is dangerous

ipso facto ban linux.

"Hacker was breathing oxygen"

oxygen aids cyber terrorism

...

Could that sort of misrepresentation qualify as libel? Or are newspapers somehow immune to that?

I agree there's a hint of yellow journalism afloat here.

> My company has banned Jetbrains now and received questions from regulators about it. Don't see them banning Microsoft anytime soon.

It was their collaboration software that got hit iirc. I also recall the delivery method being very smart, something along the lines of inserting code during compilation. While it's certainly reasonable to ask JetBrains to prove their releases are infection free among other things, banning all of their software seems excessive.

Out of curiosity, what would you want to see clarified? They said that it “may” be an entry point for the SW hack and, according to some National Security folks, it is being investigated.

Is there reason to believe this is incorrect in some way? It may be premature and amount to nothing if Team City had nothing to do with the breach, but it doesn’t appear to be misleading or false. If it was, I’d imagine JetBrains would have filed a lawsuit.

The weasel-wording still left most readers with a clear impression that flaws in JetBrains software were directly implicated in the hack, and many US companies proceeded on that basis.

But it wasn't -- the attackers had reconfigured the build servers to add malicious code to product builds, but their malware was targeting MSBUILD.EXE processes on startup, and would have worked just the same if SolarWinds wasn't using JetBrains at all, and those processes were started instead by Jenkins, CircleCI, or a human typing at a command line. Here's a technical writeup:

https://www.crowdstrike.com/blog/sunspot-malware-technical-a...

As to the lawsuit: JetBrains is not based in the US; a lawsuit would probably take years to reach resolution, and be a massive, expensive distraction.

Readers interpret the article with prejudice, the resulting understanding is what needs to be clarified.

Reply on news.ycombinator.com