Hacker News Reader

Comment by resoluteteeth | Hacker News Reader

This article seems to be saying that it's reasonable to expect that google should avoid reporting or fixing security vulnerabilities being actively exploited by the US government, and this isn't something that should make other counties consider Google to be working as an agent for the US government and therefore deserving of being blocked or sanctioned.

By the same token should we we also consider it reasonable for companies Huawei to avoid fixing security vulnerabilities being exploited by governments like China and not consider them to be deserving of having importation of their products blocked on this basis?

I don't think other countries would necessarily want to use google products if they are intentionally leaving security vulnerabilities open, so maybe it is better that all companies fix all security vulnerabilities they find?

View on HN

It should be fair and equal. It's either everybody acts on behalf of their country of origin or everybody fixes all problems they find.

"Country A can do it, but B can't because A is X and B is Y" is not an acceptable solution IMHO.

No, I don't think that's practical.

Standards like transparency, rule of law and a clear separation between corporations and the government should be uphold completely independent from the fact that this isn't done exactly as rigorous everywhere on the planet.

It's a relatively new (and IMO flawed) idea that western democracies should corrupt themselves just because non-democracies exist.

I think it's rooted in insecurity over the long term superiority of democratic institutions. This might lead to western democracy being perceived as something you do not because it's strengthening the country but because you want people to enjoy it as a luxury as long as the country can afford it.

I think that's wrong and will surely be out of fashion as soon as more prominent autocratic regimes fail to deliver as consistently as they currently do.

> relatively new ... idea

The ghost of Henry Stimson would disagree.

It's not 'corrupt' to spy on other nations and it's not 'corrupt' to facilitate it.

It's not rooted in 'insecurity of the belief in a style of government' it's rooted in basic security measures. Western nations spy on other nations as a matter of national security policy much like they invest in early-warning satellites.

The 'corruption' stems from the type of authority that drives the activity, their motivations, and what they do with the power.

When spying on and manipulating other countries takes priority over protecting everyone including yourselves, that is indeed corrupt or twisted or whatever word you want to use.

Fixing a software bug or vulnerability is unequivocally good, and the sooner the better, regardless of who thinks they need that bug to make their global manipulations a little easier. The realpolitik BS is just too easy of an excuse for any monstrosity, and the blowback is always worse than the immediate problem.

It's not 'unequivocal' though - we don't have enough information to say that. You have to know what the vulnerability is, how it's exploited and what the consequences are.

While I don't doubt that in reality, erring on the side of closing it is probably the right thing to do, the fact is we don't know.

If the vulnerability is being used to thwart a rogue entity from developing nuclear weapons, the balance of facts may be on the other side. At very least, Google should have worked with agencies on getting it closed down.

If they were using it to make a drug bust, when then who cares, shut it down.

> If the vulnerability is being used to thwart a rogue entity from developing nuclear weapons, the balance of facts may be on the other side. At very least, Google should have worked with agencies on getting it closed down.

The rogue entities on this planet already have nuclear weapons (and no, I am not talking of North Korea). A widely overlooked fact is that the nuclear non-proliferation treaty obliges the nations with nuclear weapons to get rid of them[0]. This part of the treaty has never been uphold.

[0] https://en.wikipedia.org/wiki/Treaty_on_the_Non-Proliferatio...

This is a misrepresentation.

There are no 'rogue entities' with nukes outside of N. Korea unless you consider Pakistan to be 'rogue', or, their benefactors, Saudi Arabia who undoubtedly have access to the tech the moment they need it to be ... but they are not 'rogue', or rather, the action would be widely condemned but a different story altogether.

Iran, would be a 'rogue nation' trying to get nukes, which they have signalled they are trying to do.

A wayward state or quasi-independent province in the Caucuses, the M/E or Africa would be that as well. Or of course some legit terrorist group.

And it would have nothing really to do with non-proliferation obviously.

If the US was trying to thwart Iran from getting nuclear weapons through some back door, then it frankly would be in Google's best interests to help.

The notion that large corporate entities can exist in a geopolitical context and yet somehow ignore it at the same time is nonsensical. Once you are 'Google Scale' your piece is on the table and you have to play.

Edit: to put another way - Google's very existence is protected and enabled by the US Economic and Geopolitical situation in a tangible way. It's not abstract at that level, like it would be for a small company.

Remember how we thought of US Army in Iraq as 'Exxon's Army'?

Well it's 'Google's Army' now ...

To be clear, by "X" you mean "amoral" and "y" you mean "moral"?

I think it not only acceptable but incumbent to hold yourself to a higher standard of behavior than the lowest common denominator. "An eye for an eye will make the whole world blind."

(There's also a practical reason: China is much more effective at their approach than the US is, being much more experienced at it and also having stifled internal debate about it. If the US gives up its claim of being a morally superior employer than China, why would anyone skilled want to keep working for what will inevitably be the losing team?)

> To be clear, by "X" you mean "amoral" and "y" you mean "moral"?

It can be anything. It's intentionally X & Y, not X & !X or a more concrete word. Put whatever you fancy. Democratic, White, Sunny, Oreo...

I don't take sides or make a suggestion. I do not suggest that we should go to the lowest denominator but, we shall aim for much higher. OTOH, entropy loves lowest common denominator and drives everything down. Lowest prices in cost of quality. Chaos for minimizing energy, etc. We're trying to reverse natural chaos in many areas and it's worth it IMHO, btw.

For the same reason there are no country names in my comment. Fill the ones you want. My comment implies nothing. It's the readers' bias which puts USA/Russia/China/Moral/Ethical/Democratic/Totalitarian.

I see a lot of polarization in the world and everyone is claiming to be the good guys. We can improve when we accept that we're only guys and work upwards from there.

Your comment is in reply to a comment about China, which is why I referenced China. (But if you wish to say your point is abstract, then my comment also applies equally well in any direction - I don't think China should use the US's misdeeds, which are plentiful, as justification for their misdeeds either!)

I am unconvinced that abandoning the attempt to be the good guys will lead people to be good. I believe it will only allow people to be bad guys without feeling bad about it. While claims to be moral have of course been used by many bad guys through history, the correct response is to argue convincingly that they're immoral, not to give up the idea that morality is a worthwhile standard.

Or, in other words, I believe morality is qualitatively different from any of those other categories you list. If a store chooses to sell Chips Ahoy instead of Oreos, that's just a question of taste; if a store chooses to sell cookies filled with razor blades and arsenic instead of Oreos, that's a different matter entirely, and we are not obligated to accept it because we've accepted that stores can sell Chips Ahoy.

The comment wasn't about China when I first wrote it. It expanded a lot in 1-2 edits. In all honesty, I didn't plant any implicit meaning into my comment.

I'm not suggesting abandoning the intention of being the good guy. Instead, I suggest to stop using it as a shield or plausibility cover for misdeeds. Instead I suggest the viewpoint of "Hey, we're trying to be good, but we fail sometimes. Let's accept it and collectively try to construct a better good, which is fair and equal to everyone, as much as possible." I think this is workable and can be iterated upon to make a better world (I know it's very hard, but it's not impossible).

Morality and ethics is universal. They're hugely important values to build upon, but interpreting them according to one's desires or in a subjective light, without empathy, makes them hollow. Again, a lot of misdeeds can be conducted by abusing these very important values.

I deliberately don't give any examples, because the examples may derail the conversation and take the spotlight to the examples themselves. All possible examples and evaluation of them is left to the reader, as a multi-faceted mental exercise.

Hope this clears my intentions a bit.

All right, that's fair - I think that approach leads to something like like, country A should not do morally-questionable action M, nor should country B, and if country A chooses to do it anyway, this shouldn't justify country B saying "Well why can't we" - country B should stick to its position and criticize country A. I'd agree with that.

(I originally read your comment as saying that it is unfair for country B to be enjoined from action M if country A is engaging in it, and I think other commenters did too. I do absolutely agree with the goal of collectively constructing a better good in a fair and equal way, holding everyone to that standard, and expecting that people will fail but it's worth trying to meet that standard nonetheless.)

It should be fair and equal, and countries that do not agree to the fair and equal rules, they should be excluded from free trade.

Shall we start with ones which insist that fair and equal means what they choose to mean instead of what they mean universally?

"What they mean universally" is actually a harder thing to peg down than one might assume, which is one of the reasons we still have separate countries in the first place.

It's also why the "rules based international order" is not much more than PR for violent hegemony.

I don't think I understand what you mean. Is the European Union a rules-based international order? It doesn't seem to be a violent hegemony from the outside looking in.

EU happily bombed seasteading projects.

Also Somalia originally wanted to split in multiple countries and NATO interventions happened to prevent that and force them to remain only one country, and remain in Civil war

> EU happily bombed seasteading projects

How the EU member states act towards parties outside the EU seems a bit beside the main point: that the EU itself actually is about international rules and not a cover for violent actions between the various member states.

The EU isn't about international rules - members of the EU don't care at all about international rules. It's simply a covenant between countries that can be willingly entered and left.

The "rules based international order", on the other hand, is not voluntary. If the US decides that you are in breach, then it will be rectified with hard power. It's simply an abstraction for hegemony, and you don't get a choice to parcipate or not, the choice is made for you by the hegemon (which also happens to be its enforcer).

The EU is not the rules based international order, it's a supranational entity.

The "rules based international order" is supposedly the body of international laws and customs as well as their enforcement internationally, and is what the US uses to justify their hegemony, placing them as the guarantor of this order - while themselves violently breaching it.

It's also called the "US-led international order" or the "liberal international order". Put simply, it's the US and its allies enforcing a set of rules internationally with violence or the threat of violence (or economic sanctions)

See: https://en.m.wikipedia.org/wiki/Liberal_international_order

Yes, especially them (assuming you're talking about the US here)

There is no free trade. Trade sanctions are used left and right for political goals.

Trade itself is used for political goals: https://fred.stlouisfed.org/series/LNS11300031

You think -any- country is fair and equal when it comes to spying and their intelligence agencies? It's strictly limited by technical capabilities and nothing else. You're living in dreamworld if you think all countries aren't doing it.

The exact same logic applies to nuclear weapons. How many lives have they saved by being a credible deterrent over the decades? Every country should be allowed to possess them, or else none should. I'm not even sure if the latter is desirable (it'll lead to millions of deaths in conventional warfare), but it doesn't matter, since it is completely impossible (the tech exists, so it will be used, invariably). We're left with only one logical option.

Then let's declassify all nuclear weapon designs and allow everyone to build a lot of them.

Furthermore, let's create economic programs to build a baseline nuclear arsenal in every country. That'll prevent a lot of wars.

Some countries will object to that. Why?

Isn't everlasting peace much better?

Edit: Do I need to point out that I'm not writing these comments in support of war, but with a desire to spark a thoughtful conversation?

MAD works because both sides have something to lose. If you give a nuke to Osama bin Laden, he uses it.

At the same time, I feel like there's still something there. Having nuclear weapons makes existing states much more resistant to opposition. Other states can't topple them in the traditional way because of MAD.

But neither can local freedom fighters -- suppose pro-democracy forces took three major cities in China and started using them as an industrial base to wage a conventional war against the regime. The US and anyone else couldn't really help them the way France did the nascent American Revolution, because of MAD. And if they actually started winning regardless, couldn't the dying regime nuke the rebel cities?

If we don't want people to live under permanent authoritarianism, maybe we still need something to level the playing field.

Though it doesn't necessarily have to be nukes; establishing uncensorable distributed communications comes to mind as an anti-authoritarian power. The fact that Western countries aren't spending billions to comprehensively subvert the Great Firewall is a significant strategic failure.

> The fact that Western countries aren't spending billions to comprehensively subvert the Great Firewall is a significant strategic failure.

I have strong opinions in this matter.

The GFW is only possible because of metadata leaks that Western countries are exploiting too, for security and surveillance, or whatever.

Suppose Western countries start investing billions in subverting the Golden Shield, our own infrastructure and economy would suffer too.

A very naive but simple example:

I tried to train https://github.com/Kkevsterrr/geneva against a CheckPoint and a Fortinet ... It's not been fun for those "next gen firewalls", and CheckPoint is a NASDAQ-100, Fortinet an S&P 500.

the problem with nukes everywhere is one is going to get stolen or sold and used.

The nuclear question work entirely against your argument, and illustrates the naivte of the 'everyone or nobody' concept as totally unworkable.

'Nukes bring peace' mostly only if they are in the hands of a few major, stable powers, otherwise, nuclear proliferation probably is very bad.

These kinds of moral absolutions, i.e. projecting 'rights' into nations etc. (either we all have the right or nobody does) are pragmatically irrational.

Every nation is different, in a different set of circumstances, there's always some degree of moral relativism, but there's some degree of objectivity as well.

We have to balance the forces to figure out what to do in a complex world, and the rules may not always be so cut and dry.

No, that’s not logical at all. When ISIS creates its own state in some fragment of Syria, I don’t want them to have nukes because unlike Russia or Israel, they don’t really care if they get destroyed thus MAD as a deterrent doesn’t work.

no, that's terrible, and also stupid. It's terrible because bad behaviour by one actor isn't an excuse to act in the same way. My neighbour steals thus I'm going to steal is morally bankrupt.

Secondly, from the point of view of the US it's also stupid. The US enjoys influence in the world because it propagates a rule-based order, not because it exploits everyone it can get its hands on. That would rapidly lead to a breakdown of trust and in this case result in every country trying to displace American technology from its markets. Which the EU say, could theoretically do.

> no, that's terrible, and also stupid...

Please read my other comments below (discussion with geofft). This is not the idea I suggest. In fact, it's the exact opposite.

> Secondly, from the point of view of the US it's also stupid.

My comment contains no countries and/or adjectives intentionally. It's neither about US or adjectives attached to US. I'm talking at a meta sense.

Again, please see my comments down the thread. This is not what I tried to say.

The core of the whole discussion is here [0].

[0]: https://news.ycombinator.com/item?id=26592112

It doesn't say "US government", it says "the hackers in question were working for a US ally", which makes it even more complex.

It was likely if it was counterterrorism this is about a Middle-Eastern ally, such Israel or Saudi Arabia?

Neither of these are always US allies, only sometimes.

I think you made a jump there. This could equally be one of the other in the Five Eyes group e.g. Canada, Uk, Australia, NZ.

Denmark, the Netherlands, France, and Germany are also all well equipped for this sort of thing and are as close of allies as you can get outside Five Eyes (DK/NL especially).

The Dutch were the ones who originally warned of interference in the 2016 election IIRC and had access to Cozy Bear for a while before that.

Well and for all the "legal oversight" much of the five eyes operations seems to have been designed around economic advantages, circumventing the rules about spying on your own citizens (it's not us who is doing the spying, it's the Australians). So I'm not sure if it being a five eyes operation makes it better or worse.

There's no "jump". The poster simply raised one hypothetical to consider. "Could be anyone", right?

More likely domestic counter terrorisms under FVEY. I don't know about Google, FB has called out Israeli and Saudi influence before. I imagine only Anglo countries gets default hush hush privileges.

TFA - "democratic" hacking is good: "How one treats intelligence activity or law enforcement activity driven under democratic oversight within a lawfully elected representative government is very different from that of an authoritarian regime."

The CIA has a history of spying on Congress[0], overthrowing democratic governments [1], among a long list of nefarious activities I would not consider proper "democratic hacking." [2]

How is obligating big tech to cooperate with Western intelligence agencies a positive move for democracies?

[0] https://www.theatlantic.com/politics/archive/2014/12/a-brief... [1] https://en.wikipedia.org/wiki/1953_Iranian_coup_d%27état [2] https://en.wikipedia.org/wiki/List_of_CIA_controversies

I'm quite skeptical of the viewpoint in this article - just answering the question from the parent comment of "would China be justified in exploiting Huawei?"

The distinction that this article makes is that our clandestine operations have "democratic oversight." To be clear, I think the author would say that they are attempting journalistic neutrality, but they're giving considerable space to the argument that democratic clandestine services deserve a different standard.

Not reporting vulnerabilities used by a friendly government is a backdoor backdoor.

It really feels like we're heading into or at least towards a new Cold War, with the U.S. and allies on one side and anyone they consider to be a threat on the other.

Both 'sides' will (and really already are) marshal private sector tech, media and social media companies.

non-aligned countries would do best to develop their own tech and media infrastructure because they won't be able to trust anything else.

I think slide into a Cold War could be slowed down by people working in those companies having and enforcing ethical and professional standards. In a case like this one it would mean blocking any hacking attempts that you can, irrespective of where they come from.

For social media companies it would mean devising rules about what content you will and won't allow and enforcing those standards whether the posters are from Russia, Arizona or Afghanistan.

> non-aligned countries would do best to develop their own tech and media infrastructure because they won't be able to trust anything else.

Better than "their own" -- develop free and open source software that will do it even in the participating countries. Which their people can trust because they can see and modify the code, rather than having to trust you, a foreign power.

That subverts the domestic propaganda machine there by allowing the people of the participating nations to talk directly to one another without being intermediated by a partisan spreading propaganda and imposing censorship.

Yeah that's an interesting idea.

There are a couple of issues with it though.

Let's think about Signal, Twitter, Facebook and Tor.

The US government is putting increasing pressure on social media companies like Twitter and Facebook to shape their content.

US government funded open source projects like Signal and Tor allow for the spread of US shaped social media in countries that want to limit it.

So the propaganda machine thrives , it's just that it's the US one.

(note I like and use Signal and Tor, an against censorship in China. This is just one aspect of a set of complex relationships. Etc etc)

We've been in an electronic / cyber cold war for 20 years+. The fact that it's leaked out more is related to the continued growth and dependence on the internet as a whole.

This isn't going to happen, it's already happening and there are plenty of public examples of it.

Anyone who doesn't realize that the US government can rifle through Google's data on a whim (aka secret warrant via Patriot Act) is an idiot. That said they aren't direct intelligence agency like a lot of Chinese corporations. The US government doesn't have real time access to every bit of data that google has, but they are only one rubber stamp away from it. If you keep data on google encrypt it before you upload it.

Special pleading is a hell of a drug.

Reply on news.ycombinator.com