Hacker News Reader

This smacks way more of "well, what did you expect would happen?" than surrealism. If you introduce a vulnerability, it is nothing but hubris to think that you'll be the only one to leverage the vulnerability.

View on HN

Kind of, but my reading of it is that it was also a supply-side chain attack where they modified the constant that was used in the code before the binary was built. So at that level of access, I'm not sure any algorithms would hold up. I don't think Dual ECDRGB was used to attack the source control system.

The brilliant part is that they did it in a way that remained undetected for so long. And the reason they could do that is because the backdoor already existed.

I wonder how much Intellectual Property was exfiltrated because of this?

Its hubris to think that a national state that can design and execute this kind of attack really needs your IP.

It's decades of antivirus style mindsets (we'll just clean up after), mixed with formerly being in law "enforcement" (we can't do anything until AFTER the law is broken), mixed with decades of "security by obscurity" and paranoid "hide and seek" culture, mixed with 9/11 vengeance, plus American exceptionalism.

With a smack of ham to it. I call it hot ham water.

Reply on news.ycombinator.com