Hacker News Reader

Comment by lukeholder | Hacker News Reader

The funny thing is that krebsonsecurity.com are the ones that published the false information in the first place.

Good summary of the whole saga by Crosstalk youtube channel which covers mostly Ubiquiti: https://www.youtube.com/watch?v=paLm0tP5GbI

View on HN

Wait. So his big "whistleblower" source for this article in April was actually the hacker?

https://krebsonsecurity.com/2021/04/ubiquiti-all-but-confirm...

Bad on Krebs for not at least mentioning this.

Not surprised TBH. Brian Krebs has a history of questionable ethical behavior, like doxxing people who leave negative reviews on his book[0].

[0]: https://itwire.com/security/infosec-researchers-slam-ex-wapo...

ITWire is not a credible news source. The site, and especially Varghese, often writes tabloid pieces that are just character attacks.

It doesn't look like you're disputing the specific allegations about doxxing made by ITWire - only mentioning other, unrelated, vague things like "tabloid pieces". There's a Twitter screenshot showing the doxxing - are you claiming that that's fabricated?

I don’t know anything about the outlet but that story looks pretty fine? It links to its sources at least, which is better than most tabloid pieces

Same happened with Crosstalk in a similar fashion. Commented on a video about a product similar to what he was describing and he removed the comment. It’s all about them and the products they want to sell. Not as open/transparent as one would think.

Is identifying a real person by their internet pseudonym really doxxing?

Krebbs doxxed one of my friends who happens to be a gay hacker in a country where both being gay and being a hacker are illegal. Krebbs doesn’t take kindly to any sort of bad reviews or even the hint that he’s not perfect FYI.

Have a link to the story/event?

It was notdan, and he’s quite open about both of the things I mentioned both on Twitter and his blog.

He is mentioned in this article.

Practically by definition, yes.

Yes, linking the two (public and private) identities is doxxing, because... it links the two.

They should have definitely acknowledged they covered this before. But also to be fair, quoting the article the reputation damage was done: “Following the publication of these articles, between Tuesday, March 30, 2021 and Wednesday March 31”.

And the Krebs article was on April 4th. It seems BleepingComputer broke the story and Krebs just re-reported the news.

> And the Krebs article was on April 4th. It seems BleepingComputer broke the story and Krebs just re-reported the news.

Kreb's first article was on March 30 https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-b...

Kreb's second article was on April 4th https://krebsonsecurity.com/2021/04/ubiquiti-all-but-confirm...

BleepingComputer's article didn't come out until the email from Ubiquiti on April 1 and quotes Kreb's article on March 30

Whoops I stand corrected. Wish I could edit my old comment. Looks like Kreb's definitely talked to the guy now indicted in their March 30th article. That makes the complete lack of acknowledgement quite a bit more damning.

Like newspapers of old, he should put a retraction at the top of that old article.

He obv didnt know

He can still post a retraction/update on the original article.

I mean, he added an update already from later in the month, and he clearly knows now.

I give Krebs a little credit here because the "whistleblower" from his original article was really an insider that was part of the investigation into the breach. Obviously this source was also the hacker, but knowing that was impossible.

Now, I believe Krebs should at least acknowledge he made this mistake, sadly he hasn't here yet.

From my cursory reading of Brian Krebs' blog, most posts seem written by a ghostwriter.

what makes you think that?

All the references to ectoplasm.

Krebs uses the word 'I' a lot, but the ghostwriter(s) do not.

Damn that’s a really bad hire.

Reply on news.ycombinator.com