Hacker News Reader

Comment by Maursault | Hacker News Reader

Ok, let's cut the crap. Is Kaspersky a dirtbag or not? I suspect not, but it is an unfortunate accident he was born in and runs his company from Russia, the government of which is a dirtbag, so, correct me if I am wrong, Kaspersky must be a dirtbag by association, but especially for discovering Stuxnet. Believable, but I think the real reasons Kaspersky is persona non grata is due to having discovered Stuxnet, and Kaspersky Lab suspected of uncovering secret US cyberweapons in the future.

I am a patriot, but even I don't appreciate being lied to by my government. It would be good if the next best cyber security firm and software was half as good as Kaspersky's. But I suspect not.

View on HN

The problem is: how do you run a business that has offices and physical assets in Russia, without being at least partially beholden to the Russian government? They have demonstrated that they are not shy about using gangster tactics.

One could say that the same is true in the US, but I believe the degree matters. Although the US government and intelligence agencies will and do try to overreach, there is a strong legal and cultural tradition of exposing, resisting, and fighting these overreaches in the US. I don't see that in Russia.

So, I would not be surprised to see the US strong-arming US companies, but they would do this with sham/flimsy legal cover. The result of non-compliance would be at worst asset seizure and/or imprisonment. Both of these can be examined and contested. I imagine that the penalty for non-compliance in the Russian system would max out at having an unfortunate accident. Gangsters all, but the level of gangsterism and possibilities for investigation/redress matter.

All that said, I'm not a US citizen (although in a Five-Eyes country), so I do worry about using US-hosted services.

> One could say that the same is true in the US, but I believe the degree matters. Although the US government and intelligence agencies will and do try to overreach, there is a strong legal and cultural tradition of exposing, resisting, and fighting these overreaches in the US.

That point would be a lot stronger if the US government hadn't demonstrated shocking callousness and disregard for international law in their efforts to catch notorious whistleblowers Snowden and Assange.

I remember when Belarus downed a plane to catch a political dissident and all western countries acted shocked, even though these countries had tried to do the exact same thing to Snowden on the US's behalf, with a presidential plane no less.

International law isn't really a thing if it has no teeth. I would be more worried about the US breaking its own laws. Which they of course do, on occasion. But there is a lot of pushback and not too much fear of reprisal if you call them out and fight them on it. For example, we are in the process of appointing a supreme court justice that, during her career, has fought against US Government overeach and represented alleged terrorists imprisoned (oh sorry, "detained"), in Guantanamo.

My point isn't "the US is bad because it doesn't respect international law".

My point is that the US is willing to go pretty damn far to put some high-profile dissidents in a hole and throw away the key, and there is very little pushback both internally and internationally, which kind of undercuts the whole "the US government would hesitate to do X because whistleblowers would stop them" argument.

Are you talking about Snowden? Because that is one person and he isn't in a whole. They haven't even caught him.

Another I can think of is Chelsea Manning who ended up getting a presidential commutation of sentence.

Hold up. Downed a plane is different from grounded a plane. I don't know the Belarusian case, but either you misused the word or they are very different.

They forced the plane to land in Belarus by threatening it with fighter jets while it was nearly out of their airspace.

IIRC they pretended there was a bomb threat or some other nonsense.

"Downed" is usually understood as "shot down".

Grounded a plane, yes, sorry. I meant they forced it to land (in the US case, by having neighboring countries close their airspace mid-flight).

I live in the USA, therefore I need to consider it as part of my threat model mostly in the blunders / withholding exploits (thanks CIA ~.~) senses. For everything else I try to vote informed and support a combination of the EFF, ACLU, and other organizations that can be better informed experts on the law and it's applications.

> The problem is: how do you run a business that has offices and physical assets in Russia, without being at least partially beholden to the Russian government?

The same could be said for businesses that have offices and physical assets in the US.

The argument is the US system is more accountable, fair, and able to be resisted. Not perfect by any means, but I see a lot of daylight between the two governments.

The way companies have to deal with National security letters and compliance with sanctions, amongst other things, suggests otherwise.

> One could say that the same is true in the US, but I believe the degree matters.

I think the key misconception behind this argument is the idea that harmful governments is a binary flag, such that if you're subjected to one adding more makes no difference. In fact, different governments have different concerns. This means if you're subject to the US and Russia you're significantly more constrained than if you were just subject to one. As such, it makes sense to reduce exposure even if you obviously can't eliminate it.

(I also believe the US govt is much better than Russian, but I'm leaving that out because I my argument doesn't need it and I'm uninterested in that argument)

> The problem is: how do you run a business that has offices and physical assets > in Russia, without being at least partially beholden to the Russian government? > They have demonstrated that they are not shy about using gangster tactics.

To be fair, the US government has used gangster tactics to get US companies to install backdoors and allow encryption breakers.

The very next sentence in GP directly addresses your comment.

It doesn't matter. The fact is Kaspersky (the company) can be coerced by the Russian government to exploit their highly privileged systems access to millions of computers around the globe.

I don't expect Kaspersky (the person) to play hero under these circumstances.

So can microsoft, adobe, google, etc. Even without them, NSA can intercept the hardware and put their software on those boxes... wikileaks showed a bunch of stuff NSA did.

If you're a valuable target, it's basically choosing if you want to be spied on by the russians or the americans. (or installing linux, and hoping for the best).

> So can microsoft, adobe, google, etc. Even without them, NSA can intercept the hardware and put their software on those boxes...

Those companies often actually have people scan the hardware they receive to check for alterations. There was a whole thing about this a decade ago where a reporter (wrongly, IIRC) accused Facebook and Google of having compromised motherboards, and people from those companies were commenting here about how they are actually very careful with their supply lines and have people vet what they receive with scanning electron microscopes in some instances. (I'll try to find some of the submissions here and edit them as links on the bottom shortly).

I also have it on good authority (a good friend that worked at Google at the time) that Google found out that someone (the NSA) was tapping their inter-datacenter links and that's one of the reasons they made sure all data between datacenters was encrypted, and that was prior to the Snowden leaks.

So yes, agencies are constantly attempting to infiltrate large tech companies for their own purposes. That doesn't mean they always succeed, or that those companies just give up and accept that it happens. They all fight it quite actively.

I was talking about google/apple being able to inject arbitrary code into (almost) any phone via (eg.) google play service update or whatever apple has. Also microsoft with windows update, and many other companies too.

I was really referring to the part of your comment about the NSA's ability to intercept the hardware.

It's true that any any software that allows auto-updating can be used to load arbitrary code onto a system, limited only by whatever additional safeguards are in place. In the case of the OS vendor, that can't really be guarded against, but it exists farther up the stack as well. Chrome and Firefox can just as easily load nefarious code onto your computer, limited only by what the OS prevents (which is generally more on a mobile platform, thankfully) and what their own reputation can sustain if they were found doing so.

Do you have evidence that this happens due to outside or government interference in the company's release process? If not, this is just a conspiracy theory.

They didn't claim that this happens because of government interference... -_-

It's also not a theory.

That google thing is not really a secret. It was widely discussed inside google too. Maybe it came out of Edward Snowden.

This is true, tho installing linux is probably not going to make a difference if you are a target. But the USA can issue national security letters through the FISA court with gag orders that keep the NSL secret. Not only that, but the major US companies have lucrative government contracts such that it can be in their interest to provide the US government with certain kinds of access without being compelled through national security letters.

> Even without them, NSA can intercept the hardware and put their software on those boxes.

Its interesting to note that not many people remember (maybe a generational thing?) Kevin Poulsen found multiple government listening devices installed on Pac Bell networks that were listening to foreign embassy phone traffic which was highly illegal at the time.

It doesn't surprise me the extent the NSA and other three letter agencies have gone to get at information they deem valuable or important.

Except that the statement being discussed isn’t targeted at people who are a target for NSA, but rather those that might be a target for Russia.

Don't expect him to be _able_ to play hero even if he wanted.

In my opinion, that's the right way to look at it.

But is FTC acting after seeing evidence for clear and present wrongdoing or is it merely making a geopolitical assessment.

FTC should follow a fair and evidence based process for arriving at a decision like this.

There should be punitive measures only after it has been established that there is wrongdoing.

Plenty of legit potential concerns.. Russian govt could "nationalize" Kaspersky at any moment and push rogue updates.

They don't need to nationalize anything, they can just threaten his family with imminent and painful retribution and he'll open it up to anything they want. Period.

All these people whining about "they're both the same", they are not. "Bay of Pigs" argument does not apply, last time I checked Cuba was still standing where on the other hand Ukraine is burning and getting demolished.

It seems that those complaining really really do not understand the horror of living under an "official" or "unofficial" (i.e. government sanctioned vs. government tolerated) mafia rule: either you do what they tell you, or you cease to be, along with your spouse, children, parents, siblings, etc. There is absolutely no negotiation.

Shouldnt i have the same concerns with software from the US? You dont really have to nationalize to force devs to push malicious code (looking at you Australia)

> Shouldnt i have the same concerns with software from the US? You dont really have to nationalize to force devs to push malicious code (looking at you Australia)

You should have the same concerns about software from anywhere, including the US. I believe it's a couple orders of magnitude more likely I'd be harmed by Russian government malicious code than any other nation.

Russia is in crisis, striking indiscriminately, and has no reputation left to lose. So that's where my concern lies.

> Russia is in crisis, striking indiscriminately, and has no reputation left to lose. So that's where my concern lies.

With wikileaks, we've seen, that americans did all of the same things, you now try to accuse russia of potentialy doing.

I'm not saying russians won't do it, but americans already did it.

They have - in the past. The threat from Russia is now.

So you're saying that they suddenly stopped for no reason at all?

I've worked in multiple European environments (gov & private sector) that mandated usage of European anti-virus & firewalls.

In finance I had a client that didn't trust any vendor and asked me to reverse engineer VPN appliances (they negotiate a special clause with the vendor), which makes more sense then trusting based on country of origin.

Sure.

But we're talking about a government that just stole hundreds of millions of dollars in foreign planes (and other equipment) and took down satellite radio networks with cyberattacks (causing a lot of collateral damage), recently backdoor'd thousands of companies via Solarwinds, and looked the other way w/r/t ransomware groups until one of them caused a major international incident (Colonial pipeline). The threat from other nations is a lot more theoretical than it is for Russia.

Russia can do it without any backlash from their citizens. U.S. can't do it to their own citizens without backlash. Differences in representation of population means different incentives.

Backlash after the wikileaks? What backlash? FISA courts? Gag orders?

Just call the "other guys" terrorists, nazis, whatever, and americans can occupy and bomb whatever country they want (and they did that to many countries) withot any backlash. Gone are the days of the hippies and anti-war-anything... sadly.

I was kinda hoping for a "revolution" in one of the european countries (eg france) during covid, where people would "remove" the current government, and make the other governments atleast worry a bit when their people get mad... but sadly, not even that.

The only backlash I saw is the backlash to snowden from its own country.

That is just silly, and has to be said in bad faith. Are you serious?

Where's the bad faith? The US and its allies pulled down the plane of the fucking president of Bolivia to catch Snowden.

Those are not the actions of the state worried about public perception, except in a "silence the dissidents" sense.

He's still living in Russia in fear for going back to the US

I do.

This kind of comment isn't my favorite, but I do understand where you're coming from. I personally think that it's better the devil you know than the devil you don't.

I'm American. My country is the US. Yes, they're spying on me. Yes, they do naughty things. But I assume that at the end of the day, the US has my interests at heart more than China does. Or the UK, or Russia, or Turkey, or anyone else. I happen to live on the land that they'll protect even while filling their pockets.

My feedback to you would be to do the same. You don't have to trust your own government but assume your government will keep you around longer than any other government will.

The us government has been known to want to keep people alive for the purposes of chattel slavery.

I'd much prefer misdeeds that don't affect me from a government that doesn't care about me, than those of a local government who wants to keep me alive for the purposes of doing more bad things to me in the future

The FTC isn't telling non-Americans what to do, only Americans. Russian software, outside the jurisdiction of the American legal system and under the control of Putin, is a threat to American infrastructure. American software is not.

Maybe, if the US government thought they could get some useful information from you.

You should absolutely have concerns with proprietary software from the US but unless you are in a country that is currently in a cold-war relationship with the US the concern is likely VERY different.

As a US citizen you still have some semblance of rights under the constitution that dictate what the government can do.

That's nice for some people, but is cf141q5325 even a US citizen?

I'm not, so from that point of view US companies cannot offer many guarantees to me

Snowden's leaks showed that the NSA was simply ignoring the 4th Amendment, and that the secret FISA court was letting the NSA do so.

Theoretically, the Constitution protects you. In reality, the intelligence community acts largely in secret, and there's very little preventing them from violating the Bill of Rights. Citizens don't even know what rights they've given up until someone like Snowden spills the beans.

No. You need to understand what you are comparing to. The question is comparing US and Russia. No. It’s not the same.

But you turned this question into comparing US to perfection. Yes, you are right. US is not perfection.

But there is a big difference between 70 to 10, even both are not 100.

What Snowden revealed does not make 70 to 10. If you think that way, you don’t understand how bad an authoritarian regime is.

Putting a numeric value on this is silly. The fact is that the United States government can compel companies to aid in its surveillance (just recall when they forced Snowden's email provider to install a backdoor).

Even if a company does not want to participate or is not compelled to do so, the US government has very significant capacity to break into and co-opt systems (all the way from targeted surveillance of individuals by intercepting and bugging hardware to tapping undersea cables to indiscriminately hoover up communications).

So when people say that Kaspersky might be forced to go along with Russian intelligence, the same goes for American tech companies and US intelligence. There is indeed a 4th Amendment that is supposed to protect Americans, but the last two decades have shown that the government is perfectly willing to ignore that legal restriction.

The US has the most extensive global surveillance system in the world. US intelligence services receive about as much funding as the entire Russian military. I have no doubt that Russia tries very hard to engage in extensive foreign surveillance, but its not in the same league as the US.

Yeah, I remember when the US government took Apple to court to get them to allow FBI to have a backdoor through the encryption and Apple did not capitulate, though the cases were eventually dropped. While US agencies certainly do crooked things, they do not have the capacity to force companies to do stuff under threat of violence and otherwise that Russia does with Kaspersky.

I also remember when:

* The NSA secretly obtained access to every Verizon customer's entire call log. This was blatantly illegal (the 4th Amendment forbids general warrants), and it only came to light because of Snowden's leaks.[0]

* Snowden's email provider, Lavabit, was compelled to install a backdoor that allowed the US government to read the emails of all of the provider's users. The process was supposed to be secret: the company was under a gag order. The public only found out because the founder spoke out.[1]

There are many examples like this from the US (just look up "National Security Letter," or take a look at Snowden's leaks). You're citing one example in which a company successfully refused a request, but we also know from Snowden that there was mass collection on most Americans that went on for years in secret, despite the fact that it was blatantly illegal.

The scale of surveillance conducted globally by US intelligence agencies is unparalleled. I'm sure Russia wishes it could collect information on the same scale, but it simply does not have the ability to do so.

0. https://www.theguardian.com/world/2013/jun/06/nsa-phone-reco...

1. https://www.theguardian.com/commentisfree/2014/may/20/why-di...

Isn't the difference that the government cannot permanently keep such compromises secret? They have to have a warrant for a limited period of time and limited scope?

Illegal NSA dragnets and perjury in front of Congress notwithstanding.

I put both russia and us at 10. Why would I rate it any better, given its past?

In the US the press can be openly antagonistic toward the government without reprisal beyond maybe having a WH press-core pass tossed. This provides a path for whistleblowers.

Could the Russian press behave toward Putin as the US press toward Trump? If so, then you can have your 10s.

Snowden and assange have been used as example. Although, there are probably more people shut by the Russian government than by the us, by far. The thing is, the US secret services are secretive enough that non one can complain about, independently of the ability of the people to complain.

No, Snowden's leaks show DoD lawyers working hard to justify programs under the 4th Amendment. In the fallout of the leaks, all but phone metadata collection passed muster.

The dragnet surveillance programs that Snowden revealed are obviously outlawed by the 4th Amendment.

Of course lawyers working for these agencies will try to justify them. That's what they're paid to do. During the Bush Jr. years, lawyers for the administration also argued that torture was legal, despite the fact that it's blatantly illegal.

Nevertheless, these programs are incredibly difficult to challenge in court, because the secrecy surrounding them makes even proving standing nearly impossible.

There was only one extant US dragnet surveillance program in Snowden's leaks, which was the phone metadata collection, so I don't know why you have the plural. Snowden's leaks showed the lawyers' justification for that program (https://www.aclu.org/files/natsec/nsa/20130816/2009%20OIG%20...) which said that the data does not fall under Fourth Amendment protection by Supreme Court precedent, and it was never ruled unconstitutional, only exceeding the law that the government claimed had authorized it.

Snowden's leaks revealed several mass surveillance, including PRISM, XKeyscore and Tempora.

As for the (un)constitutionality of mass collection of Americans' call records, here's what Reuters[0] says:

> In a ruling handed down on Wednesday, the U.S. Court of Appeals for the Ninth Circuit said the warrantless telephone dragnet that secretly collected millions of Americans' telephone records violated the Foreign Intelligence Surveillance Act and may well have been unconstitutional.

The court did not make any ruling on the Constitutionality of the NSA's mass surveillance program, but they wrote in their decision that it very likely was Unconstitutional.[1]

Historically speaking, this NSA program is exactly the type of search that the 4th Amendment was intended to prevent. Americans were upset about "writs of assistance" that gave colonial officials wide powers to conduct searches against classes of people. That's why the 4th Amendment requires warrants to be specific and limited in scope. Handing out warrants that allow authorities to collect call logs of millions of Americans is blatantly Unconstitutional, and is exactly the sort of thing the 4th Amendment was intended to put a stop to.

0. https://www.reuters.com/article/us-usa-nsa-spying-idUSKBN25T...

1. https://cdn.ca9.uscourts.gov/datastore/opinions/2020/09/02/1...

PRISM isn't mass surveillance. Snowden's slides clearly show it is a way for the NSA to ingest data from FBI wiretaps [1], which are targeted, which is why the only lawsuit brought against it was dropped. High school dropout Snowden and useful idiot Greenwald were too stupid to understand the slides they released and were called out about it immediately on Twitter. The New York Times [2][3] and CNET [4] subsequently correctly described the program, and WaPo retracted its original description. Now, Snowden never talks about PRISM out of embarrassment, only the phone metadata program.

XKeystore is simply the database that stores data collected outside the US, and Tempora is not even a US program, so clearly neither can violate the 4th Amendment, which is why no lawsuits were brought against either program.

> Handing out warrants that allow authorities to collect call logs of millions of Americans is blatantly Unconstitutional.

Obviously not. The program was limited to collecting millions of call logs instead of all call logs after the leaks, and that was considered so obviously constitutional that nobody sued. [5]

[1] https://cdn.vox-cdn.com/thumbor/DqqNh3fnfGCY1Zmk41LsSnjgUBg=...

[2] https://www.nytimes.com/2013/06/08/technology/tech-companies...

[3] http://www.nytimes.com/interactive/2013/06/07/us/comparing-t...

[4] https://www.cnet.com/news/no-evidence-of-nsas-direct-access-...

[5] https://www.reuters.com/article/us-usa-cyber-surveillance/sp...

There are many obvious errors in your claims, such as this:

> Tempora is not even a US program, so clearly neither can violate the 4th Amendment

The NSA is a partner in the program (led by the British, with whom the US has a very close intelligence partnership). The program does bulk collection on undersea cables which do carry Americans' data. This is prima facie a violation of the 4th Amendment.

> which is why no lawsuits were brought against either program

The reason why lawsuits so rarely get anywhere against any of these mass surveillance programs is that in the US legal system, you have to be able to prove standing in order to challenge them. The US isn't like other systems with dedicated constitutional courts that can review laws on their own initiative. Someone has to be able to show that they themselves have been specifically harmed. Unless you can prove that the NSA specifically looked at your data and used it against you in some way, you can't challenge the NSA's surveillance. By the very nature of these programs, it's nearly impossible for anyone to prove that.

> The New York Times [2][3] and CNET [4] subsequently correctly described the program

The NY Times article you cite describes it as a program that collects information from the largest US tech companies on the basis of FISA requests. Just so you recall, FISA is a court that operates in secret, that grants virtually all requests, and that has demonstrably signed off on Unconstitutional bulk surveillance (e.g., mass collection of call logs).

And by the way, the type of behavior we're discussing here, which we know for a fact the US government has engaged in, is exactly what people in this thread are alleging the Russian government might theoretically do to Kaspersky.

> High school dropout Snowden

Yes, a "high school dropout" who was paid 200 grand a year and given access to the NSA's classified networks. What a dummy!

> The program was limited to collecting millions of call logs instead of all call logs after the leaks, and that was considered so obviously constitutional that nobody sued.

This is not how the process of challenging an Unconstitutional law works. You can't just say, "That's Unconstitutional" and then sue. You have to show that you have personally been targeted. That's why Rosa Parks had to physically sit down on the bus and wait to get thrown off. That's what gave her standing to challenge Montgomery's segregated bus system. Just knowing that a surveillance program exists and has probably illegally collected your information does not automatically give you the ability to challenge said program in court.

Bulk collection of records of millions of Americans (this is just the warrant that we know of, and there were almost certainly similar warrants covering most Americans, because by design, the program was meant to do bulk analysis of all call records) is obviously unconstitutional, but also very difficult to legally challenge.

> The NSA is a partner in the program

The NSA is aware of the program but has no say in implementing it and doesn't have access to its data. Only the UK has the data and gets to choose who to share what they've learned from it to. This is clearly not a violation of the 4th Amendment, which is why nobody has sued the US government for it. If you believe it is a violation, go ahead and try to find a lawyer to take your case.

> The reason why lawsuits so rarely get anywhere...

No lawsuit was brought at all against XKeyscore or Tempora. That is the reason they didn't get anywhere. Lawsuits were brought against the phone metadata program, which succeeded, and against PRISM, which was thrown out because it didn't collect the data of the person who brought the lawsuit, unlike what Snowden and Greenwald erroneously claimed.

> Just so you recall, FISA is a court that operates in secret, that grants virtually all requests, and that has demonstrably signed off on Unconstitutional bulk surveillance

Once again, no program the court has signed off on has been ruled unconstitutional. Just so you recall, FISA is not a court but a law. FISC is the court that rules on FISA requests.

> And by the way, the type of behavior we're discussing here, which we know for a fact the US government has engaged in, is exactly what people in this thread are alleging the Russian government might theoretically do to Kaspersky.

The behavior we're alleging the Russian government could do with Kaspersky is putting malware in its software. We know the US government has done this for hardware exported overseas, which is why we are right to expect Russia to do this. We also know that Russia engages in dragnet domestic surveillance, which is something you're alleging that the US does, but there is no evidence of.

> Yes, a "high school dropout" who was paid 200 grand a year and given access to the NSA's classified networks. What a dummy!

He was a Sharepoint admin earning $122k. https://www.washingtonpost.com/blogs/erik-wemple/wp/2013/06/.... His hilarious misinterpretation of PRISM and other programs proves what a dummy he is. The fact that he dropped out of high school just explains how he came to be so stupid, and it should have been a signal for you to read the documents he leaked instead of expecting him to interpret them correctly for you.

> Bulk collection of records of millions of Americans (this is just the warrant that we know of, and there were almost certainly similar warrants covering most Americans, because by design, the program was meant to do bulk analysis of all call records) is obviously unconstitutional, but also very difficult to legally challenge.

They just have to have reason to believe their data is being collected to challenge it, as they did in Klayman v. Obama I. The conclusion was that the bulk collection of everybody's call records wasn't justified by the law, with no ruling on the constitutionality, possibly because there was precedent in Smith v. Maryland that it is constitutional (the very opposite of "obviously unconstitutional"). After that, Congress passed a law that allowed collection of millions of call records, and that was not even challenged.

Depends on the country. Unlike Russia, the government in the USA is not all powerful.

except when it comes to force companies out of the USA because of "security reasons".

I think Russia is using similar tactics, does it?

Try saying the words "Ukraine War" in Russia. That alone is grounds for getting arrested, possibly disappeared and/or tortured.

You have to say "Ukrainian Special Security Operation".

This is from the first article I came across on the RT front page right now:

>Moscow attacked neighboring Ukraine last month, following a seven-year standoff over Kiev’s failure to implement the terms of the Minsk agreements, and Russia’s eventual recognition of the Donbass republics of Donetsk and Lugansk. The German- and French-brokered protocols had been designed to regularize the status of those regions within the Ukrainian state.

>Russia has now demanded that Ukraine officially declare itself a neutral country that will never join the US-led NATO military alliance. Kiev insists the Russian offensive was completely unprovoked and has denied claims it was planning to retake the two republics by force.

It doesn't seem like they are afraid of getting disappeared for saying russia attacked ukraine.

RT is the propaganda arm of the Russian government operating in other countries.

Internal newspapers, such as Novaya Gazeta, have been shut down for saying "war" in print. Just the latest in many papers, radio channels and more that have been silenced in Russia.

> It doesn't seem like they are afraid of getting disappeared for saying russia attacked ukraine.

They didn't use the word "war".

“That guy who killed someone is not that bad, because the other guy punched someone and everybody seems happy with that”.

Bullshit. The US is an imperialist, sometimes oppressive pseudo-democracy, but nothing like that mafia-run kleptocracy.

This is a very americo-centric view....

Most of the world consideres americans the "bad guys", and a lot worse than the russians. You can start with southern america and middle east. Then the balkans (where putin is doing the same as you guys did with kosovo). Even parts of africa would have a say.

Here in the balkans, people were actively rooting for trump in the last two elections, because they were afraid Hillary would start a new war here...

You are way off base. First, I am not American and well aware of the imperialist and oppressive aspects. I would be quite happy to see the American hegemony disappear, but not for it to be replaced by Russian aggression or Chinese imperialism.

> Most of the world consideres americans the "bad guys", and a lot worse than the russians. You can start with southern america and middle east.

Their absurd support for tin pot dictators in South America was and is reprehensible, and the whole Iraq war was morally bankrupt and threw fuel on a fire that we’ll be trying to put out for decades. And yet, nothing the American did in the Middle East came anywhere near Aleppo or Mariupol. Or the Holodomor. Or the Prague spring.

> Then the balkans (where putin is doing the same as you guys did with kosovo).

Come on, now. You cannot possibly compare Sarajevo (with an actual genocide being carried out, surprisingly, by the side with Russian support) with the charade Putin used as a fig leaf to invade Ukraine. This is pure propaganda. The region would not be any better today had the ethnically cleansing gone all the way to the end, quite the contrary. Europe should have had grown a spine and actually done something.

> Here in the balkans, people were actively rooting for trump in the last two elections, because they were afraid Hillary would start a new war here...

Well, maybe you did, but that’s not what I heard from my greek friends. The Americans are not complicated to understand, they are going where their interests are. What the hell would they do in the Balkans? That is just stupid.

> Their absurd support for tin pot dictators in South America was and is reprehensible, and the whole Iraq war was morally bankrupt and threw fuel on a fire that we’ll be trying to put out for decades. And yet, nothing the American did in the Middle East came anywhere near Aleppo or Mariupol. Or the Holodomor. Or the Prague spring.

Yeah sure... and iraq had weapons of mass destruction, and iraqi soldiers killed babies, and afghanistan had to be occupied for 20 years, because a few saudis flew a few planes into a few buildings. Plus syria, libya, lebanon etc... and considering how far back you go in history, there's also blood from vietnam on americans hand. And it's funny how it's a "beloved ruler" when it's a friend of america and "nasty dictator" when it's not... so america has to replace the ones they don't like (eg iran.)

Sarajevo is not in kosovo, quite a few years were between sarajevo and the bombing of yugoslavia/serbia. Kosovo albanians wanted to separate from the main country, and the main country (yugoslavia then) wouldn't let them... then they formed armed groups that attacked the serbs, and serbs attacked the albanians... basically the same thing that was happening with the russian minority in eg. donbas and lugansk in ukraine. Then someone (USA) had some geopolicital interests in the balkans, bombed the country for 78 days, bombed hospitals, passenger trains, busses, schools, tv stations, cluster bombed a few cities, bridges, roads, highways etc, and built a nato base in kosovo.

So, why have a base in the balkans, if they don't need it?

It's about probability. I mean I have my issues with US foreign policy but at the end of the day they are more friendly and reliable than Russia.

Yeah if the US ever goes rogue we're all doomed but then your antivirus software will be the least of your worries.

Or rouge updates?

The sanctions in question are against Kaspersky Labs the company, not Eugene Kaspersky the man. Frankly none of the analysis involves a decision as to whether he is a "dirtbag", by association or not. It's just that there's no way anyone can reasonably trust "security" software produced by entities in a totalitarian state, especially so when it's at war.

Thanks for the clarification.

So it is not a situation were we have actual evidence of dirtbaggery against the company, but that we are rationally paranoid that Kaspersky Lab could somehow steal our Pokemons.

Kaspersky graduated from The Technical Faculty of the KGB Higher School in 1987. That was a definition of a dirtbag in Soviet time.

I can't find the actual profile on Wired anymore, but I found it on the internet archive: https://web.archive.org/web/20140423055434/http://www.wired.... and also a sort of response to it https://web.archive.org/web/20140426095603/http://www.wired....

After I read that profile I decided I'd never use the software. I remember before news spread of the Russian troll farms being real, people talked about it like "who would do that?" Russia would.

I don't think it's their quote - but I remember Penn of Penn & Teller saying about magic something to the effect that the magician does the things that people think "It could be... but who would do all of that work?" This is how I feel about Russia. They will or already are doing the things you think they won't and nothing is beyond being a tool for the state.

I don't really like feeding the image of the Russian super villain, but I don't consider it overly paranoid to avoid installing software from hostile nations. Yes I used this same logic to convince my wife to uninstall tiktok.

Comparison notwithstanding, that's what I felt when I first heard about PRISM. Holy shit, I knew this was all possible, but I hadn't believed that someone actually went through all the effort of doing it.

The original Wired links are:

https://www.wired.com/2012/07/ff-kaspersky/

https://www.wired.com/2012/07/kaspersky-indy/

So odd I thought I tried this and got an "Oops" I must have missed something - thank you!

I think they used underscores in their links originally and then changed them to dashes at some later date but broke things. (You can see this in the second article which links to the first using an underscore, but the redirects they've put in place are broken.)

Is hackernews cutting off links now. Neither of your links work. End of line contains "/http://wired/"

Congratulations to both of you for uninstalling TikTok :) Facebook is next.

Was every 17 years old who attended anything with KGB written on it, really dubbed a dirtbag in the 70-80s? Even knowing there were 100 years of Red Scare this sounds a lot like like a neurotic leap conclusion, I can't imagine KGB's cryptography school teaching teenagers torture skills or something like that.

Every single Soviet citizen knew what KGB is and what it stands for. Unlike you I don't need to imagine anything. I remember.

What he could have done then at that time? To not study? To remain illiterate?

You really think the choice was to go to KGB school or remain illiterate? There were a lot of other options to study. Much better options if your want to do science. For one thing, education in Soviet Union was decent and free for everyone. Going to KGB school was a choice, very specific one.

I know brilliant people from the GDR who studied at Moscow Polytechnic University, they weren't in the KGB or Stasi. You had to be system-conform to study anything, that much is true, but that's still far away from joining the KGB.

I know right? Like what the hell kind of criticism is that lol.

The kind that understands historic nuance.

That understands nuance, but not history.

Even american security companies have ties to the intelligence community. Kaspersky is no different. In most countries private sector pays more so state hackers work at places like Crowdstrike or Kaspersky after some time. Their relationship with the IC helps develop and share intelligence both ways.

There's an important difference: American security companies have ties to American intelligence. The concern here is Kaspersky has ties to Russian intelligence. If you're an American company or government agency and have to choose between the two the choice is pretty clear.

I have a lot of respect for Kaspersky and hope they are still independent. But "ties to intelligence" can come in many forms: deliberate, coerced, or via infiltration. We've seen similar issues here in the US. Sometimes companies work voluntarily with the FBI and NSA, sometimes they are infiltrated or tricked by them.

> If you're an American company or government agency and have to choose between the two the choice is pretty clear.

I suppose that entirely depends on one's threat-model. As an American, I have greater concerns of USG oppression than I do Russian. As the Russians have their ham-fisted means of exterting influence on a company, the US has their very own nasty ways of infiltration.

If you're interested in personal freedoms free of malicious government intrusion, they both suck.

It's not just security companies. US ISPs are heavily tied to agencies and so are the large corps. The media is state ran just like Russia.

You can't be more wrong when you say "just like Russia". It is not even close. The killings of journalists, repressions... The last independent newspaper has to close its activity because it is not possible anymore to report truth while complying to the Russian laws: https://www.aljazeera.com/news/2022/3/28/russias-novaya-gaze...

All this with Russian government/president approval rating of 70%.

Without independent media, how can we trust the approval rating is accurate?

Levada-Center is the best bet we have: https://www.levada.ru/en/ratings/ But when even Russians who live in Germany are rallying in support of the Russia's war it is reasonable to assume that those ratings are accurate.

No, it really doesn't follow. The subset of russians living in germany who approve of the war has no bearing or relationship to all russians.

The "living in germany" part doesn't contradict the same concerns that those living in russia have, as like those living in russia, the emigrated russians likely have:

- family still in russia - ties to russia (financial, business, family, etc) - desire to visit russia without having to deal with legal harassment for actions done abroad - desire to be able to assist people (family/friends) living in russia without compromising them

This does not mean that they are for or against a current government, but rather, that the proposed logic is specious as it tries to create a separation where it is not probable there is one while simultaneously extrapolating the results of a small sample size across a population that supposedly is without the influence of Russia.

Well, maybe you're right but I'm not so sure. After watching recent interviews with random people on the streets of Russian cities. Here's interesting thread on twitter by someone sharing his experience calling random Russians and trying to talk: https://twitter.com/GentileOslo/status/1506663082634145797

You can never get a completely accurate approval ratings. However there is enough evidence that a nontrivial percentage of russians does not disprove of the war. Besides the ones already mentioned in this thread, don't forget that it is not Putin personally fighting in Ukraine or arresting protesters or posting propaganda. Does it matter if it is 70% or 40% when it is obviously enough for the state to continue its control over the populace and thus could also compel their IT companies to work for Kremlin needs and against their users.

The media is heavily biased in the US, but nowhere near Russia style.

You can still find the opposing views, quite easily.

> The media is state ran just like Russia.

The whataboutism is out in full force here.

Indeed, and it's really absurd. Just compare Fox News and MSNBC. They might be both state run, but certainly not the same state.

When was Kasepersky ever considered a dirtbag? That company has written a lot of technically in-depth security reports over various threats for a long time.

AFAIK it's a (relatively) honest business, though sadly the target of American russophobia

> American russophobia

When you are entering a cold war with Russia, it's not Russophobia, it's common sense to not allow a potential state actor to have root access to millions of devices in your country.

Also, Kaspersky was literally a former KGB

> At the age of 16, Kaspersky entered a five-year program with The Technical Faculty of the KGB Higher School,[15] which prepared intelligence officers for the Russian military and KGB.[7][8] He graduated in 1987[15] with a degree in mathematical engineering and computer technology.[4][8] After graduating college, Kaspersky served the Soviet military intelligence service [6] as a software engineer.[2][10] He met his first wife Natalya Kaspersky at Severskoye, a KGB vacation resort, in 1987.[2]

https://en.wikipedia.org/wiki/Eugene_Kaspersky#Early_life

I think there was an incident in which some NSA contractor had Kaspersky installed in their workstation and the heuristic caught up NSA tools https://www.theguardian.com/technology/2017/oct/26/kaspersky...

They did the right thing - finding suspiciously malicious code is their job. Not their fault the user was an idiot, spooks PEBKAC is still PEBKAC.

Sure, but the allegation was that soon after Kasperky detected the NSA tools on his system he was hit with a very targeted cyberattack. IIRC that's where the allegations of Kasperky's involvement with the Russian government came in.

And anecdotally there were a lot of MSPs in /r/sysadmin claiming that every single one of their Kasperky customers would be hit by ransomware while few if any of their other customers were.

> They did the right thing - finding suspiciously malicious code is their job. Not their fault the user was an idiot, spooks PEBKAC is still PEBKAC.

Except for this part, which leaves a huge question of "do they share knowledge with the russian govt."

> But the bigger unknown is whether and how Kaspersky’s acknowledged discovery and acquisition of NSA hacking tools resulted in Russian intelligence agencies discovering the NSA contractor, and targeting him for further, apparently successful, attacks.

The concern isn't Kaspersky being a dirtbag, it's Putin legally mandating they become a dirtbag. That's how nation states and wars work.

In fact, there's a similar concern that the EU has with the US. The US's CLOUD Act forces American tech companies to comply with US legal subpoenas in foreign jurisdictions, which means that said tech companies cannot also comply with GDPR data export rules. Hence, it's illegal to include US services on EU websites[0] until and unless the US either agrees to pass GDPR into US law (so that exported EU data is still protected) or repeals the CLOUD Act (so that localized EU data is legally untouchable by the FBI or CIA).

The idea that we can treat a company as wholly separate from it's host nation is more of a legal fiction than anything else. It's not, in and of itself, russophobia. If the person running Kaspersky was trying to, say, flee Russia; and people said he couldnt't be trusted, then that would be russophobia.

[0] Note: It is still legal for EU citizens to use those US services directly. This only covers data export by EU companies to third-parties.

Sorry, my reference to Russophobia was more at past light that has been shown on Kaspersky, before this year's invasion of Ukraine. I agree that it is entirely possible that Kaspersky could be weaponized now

Was it America-phobia that made russia direct endless waves of cyber-attacks at us?

Unsure of reason for downvotes, but this was my observation as well, and my experience is that Kaspersky Labs scanning software successfully sanitizes its targets and does so without giving the uncanny feeling of wasting one's time.

Putin and friends are moronic for bullying and harassing and mugging Ukraine. But if I were him, I would definitely declare apple pie a security threat in response.

Yeah, it was my preferred AV for a while, til I switched to a local company

The Stuxnet association seems completely basis, and you do not provide any evidence for the assertion. There were multiple firms and individuals responsible for the discovery, reverse engineering, and attribution of Stuxnet, so you are overplaying their involvement.

This decision was certainly made by a bureaucrat who may not even know about Stuxnet. It’s simple risk mitigation. Why even take the chance Kaspersky is a malicious entity? It’s not important software.

Some of the conspiracy theories people throw out around here…

His only statement so far on the far (keeping in mind this is rather than saying nothing) called it a "situation" in Ukraine. That's not much to read into, but he also could have chosen to say absolutely nothing.

"We welcome the start of negotiations to resolve the current situation in Ukraine and hope that they will lead to a cessation of hostilities and a compromise. We believe that peaceful dialogue is the only possible instrument for resolving conflicts. War isn’t good for anyone."

I don't think there is a conspiracy here about tit-for-tat stuxnet or even if he is a "dirtbag". All AV shift trust from the system to the AV. That is the root of the issue and it is an unsolved problem no matter where you try to secure something in the end there is always a compromise somewhere that boils down to "but eventually you need to trust something".

If that something is owned by your enemy in a hot war it's game over.

The minute a vendor can be leaned on by a hostile government (even they are not in the country like the founder of Telegram) and the interest is strong enough to lean on them (hot war) the trust assumption becomes problematic. How problematic? I think it doesn't get more urgent then in a hot war.

Kaspersky needs to pack up in all NATO countries. Not just because they pay taxes in RU (also this is a good enough reason for me). But also because if you share data with a non-NATO country it immediately becomes problematic too if your business partner is using their products.

The options under which they should be allowed to continue to operate is purely academic because it involves not only shifting all operations out of RU but also getting rid of any executive who moves to the new location that can be leaned on back home (e.g. family and friends etc).

There is no middle ground because the minute these steps are initiated Kaspersky has good reason to feel mistreated by the West. So even they kept their hands clean until now they might start doing what they've been accused of anyway.

Also if Positive Tech and others have been sanctions already some months ago there is no reason to give this much bigger potential threat a pass.

Kaspersky consciously, under no pressure chose to be chekist. That is absolutely all You need to know about this person and his deeds, consequentially. The numerous ruminations on "coercion" are just deeply naive. He is a member of kremlin gang. Anything else falls into bottomless category of whitewashing.

> Ok, let's cut the crap.

Clearly you were joking?

The crap is your assertion that this has anything to something other than what's happening in Ukraine.

Kaspersky is collateral damage and fallout from Russia s actions and nothing more.

Please let's cut the crap.

Here is my humble opinion.

Kaspersky is by definition a Russian company that provides antivirus software to many influential western companies and institutions.

The risk of Kaspersky bowing to the pressure from Putin is just too great to ignore. For Kaspersky this can seem unfair, but that is one of the many consequences of Putins actions.

Don't forget who started the invasion and who is still hurting innocent Ukrainians.

funny you say that, because bitDefender always outshines Kaspersky in all the AV tests and was always ranked #1

also dont forget that the Global Research & Analysis Team @ Kaspersky is not Russian

You're saying things that are obvious but the facts are:

1. Kaspersky could have long ago left Russia

2. We can't trust Kaspersky

3. The fight is real, even if the US gov lied, incentives matter

Kaspersky himself had deep connections with the KGB

You think the US government waited 12 years to be able to turn the screws on Kaspersky because they uncovered Stuxnet?

You dont sound like a patriot.You sound like the opposite.

I thought the question was much older than stuxnet?

> Is Kaspersky a dirtbag or not? I suspect not, but it is an unfortunate accident he was born in and runs his company from Russia, the government of which is a dirtbag, so, correct me if I am wrong, Kaspersky must be a dirtbag by association [...].

Even if he is not a dirtbag, being in Russia means Putin has power to use Kaspersky technology in war.

Your entire post is pure speculation.

Reply on news.ycombinator.com