Hacker News Reader

Comment by kstrauser | Hacker News Reader

I don't have a dog in this hunt. I've never worked with Snyk, I've never been a customer, and I don't think I even know anyone who works there. That said, they've built their whole company around being trustworthy and doubt they'd knowingly do anything to risk their entire business. Also, I can hardly imagine someone better positioned to protect against supply chain attacks.

Your criticism sounds to me like "just a reminder that this armed bodyguard service comprises Navy SEALs and Army Rangers". Uh, great!

View on HN

I'd give good odds it was a mistake by a staff member (or small group) who overstepped and was not part of any formal work.

Most companies where I've worked as a security researcher, you get some time as part of your job to hack on random stuff to be able to generate interesting talks / research. This feels like that.

This isn't a special cyber spooky practice, most pentesting companies do this to generate IP (rarely, lol), buzz (reasonably often) and keep the staff happy (this is really the main thing).

It's rare for management to be fully across the scope of this.

Maybe if you change that to "armed bodyguard services employ ex KGB assassins"

I think you've missed the point: it's Americentric to assume that Navy SEALs and Army Rangers are inherently pure, good and have done nothing evil on behalf of the American government when we largely know that to be untrue.

That wasn't my point at all. The point was that often the best people to protect a resource are the ones who know how to attack it.

I would say it is on similar to criticism of TikTok or Huwaei and China.

It has less to do with whether it malicious intent from the start of building an organization for explicit intent of capturing core infra. It has more to do with how the Government of Israel operates and the legal requests they can make of their citizens and/or veterans.

Perhaps concern over Israeli products should be probably higher than for China as Israel more well known incidents of exploits as a State actor like with Stuxnet, Pegasus or more recently with pagers etc.

China no doubt has their own share of operations but they either have not used them as publicly in a large scale overt operation or been more discreet about it.

Point is the concern is valid just as it would be valid for China.

You mean like how we found out that China attacked and pwn3d the entire US phone system? That’s not a shining example of discretion.

As the U.S. has done to our closest allies and their leaders, would be shocking and incompetent if they have not done much more in Russia and China and vice versa

There is no equivalence intelligence gathering or gaining the capability for sabotage (which everyone does) versus actual active sabotage which today only Israel executes like with Stuxnet or with the pagers.

I have no downside to seeking alternatives. The pager incident ensured that I will always look for non-Israeli tech.

What pager incident?

The recent one in which Israeli techs compromised pager supply chains.

It was very widely reported across the globe.

https://en.m.wikipedia.org/wiki/2024_Lebanon_electronic_devi...

Well, if the mossad put "made in israel" on those devices I doubt they would have worked.

And what does that have to do with Snyk, other than that some of their employees use to work for IDF?

I'm a US Navy veteran. Would you also stay away from my employers because they have veterans on staff?

Seriously, I get what you're trying to say, but I don't understand the broader point you're trying to make. So Snyk has some ex-IDF employees. Find a high-profile infosec firm that doesn't. They military service they were compelled to has a reputation at being really, really good at infosec. I see no reason why companies shouldn't want to hire them afterward.

Without wanting to take a position here, the GP comment had a specific narrow point.

The claim was that Snyk was founded by Unit 8200 members.

Not that it had a few Israeli veterens, almost all Israeli's serve in the IDF after all.

https://en.wikipedia.org/wiki/Unit_8200

To be fair I have a former Unit 8200 member in my larger extended family who left and has since been vocal in opposition to Netanyahu so membership in an elite Cyber Unit alone doesn't define a person.

That aside, most Governments would keep an eye on a company started by, say, former NSA employees and watch for covert activity under any overt actions.

It would correlate strongly that 8200 alumni end up being educated and working in tech, and likely living in Tel Aviv. This is a group of people who, by and large, are not big fans of the current government.

Based on the pager incident, I'd think you should avoid companies that don't have a publicly-known link to Israel. It's not like Hezbollah thought they were buying pagers from 8200 alumni.

Reply on news.ycombinator.com