Hacker News Reader

Comment by anonbanker | Hacker News Reader

So, I was making the correct determination when requiring that all server and desktop hardware puchased by my companies originate from BRICS nations. Avoiding dell/cisco/juniper/hp for networking equipment, and opting for Custom RK3188 and AllWinner A23-based routers/switches and desktop thin clients running (Debian/Angstrom) linux are gonna throw more than one wrench in any surveillance plans.

I wonder how many exploits the Five Eyes have for Tahoe-LAFS running on LVM disks. I'm betting on very few.

View on HN

Isn't this changing the devil you know for one you don't? Instead of potentially having NSA spy on your org, you have potential of China and Russia doing the spying?

Or is there solid evidence that these countries aren't engaging in the same stuff as the NSA?

> Isn't this changing the devil you know for one you don't?

I don't think so.

How likely is it that China spying on you will actually impact your life, if you're living somewhere in the US or Europe?

Compare this to How likely is it that the US spying on you will actually impact your life, if you're living somewhere in the US or Europe...

I mean sure, this may be a relevant consideration for actual terrorists, but hardly for "regular" people that are more concerned about mundane details like their unhealthy dietary habbits being leaked to insurance companies, or their downloading of youtube videos being leaked to copyright holders.

Well, one of the risks that you face in a state-sponsored advisory is industrial espionage, and that is as likely to come from China [1] as it is coming from the NSA [2].

[1] http://money.cnn.com/2014/05/20/news/china-espionage-busines... [2] http://www.theguardian.com/world/2013/sep/09/nsa-spying-braz...

This may just be paranoia on my part, but wouldn't being a target of industrial espionage by the Chinese make you already important/big enough to have the NSA working for rather than against you?

Not if you're in a competing country to both US and China. The world is bigger than the US :-)

Engineers have to work with what they have.

Do you disagree that he made the right decision?

Is there solid evidence that these countries are engaging in the same stuff as the NSA?

Yes, I disagree. If there's an almost guaranteed chance that my org will be spied on, I would rather have the US do the spying. Unlike a BRICS country, at least the US has the occasional Snowden to shed light on things. The resulting scandal may do little to change the status quo, but it'll lead to a discussion and maybe a civil suit my company can win.

I have never heard of a similar public leaker from Russia or China (I imagine those people just quickly get disappeared).

As for BRICS country spying, we have some very solid evidence that China is engaging in cyber espionage of both US military and corporate targets.

If you are working on US based consumer web site, spying by NSA could be much more harmful than spying by China or Russia for vast majority of users. NSA is known to provide leads to police that then reconstructed evidence to exclude any links to NSA and still arrest/harass the person. There are people who are not national security risk in US jails because of NSA (mostly drug busts). BRICS countries have zero interest whether you smoke dope in your free time and won't rat you out to local police.

PS. I am not arguing that they should not be in jail. Just that NSA used semi-legal (waterboarding!=torture kind) methods to obtain initial leads.

What if dissidents are using your service because it's outside their country of origin and they get disappeared because of it?

As I said it's better to be located outside of country where majority of your users are. If your service targets american market, you can minimize risk to majority of your users by locating service outside of US. Dissident disappearing is mostly red herring - people disappear in US too (Guantanomo).

Lack of evidence is not proof they aren't doing it. You can still say there is risk of it and ponder how much risk that means. There's definitely some concern of Chinese hardware.

Can you answer the question?

There was plenty of solid evidence of those countries spying on US citizens long before there was solid evidence of the US spying on US citizens.

I would be surprised if India, China, or Russia did not have similar sorts of surveillance programs.

But, I think you're right, you're unlikely to be caught in dragnet-style surveillance by the Five Eyes nations, but this style of attack sounds like it has to be targeted.

> requiring that all server and desktop hardware puchased by my companies originate from BRICS nations

How exactly did you do this? Obviously the company assembling the pieces (like CPUs and chipsets) into the final PC isn't really the issue, but rather the companies producing those pieces - and virtually none of them are outside the US, seeing as how there's only Intel (and maybe AMD).

Your idea sounds good, and I'd like to adopt it, but I just don't see how, with x86 hardware.

Then again, maybe this'll be a major selling point for ARM-based Servers and Desktops at some point in the future? :x

Get on alibaba.com, and find a supplier. Most allow customization of the boards you purchase. And the above-mentioned chipsets have full Linux support. Getting arm-based boards with 4+ 10gigE ports is easier than you'd think.

The desktops are all arm-based thin clients running X servers with all apps hosted remotely. If a device fails, plug in another one and keep working.

Richard Stallman abandoned Five Eyes-based chipsets for the same reason, long before I ever did. We should look to him more for inspiration on how to remain free during these draconian times.

What about this exploit really requires a US supply chain? Why do you believe that the Five Eyes have fewer exploits for hardware originating from BRICS nations? Don't intelligence agencies have explicit missions to spy on those countries?

If you think that because you are running less popular hardware, that the NSA wouldn't bother obtaining exploits for them, you may be right. In that case, though, you're simply making a popularity trade-off. (And it is a trade-off, more popular hardware is more popular for a reason.)

From all documents released by snowden thus far, it is clear that the Five Eyes are targeting their own supply chains. They're using arm7 and arm9 chips in their hardware bugs, but it's clear that they have no focus at all on arm exploits.

Both the RK3xxx and A23 chips are fully supported in Linux 3.16, so I see no trade-off. Just low wattage and a bit of peace of mind that my government has to custom-tailor exploits for me and my companies, which isn't very cost-effective. :-)

Dell especially seems to be targeted a lot by NSA - easy target? Or something more?

Edward Snowden worked for Dell, maintaining NSA infrastructure. They NSA is deep into Dell, easy access to specs and maybe the NSA even engineered those backdoors themselves.

Reply on news.ycombinator.com