rshnotsecure

I'm not sure I'm comfortable using the term "bots", but certainly more gamesmanship and "information warfare".

The Nautilus link that made it to the front page several days ago deeply disturbed me [1]. From a grumpy technical standpoint it did not have TLS by default or even a redirect.

More concerning though was that it was a SPONSORED advertorial that only ran because a fee was paid. Anyone who pointed this out was downvoted as the post accrued hundreds of upvotes and comments.

[1] - http://oceans.nautil.us/

Most police departments do business with extremely shady technical firms. These are things no normal say DevOps engineer has ever heard of.

I can say confidentially the whole computer forensics industry is something of a cross between Chinese government schemes and Organized Crime schemes.

Many firms try to get video data from the police. This is key. Look at Granicus Video, the recent debacle with Banjo in Utah, or the various bodycam makers.

Many drone makers with established Chinese military connections have been pitching police departments for months. Look at Autel Robotics, sister company of Wyze Camera, and what they are doing in Virginia. They have not broken any contract that is for sure.

I welcome the down vote bots. I also welcome the "yeah but what's your evidence!". The evidence is go research what I said on a Google. More than happy to go into detail on certain parts.

Most police departments do business with extremely shady technical firms. These are things no normal say DevOps engineer has ever heard of.

I can say confidentially the whole computer forensics department

This is actually very concerning. We have significant evidence now to suggest that asteroids in the past have caused large earthquakes. Sometimes on the other side of the impact zone (the antipode).

More scary though is what comets can do. They have a highly elliptical orbit, so they are much harder to spot than asteroids as they come out of nowhere. The elliptical orbit gives them much greater speed to. Comets tends to generate enormous levels of heat too, they explode shorty before impact as one did in Tunguska in Russia in 1908. Anyway it now seems that these "bursts" have happened during ice ages, vaporizing massive ice sheets. We are talking perhaps the entire northern hemisphere in some cases like the Younger Dryas Impact Hypothesis.

The crust floats like water and is as gooey as pudding when suddenly trillions of tons of weight just "disappears" above it. We have no idea how this unfolds currently except to say it is destructive and chaotic at the least.

This article is bizarre.

Some quotes that strikes me as just really really odd:

"Jerry Mitrovica has been overturning accepted wisdom for decades" - no one is this good.

"What he calls postmodern geology" - this is very concerning. Postmodernism is like Foucault and Derrida and about power and society. Foucault is actually the most cited academic of all time statistically, so for a Professor to knowingly use this word to describe the science of geology is just strange.

"Though a practiced public speaker" - what is this? should he be ashamed?

"These are known as sea-level fingerprints, because each ice sheet has its own geometry. Greenland produces one geometry of sea level change and the Antarctic has its own. Mountain glaciers have their own fingerprint." - what?

It has always struck me as strange there is no 2FA function on HackerNews along with no real delete function.

Also some of us have noticed for a while Hacker News is hosted differently than the rest of YCombinator. While YCombinator uses AWS, which makes sense, Hacker News uses a small San Diego firm called M5 Computer Security. They have commented on here from time to time.

M5 Computer Security, also known as Cloud 5 Hosting and a few other names, has popped up on other forums too. The IPs that are owned by them (at least according to WHOIS) wind up holding very strange other websites that aren't say hosting customers (like how to weld underwater, how to get a foreign visa, etc). Some of their name servers also hold data for websites that are definitely not supposed to be there, like the regional government sites of a foreign country (could be part of the Sea Turtle DNS attack we have thought [1]). Also for a security company they seem to have strangely out of date websites [2]. Copyright 2003?

A few weeks ago we wound up calling the FBI's Cyberstorm hotline after we saw something weird with a government in the United States that traced back to M5 and American Internet Services, LLC (they often appear alongside M5 in the hosting records). A week later I had someone from DHS interview me at length (they just showed up at the door) for about 30 minutes. They seemed to be around organized crime, but near the end of the conversation it was mentioned "well they also do a lot of Department of Defense stuff". Uh oh. This seems to be true as they mention it on one of their websites actually [4].

Hopefully someone a few months from now will pick up the case and find out / connect to one of the many other DNS mysteries out there.

[1] - https://blogs.cisco.com/security/talos/sea-turtle-keeps-on-s...

[2] - https://www.m5computersecurity.com/audit-private.php

[3] - www.htleng.com

[4] - https://www.m5hosting.com/about-us/data-centers/san-diego-li...

Zoom I've always thought must have pretty strong security if configured correctly (obviously that's a big if) It is currentLy in use by the Chinese Academy of Sciences (CAS). CAS is sort of like a mix of NSF, NIH, and DARPA all rolled into one. About 20% of their research supports the People's Liberation Army (PLA) for things like encryption research, so I assume they know what they're doing.

This is technically a white label I guess you would say, but if you download the code, a majority of the files begin with the prefix Zoom and what not: https://cc.cstcloud.cn

I bought a Purism laptop last year for around $3,000 USD. It is ok.

Purism had a bizarre falling out with their former CTO. I am inclined to believe the CTO [1].

The documentation is basically non-existent. There is no end to end hardware tear down, at least a fully complete one, which I found kind of shocking. The special privacy first operating system is a very lightly modified Ubuntu OS. System76's popOS, almost a clone itself of Ubuntu, is probably more customized.

The manufacturing seemed shoddy, although not terrible. Just a lot of air-space when opening the thing and pieces jiggle around a little too much.

The USB keys they send you are awesome (micro usb, usb c, and usb A in the same key!) and I wish more vendors did the PGP smart card setup they do.

In general the German open source movement has grown...strange...the last two years. Recently I was shown that one of the main contributors to the a small but important part of the Linux library that handles multimode to Usb devices...runs an overpopulation Institute that reminds me of the bad guy from the James Bond movie Moonraker [2]. They also added a "HuaweiAltModeGlobal" which causes no end of trouble for anyone in the networking field who commonly uses say tcpdump and USB router sticks.

[1] - https://www.phoronix.com/scan.php?page=news_item&px=Zlatan-T...

[2] - https://www.draisberghof.de/usb_modeswitch/

Reddit has changed ownership structure significant since these comments were made. It is highly unlikely that Tencent would be willing to see their $300 million investment from last year diluted at all [1]. Tencent is also one of the largest companies in China, essentially a State Owned Enterprise (SOE). Such a move would clearly privilege American users, who have been on Reddit significantly longer, than it would Chinese citizens.

Keep in mind the telecom connections to add the internet to China were not made until 1994, and residential was not available even to Beijing until 1997.

[1] - https://techcrunch.com/2019/02/11/reddit-300-million/amp/

Recently the Australian Strategic Policy Institute put out a paper "The Chinese Communist Party: Engineering Global Consent" [1]. It focused on China's attempt to build a digital "belt road initiative" and the vast amounts of data (it was in the many hundreds of exabytes) they were collecting each year.

China has previously said 90% of military intelligence is OSINT, so this level of aggregation in a country without at least the checks and balances of the West is concerning. Think of all the problems America has. Then imagine them with Google 20x as big and no Supreme Court and no free press.

[1] - https://www.aspi.org.au/report/engineering-global-consent-ch...

This article is bringing to light a lot of stuff that needs to be said about printers.

Also somewhat depressingly, HP is definitely the most secure printing company. That's not a very high standard though. But what it means is everything these guys have found...is much worse worse at every other printer company. HP was the first printer company to join HackerOne I believe, shockingly they still make some of their server brands in the US, and the security options on their entry level enterprise printers (m406) show at least some effort was put into them (for instance only allowing SNMPv3).

Yet at the same time, why can I only have a max 16 character password on the web management portal? Why does the username have to be "admin" which is obviously super easy to guess?

NOTE: I first saw this article as a promoted tweet on Twitter. This was hilarious to me because it was the first time I had had a relevant promoted tweet shown to me where I also didn't feel like the party involved was being misleading in some sort of way.

EDIT: Had trouble accessing their site. Some things to note that they found:

- Why do you have to download the updates manually from HP? Why can't the printer check? Why is it not automated? This process is awful. Do you then upload the zip file of the update to the printer or the bin file inside, or is it the bin file plus the md5 hash?

- PCL and PJL are languages that predate IP. Very insecure and so many things that have never been fixed.

1. Keyloggers written entirely in CSS have been demonstrated for some time now [a]

2. Malicious Javascript could have been embedded into their CI/CD pipeline and made it onto the site.

3. Somehow stealing SSH keys from a developer and simply logging into the box to change things at the OS level. In fact, it looks like at least one subdomain of theirs is hosted on GoDaddy. SSH keys for some of their customers were recently compromised. Note that I don't think this actually happened, but wanted to list. [b]

4. Smashing Magazine could also improve security by adding the Expect-CT, Feature Policy, and especially a Content Security Policy. Ironically a Smashing Magazine article from 2017 mentions at least having a CSP. [c,d]

5. I recall some speech by the NSA at DEFCON, I think in 2012 or something. One of their speakers said that for all the cool stuff they do...95% of this time it's just password reuse that gets people or phishing for credentials. This would seem to me the most likely way and the best investment of a hackers time.

[a] - https://css-tricks.com/css-keylogger/

[b] - https://www.theregister.co.uk/2020/05/05/godaddy_ssh_login_d...

[c] - https://www.smashingmagazine.com/2017/04/secure-web-app-http...

[d] - https://www.keycdn.com/blog/http-security-headers

This is just Zoom. The partners and sponsors almost all conspicuously mention Zoom meetings and Zoom Celebrations on their websites. Especially because of the major WSJ story today on Zoom and the origins of the Coronavirus, it seems very implausible that anyone mentions Zoom anymore overtly without having an agenda.

The co-founders are all from Yale, and have the best of intentions, but don't realize they have to some extent been manipulated.

I think this phrase was a little concerning as well. There is a decent historical record that has been built up over the last 10 years of stuff like this being abused: "We also use machine learning tools to make predictions". What are they trying to forecast? When did talking and letter writing necessarily need machine learning? I'm not at all saying it is dumb...but we should approach all of this with caution and hesitancy.

Nearly all consumer-grade home security cameras sold today on Amazon are just rebranded Xiaomi.

This is part of a major initiative out of Beijing called the "Xiaomi Ecological Toolchain".

Wyze, Yi, Kami, and IMOU are all part of this group. The products, at least the physical cameras, are quite well made. The software though has security and data collection issues much like what is mentioned in this article.

However the main issue is this appears to be a somewhat significant anti-trust violation. It will depend though ultimately on how much coordination is going on between the companies.

Dell XPS 13 Developer edition is probably considered the best.

I would also recommend System76 out of Colorado. Quite an interesting, boutique company.

I agree with the other commenter. This could just as much fight trafficking as it could be an "FDCS" or "Foreign Data Collection Scheme"

The Australian Strategic Policy Institute has some excellent examples in their paper from a few months ago. If anyone knows if similar work being done, please suggest.

[1] - https://www.aspi.org.au/report/engineering-global-consent-ch...

Even within the security community there is vicious, and at times quite personal, disagreement.

We are about 5-7 years away from there simply being a "site" with all around good advice most agree on.

Here's one problem. Let's say I recommend company XYZ, along with many other ppl. The thing that would then most likely happen is company XYZ gets bought out by private equity and used as an FDCS (foreign data collection scheme) by some nation state.

Until hard norms are in place, very tough to win.

- graduate with BA in psych at 21 in 2012 - self study into sysadmin role over summer break - work way up to Engineer and then to Cloud Architect over next decade - am aging in place until of the age when management considered more normal (this seems to start 35+ these days).

Tmux is what makes Linux worth it for me. Or more specifically, the command line. It is incredibly freeing, and discovering it is what made me finally choose the sysadmin path over outright programming.

Fun Fact: Google Cloud Shell is by default Tmux. You can tell, because you don't need to start Tmux up ever if you are in it. Simply hit something like ctrl+b++" and watch your terminal split in two.

We have been measuring and tracing Zoom traffic from the various client apps for the last couple of weeks.

One weird thing. It appears Zoom uses SCO Cloud [1] and HunTel Engineering Nebraska [2] to form sort of their own IPX? I have been a cloud architect for the last decade and haven't seen anything like this. The costs must be enormous if we are measuring correctly (no guarantee).

SCO Cloud though is quite the character. Apparently they are part of some group that has been trying to sue the Linux kernel for the last 20 years, until the case was put to rest in 2017 I think [3].

[1] - https://scocloud.com

[2] - https://htleng.com

[3] - https://arstechnica.com/tech-policy/2017/10/appeals-court-ke...

Agreed, and obviously the WHO is highly motivated to say something dire will happen at the withdrawal of large amounts of money.

AID to Africa has largely has been an unintended yet sad disaster. The best example of this is when the British were leaving East Africa in the 1960's they, reasonably, decided to administer the polio vaccine widely. Likely this massively furthered the spread of AIDS, which is thought to have crossed from monkeys to humans sometime in the early 1950s.

[1] - https://www.lrb.co.uk/the-paper/v25/n07/edward-hooper/aids-a...

Front companies are a well established method of operation certainly in spycraft (see the latest Crypto AG revelations), but also in internet hosting.

For example, Google requires their employees at certain data centers to only wear the badges of / pretend to be COPT employees [1].

Additionally, the Wikileaks AWS Atlas [2] showed show how yet another major company does this. I realize these are cloud data centers, but the similarity between them and hosting registrars, in terms of "internet power", is very complementary.

[1] - https://www.copt.com/ [2] - https://wikileaks.org/amazon-atlas/

The way the report was written, I suspect this was another open Gitlab server.

Most people who self-host Gitlab doesn't realize that between the default self-registration and "Explore" button at the bottom, possible for entirely random individuals to gain enormous access.

I have written the Naval Postgraduate School several times since December about their open Gitlab server (maybe it is supposed to be open though) which seems exposed via the "Explore" tab at the bottom: https://204.102.228.54/users/sign_in

Does anyone know what happened to the Facebook https://opencompute.org project? Does anyone actually use that? Seemed interesting at the time but haven't heard much recently.

The Area 51 of China is known as "Lop Nur". It is a desert site in the far northwest of China in the province of Xinjiang.

Xinjiang is the site of many concerning human rights violations, particularly near arbitrary executions to meet organ transplant quotas. An international tribunal convened in London last year to finally rule on this matter that has been rumored for years [1].

Also interestingly China is known to do nuclear tests when frustrated in foreign policy goals. They also detonated, several actually, nuclear devices in Lop Nur during the 1996 Taiwan Straits crisis.

[1] - https://www.nbcnews.com/news/world/china-forcefully-harvests...

Does this process allows the use of custom domains?

For a long time now custom domains on GCS with SSL has been a networking "mission impossible" and just an absurd amount of work really.

I remember giving up 12 months ago, I can't remember why, and just deploying to Firebase finally. That worked out well...but much more work than it should have been. Particularly compared to just hosting on S3.

I was hired by a decently well know consumer tech company in 2018 to investigate automated cloud security platforms. They handled a good deal of financial data so I was told (and this is the only time I've been told this in my career) cost wasn't an issue.

The first day at my work my manager handed my a 49 point spreadsheet with each row as a security functionality he wanted to see. Thee were a dozen columns for a dozen vendors.

Thus began an incredibly tedious of reading through literally every marketing word and documentation reference on each vendors site. Also my god the countless demos and follow up questions with the reps.

By the end of it I was convinced of one thing. All anyone did was "monitor" and "alert" on "stuff". Nothing took any action. Just alerts and monitoring and reporting and dashboards and metrics.

If an application would arrive that would actually "do security stuff" instead of just "Business Intelligence for Network Engineers"...I would really be motivated to use, recommend, and evangelize that application.

A quick recent anecdote on how hard this is going to be. In early February an NY Times reporter criticized, with some good evidence, Senator Tom Cotton for claiming that the Coronavirus leaked from a lab in Wuhan [1].

By the second week of this month, most of the intelligence agencies in the US had lined up behind this claim of a virus leakage from the Wuhan lab. Additionally Wikileaks cables from 2018 showed State Department officials warning about the conditions of the lab [2].

[1] - https://www.nytimes.com/2020/02/17/business/media/coronaviru...

[2] - https://www.nationalreview.com/news/u-s-diplomats-warned-abo...

This is particularly concerning for those in China. Keep in mind over 1,000 Chinese hospitals now use Zoom, as detailed in the Feb 26th blog post by CEO Eric Yuan[1].

If anything, I suspect this has less to do with hacking and more with insiders abusing their access to the system. Chinese hackers are very often extremely competent day time programmers, and have been known to sell their internal access to the highest bidder[2].

[1] - https://blog.zoom.us/wordpress/2020/02/26/zoom-commitment-us...

[2] - https://intrusiontruth.wordpress.com/2019/07/25/encore-apt17...