Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GCHQ's Boiling Frogs paper on software development

github.com

Post reply on HN
Print view View original

71–80 of 85 posts

Re: GCHQ's Boiling Frogs paper on software development

#71

Post by Jugurtha »

saganus wrote: post #66
branchless wrote: post #55

Earlier quoted context omitted.

Because GCHQ are having a PR drive and they have enough accounts here to up-vote it to the front page?

Would it really be a good investment for GCHQ to keep enough sockpuppet accounts on HN to upvote something like this to the front page? What would they gain? And if they really have an eye on HN, that would probably mean that NSA as well. If that is true, would it inhibit a community like HN to self-censor?

You wouldn't want to inhibit a community like HN, that would be useless.. but if you could shape it or get it to like you, that would be monumental.

Let's look at it from different scales..

Think on a very small scale: how many hugely successful companies were on YC combinator? A lot. Companies like Dropbox, Airbnb, etc. Companies that are now important. Imagine if you could influence their founders right at the beginning of their journey..

Where people spend their night and what files they store? That's great information to have.

Think on a slightly bigger scale: how many applied to YC? A whole lot more. What would you get if you influence those?

How many are on HN but haven't applied to YC (i.e: read and comment or just read): a lot, lot more..

Where are they? Could be anywhere. They could speak any language, be of any color, worship any deity.. They could be a teenager or a senior VP, an engineer or an artist. They could get any access to anyone, they could either know someone or know someone who knows someone.

They all are somewhat technically literate and can influence people around them. Right there, my friend, is the prime recruiting Tree of Knowledge for any Intelligence Officer in the world. Imagine if you could develop assets everywhere..

Or better yet, imagine if you can shape the image such a great demographic has about you to the point they look at you like a normal tech company: suddenly, you've reframed the interaction and took the controversy/guilt/moral dilemma out of it. They won't consider themselves assets since you're just like Google or Dropbox.. they won't think they're spying on their countries, it will just be filing a vulnerability report.

You could also have advocates that relay your thoughts on an issue about something: it's like having millions of megaphones. Or at least don't go hardcore on you..

Imagine all the communities each HN member is part of, and the reach this gives you.. Imagine all the places they access HN from..

Just imagine the possibilities if you get people that smart and dispersed to like and respect you.

Re: GCHQ's Boiling Frogs paper on software development

#72

Post by MichaelGG »

xrorre wrote: post #60
linuxlizard wrote: post #51

Earlier quoted context omitted.

(In case folks don't know, PNG better for text because JPG's compression introduces "ringing" artifacts around sharp edges, such as the black/white transition of text.) https://en.wikipedia.org/wiki/Ringing_artifacts

JPGs are also a lot safer as PDFs can ping remote resources using carefully hidden beacon images. Although that said, I sometimes use this to see who opened my files. I once left hundreds of these on a very popular cloud hosting provider (not naming names), and somebody working there was stupid to open the PDF on a machine connected to the internet, thereby proving abuse by employees and proving any random stranger c…

Maybe it was an indexer that for whatever reason runs the full PDF handling code?

Re: GCHQ's Boiling Frogs paper on software development

#73

Post by floatboth »

kirykl wrote: post #52
cm3 wrote: post #5

Wait, the GCHQ has a GitHub profile where they share a Graph Database engine. Interesting.

NSA has a linux distro https://en.wikipedia.org/wiki/Security-Enhanced_Linux

SELinux is not a distro. It's an Linux Security Module (Mandatory Access Control thing) that comes with the upstream kernel that sysadmins need to STOP TURNING OFF: http://stopdisablingselinux.com

There are alternatives though. SELinux was designed for big machines with multiple physical users. You can use it with pretty much any scenario (and Android uses it for sandboxing apps), but AppArmor is much easier for common personal desktops and web servers.

On FreeBSD and Darwin, the similar thing is TrustedBSD: http://www.trustedbsd.org/mac.html

Re: GCHQ's Boiling Frogs paper on software development

#74

Post by awinter-py »

> For example, an organisation building public service websites would not build a software configuration management system for itself, this is a commodity capability that is best served by well-established tools such as the open source Git.

Hmm

TARDIS metaphor is very cool though

Re: GCHQ's Boiling Frogs paper on software development

#75

Post by dang »

branchless wrote: post #55
dTal wrote: post #53

I really doubt this PDF is infected with anything like people are suggesting, but why is it on here at all? It seems incredibly empty and buzzword-y to me, interspersed with such charming insights as "It can make good sense to use external suppliers." Lots of talk about "disruption". It reads... well, it reads exactly like what it is, a vacuous corporate "whitepaper".

Because GCHQ are having a PR drive and they have enough accounts here to up-vote it to the front page?

I suspect it's more the novelty of a spy agency publishing an article on something people here know a lot about.

Re: GCHQ's Boiling Frogs paper on software development

#76

Post by saganus »

Jugurtha wrote: post #71
saganus wrote: post #66

Earlier quoted context omitted.

Would it really be a good investment for GCHQ to keep enough sockpuppet accounts on HN to upvote something like this to the front page? What would they gain? And if they really have an eye on HN, that would probably mean that NSA as well. If that is true, would it inhibit a community like HN to self-censor?

You wouldn't want to inhibit a community like HN, that would be useless.. but if you could shape it or get it to like you, that would be monumental. Let's look at it from different scales.. Think on a very small scale: how many hugely successful companies were on YC combinator? A lot. Companies like Dropbox, Airbnb, etc. Companies that are now important. Imagine if you could influence their founders right at the begi…

I see the point.

Still scares the hell out of me.

Privacy is a very strange thing. Even though I know that what I comment in online forums like HN is public for all intents and purposes it sends chills down my spine to think that we as a community could be shaped as you say.

And if they are able to do so, how do they do it? I mean, besides the obvious tools like sockpuppet accounts and such, how do you build a strategy to steer an online community? what kind of psychological tools do you need to employ?

Obviously psyops and humint people have decades of research on public manipulation, but still... how do you measure success? how do you keep it out of the participants' attention in a community that is full of educated (on these issues) people, or at least more educated than the average Joe I would hope?

Re: GCHQ's Boiling Frogs paper on software development

#77

Post by justinclift »

nicky0 wrote: post #44
justinclift wrote: post #38

Maybe a [dupe] tag, as this was submitted a few days ago too? https://news.ycombinator.com/item?id=11674394

Does HN have tags now?

Not sure what you mean. Other duplicate posts have "[dupe]" added to their title, so why the hassle this time?

Re: GCHQ's Boiling Frogs paper on software development

#78

Post by Jugurtha »

saganus wrote: post #76
Jugurtha wrote: post #71

Earlier quoted context omitted.

You wouldn't want to inhibit a community like HN, that would be useless.. but if you could shape it or get it to like you, that would be monumental. Let's look at it from different scales.. Think on a very small scale: how many hugely successful companies were on YC combinator? A lot. Companies like Dropbox, Airbnb, etc. Companies that are now important. Imagine if you could influence their founders right at the begi…

I see the point. Still scares the hell out of me. Privacy is a very strange thing. Even though I know that what I comment in online forums like HN is public for all intents and purposes it sends chills down my spine to think that we as a community could be shaped as you say. And if they are able to do so, how do they do it? I mean, besides the obvious tools like sockpuppet accounts and such, how do you build a strate…

Well, a "community" can be shaped when its individuals delegate thinking for themselves. This is the case with places where traditions hinder critical thinking. Everyone in unison: "GO TO statements are bad; Dijkstra said so".

It also doesn't need to be kept out of the participant's attention to work or there wouldn't have been Hanssens and Polyakovs.. My point is that if the very people who do this for a living and are trained to counter an effort to turn them can be recruited, then anyone can be.

Smart people seem to be like a machine with more open ports than a microwave and knowing the knife is sharp doesn't make one bleed less.

Re: GCHQ's Boiling Frogs paper on software development

#79

Post by justinclift »

xrorre wrote: post #61
kirykl wrote: post #52

Earlier quoted context omitted.

NSA has a linux distro https://en.wikipedia.org/wiki/Security-Enhanced_Linux

Qubes is exponetially superior to this distro. Open that PDF in a disposable Fedora sandbox, and physically disable the network plz

Because sandbox escapes aren't a thing GCHQ would have any knowledge of yeah?

/s

Re: GCHQ's Boiling Frogs paper on software development

#80

Post by abk77 »

xrorre wrote: post #61
kirykl wrote: post #52

Earlier quoted context omitted.

NSA has a linux distro https://en.wikipedia.org/wiki/Security-Enhanced_Linux

Qubes is exponetially superior to this distro. Open that PDF in a disposable Fedora sandbox, and physically disable the network plz

yes qubes is
Post reply on HN