221–230 of 334 posts
Interesting tidbit from the linked twitter post: "Something is wrong. Blanket denials from companies, NCSC and DHS are v. unusual. The only precedent for this is a 2014 Bloomberg article, by the same author, which claimed NSA exploited Heartbleed, and was vigorously knocked down with zero follow up by Bloomberg or correction." https://twitter.com/nicoleperlroth
Earlier quoted context omitted.
> Apple's official statement clearly said, they're not under any form of NSL or gag order. Except that a NSL can (legally) command the recipient to lie about it.
> Except that a NSL can (legally) command the recipient to lie about it. Do you have a source for this statement? As far as I'm aware, you can be compelled to remain silent but not compelled to give a false statement.
Q: Have you received an NSL? A: No. Q: Now have you received an NSL? A: Still nope. (Government issues NSL) Q: What about now? A: No comment.
^ This would be a clear canary indication that an NSL has been issued, which is in directly contradiction of the terms of the secrecy requirements laid out in the NSL. The only reasonable response (aside from supporting the ACLU and EFF to end this nonsense) is to adopt the "no comment" policy early, which most do. However Apple has now broken that strategy, if they haven't already.
Earlier quoted context omitted.
> An NSL compels you to say nothing. You can neither confirm nor deny anything Ordinarily, yes. But what if this was double secret NSL?
I'm not sure NSL's are like meat/cheese layers on hamburgers. What's the NSL equivalent of adding bacon?
Earlier quoted context omitted.
> Except that a NSL can (legally) command the recipient to lie about it. Do you have a source for this statement? As far as I'm aware, you can be compelled to remain silent but not compelled to give a false statement.
You can be compelled to act exactly as you would as if the NSL had not been issued, and indeed they seem to contain language to that effect. A reasonable response would be to adopt a policy of "no comment" and most do, but if you have previously responded to questions about NSLs in the negative, you would then be required to continue doing the same. Q: Have you received an NSL? A: No. Q: Now have you received an NSL?…
They therefore are not “acting exactly as they would” without a NSL.
Earlier quoted context omitted.
Apple has a new chief counsel. Hmm the plot thickens
Old one was in place at the time of these alleged events and has publicly denied it as well.[1] [1] https://www.macrumors.com/2018/10/05/sewell-says-fbi-never-h...
Earlier quoted context omitted.
In the past, these Bloomberg reporters have misreported on NSA exploiting Heartbleed. Here is the Washington Post giving them shit about it:[1] As for the 2016 incident, read Apple's denial more closely. They denied finding infected firmware on servers purchased from SuperMicro. What happened is someone in the design lab (not in production) downloaded infected firmware from SM's support site, where it was "still host…
> Bloomberg reporters have misreported on NSA exploiting Heartbleed Bad source given. The WP relies on NSA officials denying they used heartbleed. You believe that?
God, people.
Earlier quoted context omitted.
> Except that a NSL can (legally) command the recipient to lie about it. Do you have a source for this statement? As far as I'm aware, you can be compelled to remain silent but not compelled to give a false statement.
You can be compelled to act exactly as you would as if the NSL had not been issued, and indeed they seem to contain language to that effect. A reasonable response would be to adopt a policy of "no comment" and most do, but if you have previously responded to questions about NSLs in the negative, you would then be required to continue doing the same. Q: Have you received an NSL? A: No. Q: Now have you received an NSL?…
The interesting thing about this story is that everyone is hopping up and down trying to figure out if it's true, but the one thing everybody agrees with is that the attack is practical. Whether it happened in this specific case or not, what are we doing to prevent it from happening in general?
The interesting thing about this story is that everyone is hopping up and down trying to figure out if it's true, but the one thing everybody agrees with is that the attack is practical. Whether it happened in this specific case or not, what are we doing to prevent it from happening in general?