20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions • Hacker News Board

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#141

Post by elmo2you » Thu, Aug 06, 2020, 10:18 PM UTC

gabcoh wrote: post #16

Is releasing this legal? It seems like this person isn't really disguising their identity or concerned about breaking the law. In their profile they even seem to brag about leaking company's code.

In addition to what other people already mentioned (how it is illegal), it may depend on jurisdiction. Also whether the country of origin of the source has an extradition treaty with the USA, or if the USA can otherwise (e.g. extrajudicial kidnappings) get the culprit to stand trial in the USA.

EDIT: While it maybe a relatively clear cut case according to US law, other countries (may) have different laws. There are also all kind of potential diplomatic and political obstacles, when this was done by somebody outside of the USA. For instance, good luck if this was a Russian or Chinese citizen.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#142

Post by deathanatos » Thu, Aug 06, 2020, 10:18 PM UTC

oneplane wrote: post #108

eli wrote: post #93

Earlier quoted context omitted.

"Maintenance Hole" actually, which is better because it's both more descriptive and not gendered.

But what if manhole is just mankind hole? (It probably isn't, I didn't look it up). Man doesn't always mean male, or does it?

> Man doesn't always mean male, or does it?

Not necessarily, but see: https://en.wikipedia.org/wiki/Gender_neutrality_in_English#D...

The link is about the debate as it is, but I would also encourage the use of good faith in interpreting any speaker: that is, assuming a person referring to "mankind" likely means all humans without exclusion based on gender or sex, and requiring some other material evidence before presuming bias.

I also wonder what these discussions are like in languages where most nouns are gendered, e.g., in French.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#143

Post by bogidon » Thu, Aug 06, 2020, 10:19 PM UTC

oneplane wrote: post #108

eli wrote: post #93

Earlier quoted context omitted.

"Maintenance Hole" actually, which is better because it's both more descriptive and not gendered.

But what if manhole is just mankind hole? (It probably isn't, I didn't look it up). Man doesn't always mean male, or does it?

Viewpoints can be encoded in language https://en.wikipedia.org/wiki/Male_as_norm

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#144

Post by james412 » Thu, Aug 06, 2020, 10:20 PM UTC

This kid has been posting these for fame (it's the same guy that posted the Daimler leak). I guess it's all fun and games until he finds himself in prison

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#145

Post by bogidon » Thu, Aug 06, 2020, 10:20 PM UTC

dlivingston wrote: post #134

bogidon wrote: post #80

Earlier quoted context omitted.

Yes, yes. Seems like an outdated term. Downvotes accepted.

Pick your battles. This isn’t a hill worth dying on (or even a hill worth getting slightly bruised on).

Yeah agree. And I think we could agree replying "Ew" and loosing a little bit of HN karma does not constitute more than bruising.

EDIT: didn't see the "or even" there. Disagree. I think the analogy can be drawn out a bit, so I'll say that a bruise can heal pretty quick, and one would adapt better to climbing "hills" if they exercised regularly. Plus maybe smaller hills should be climbed too.

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#146

Post by ccktlmazeltov » Thu, Aug 06, 2020, 10:25 PM UTC

skissane wrote: post #135

orisho wrote: post #11

At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|

Once I got a complaint from a security auditor that some code was using MD5. It wasn’t being used for any security purpose, just to check whether an autogenerated file had been manually edited. We decided it was easier to do what they wanted than argue with them, so we replaced it with CRC32C. That would have been faster than MD5, but nobody cares about saving a few milliseconds off reading a configuration file at st…

this is hilarious

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#147

Post by [deleted] » Thu, Aug 06, 2020, 10:26 PM UTC

aflag wrote: post #118

dleslie wrote: post #67

Earlier quoted context omitted.

Intel is an American company; so wherever there is an extradition treaty with the USA and where there are also similar laws.

No country Will extradite their own citizens, though. If intel wants the person punished, they have to sue them in the country they live in.

[deleted]

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#148

Post by switchbak » Thu, Aug 06, 2020, 10:26 PM UTC

newacct583 wrote: post #105

yelloworangefog wrote: post #73

Earlier quoted context omitted.

Frankly I don't think Intel's track record affords them the privilege of having good faith be assumed with something like this.

Intel doesn't have a track record of shipping back doors, or even "bad faith" software really.

Isn't their whole management engine essentially one big (poorly secured) backdoor?

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#149

Post by dathinab » Thu, Aug 06, 2020, 10:27 PM UTC

akerro wrote: post #79

orisho wrote: post #11

At a previous workplace we had a few places in the code which used the word backdoor. It was not an actual backdoor though, but merely a debugging server that could be enabled and allowed you to inspect internal state during runtime. At some point I removed the word backdoor, fearing it would get to a customer or during an audit someone would misunderstand. :|

>merely a debugging server that could be enabled and allowed you to inspect internal state during runtime When we talk about CPU it's bad enough. Think that your program has an input and output streams where most of the app data goes through and I can attach debugger and listen on the data. I would not be very happy about it and would still consider it backdoor.

But do we now if that part ever ended up in any CPU sold by Intel instead of e.g. engineering samples ?

Re: 20GB leak of Intel data: whole Git repositories, dev tools, backdoor mentions

#150

Post by fastball » Thu, Aug 06, 2020, 10:29 PM UTC

crdrost wrote: post #139

gspr wrote: post #125

Earlier quoted context omitted.

Why?

Because until this thing gets diffused and dissected by everyone and their mothers, the law is likely to view it as publication of confidential trade secrets, and people who can be confirmed to be spreading such things can get federal time, e.g. [1] for example. Using a VPN is the barest of mechanisms to try to obscure your identity to avoid this sort of punishment. [1] https://www.wsj.com/articles/SB1000142405297020…

Right but if you just download without seeding, no crime is being committed, yes?

So seems like the barest you can do is "disable seeding", not "use a VPN".