161–170 of 238 posts
Reminds me of the Bloomberg SuperMicro article with a single anonymous source alleging that several big companies were compromised, which they deny. Funniest part is how Bloomberg itself also claims it wasn't compromised: > Bloomberg LP has been a Supermicro customer. According to a Bloomberg LP spokesperson, the company has found no evidence to suggest that it has been affected by the hardware issues raised in the a…
Earlier quoted context omitted.
>Everyone makes mistakes. Fully agree, which is why I said the same thing. :) >Granted, this is probably in response to some legal action either in progress or already settled, but what more do you want from the guy? As I said in my post, a stated awareness that he was used in a cyber blackmail scheme, and at least some nominal promise to try and be aware of that in the future. The difference here is between "I made…
Saying that he was part of the blackmail scheme would make him maybe target of legal actions from Ubiquiti. So .. that you will not get. He has to do the same company-lingo like they all do after screwups.
If there's one thing I really hope people take away from this entire story is not to use security researchers' statements in constant appeals to authority. I hear so many questionable-to-bad takes on cyber security that basically amount to Bruce Schneier, Brian Krebs, or Troy Hunt said so, so you're absolutely wrong if you don't obey them. It's really important to remember security researchers and experts convey what…
There are many examples of this occurring.
Sometimes the manipulation is just designed to make the journalist(s) look stupid as in KTVU's scoop on the names of the Asiana Airlines pilots responsible for the deadly crash at SFO: https://www.youtube.com/watch?v=L1JYHNX8pdo
Sometimes it's more serious as in the case of Matthew Keys, who went to prison. I suspect he thought he was chasing a story but was too naïve to realize he was being played. https://www.wired.com/2016/04/journalist-matthew-keys-senten...
Dan Rather's desire to take down former president George W. Bush for all intents and purposes ended his own career by not vetting documents provided to him by a source. His producer Mary Mapes was forced to resign as well. https://en.wikipedia.org/wiki/George_W._Bush_military_servic...
I think we can all learn from these people's mistakes. Our own desires for a particular outcome or to have our personal beliefs confirmed can make us vulnerable to people who might have an incentive to manipulate us. For this reason, it's probably wise to employ a healthy level of skepticism when consuming "news" regardless of how trustworthy we believe the source to be.
Earlier quoted context omitted.
> I think it's obvious he's going to do something to avoid this happening again but also I highly doubt anything would be disclosed publicly about this. This isn't exactly a guy with a track record of not learning. Sure, but part of a "mea culpa" is saying what's important to be said. Otherwise why say anything at all? Maybe he doesn't get it? Maybe he sees the facts differently? Generally I agree with you, and think…
Frankly, he is retracting something because is wrong and he is broadcasting that retraction on the largest platform he has access to: his platform. He has sincerely apologized to and made clear who he has harmed: Ubiquiti. So like, what do you want? What more should he say? You say "maybe he sees the facts differently" as if we as anonymous internet crowds are entitled to a post-mortem on his psychological state. Thi…
> So like, what do you want?
I think I've been pretty clear, basically an acknowledgement of the situation and a statement that he has some ideas on how to address it from coming again. I'm not even asking for an in-depth process update, I realize why he might want to be vague. Importantly, I just want to make sure he sees the problem. Otherwise, what stops it from happening again?
> What more should he say? You say "maybe he sees the facts differently" as if we as anonymous internet crowds are entitled to a post-mortem on his psychological state.
I'm certainly not entitled to his mental state, he's free to remain as private as he'd like. To go back to my original point, I said "[how he] has handled this whole episode has not inspired optimism in how he'll handle future mistakes." So to answer your question, all I'm saying is if he wants to be seen as a trustworthy public security researcher that is a step he can take in service of it. If he wishes to remain private on it he can too, but as he's decided to be a public security researcher I think it's only fair to engage with that. And I think it's off the mark to call it parasocial, when I'm only engaging with him as a public security researcher doing security work.
Before people jump on this with super negativity... mistakes happen. What is Krebs' false positive rate? I think low enough that a simple, clear explanation of why it happened is sufficient. There's no weasel words or evasion here - he owns up to the error, apologizes to affected parties, and retracts all original posts. It's true that his reporting probably caused stress for Ubiquity. I'm curious what people think i…
Earlier quoted context omitted.
Saying that he was part of the blackmail scheme would make him maybe target of legal actions from Ubiquiti. So .. that you will not get. He has to do the same company-lingo like they all do after screwups.
He was/is the target of legal action from Ubiquiti. I assume this statement is part of some settlement he has reached with them regarding the legal action.
I remember at the time we were discussing the misreporting I noted that Krebs’ lack of retraction could come back and bite him. It’s interesting to see it now. It’s also interesting to note that it is referenced in point 11 of the lawsuit.
A little remorse goes a long way, and pride can be expensive.
Earlier quoted context omitted.
Yeah, this reflects my views too. He's using the veneer or pretext of journalism and reporting the truth in order for him to cover sloppy sourcing.
> sing the veneer or pretext of journalism and reporting the truth in order for him to cover sloppy sourcing Getting tips from criminals is not sloppy sourcing. There is verification that obviously failed here. We likely won't hear the full story until the prosecution and litigation cycles have turned.
But the fact that the source was also the person who has allegedly perpetrated the crimes going unmentioned and not being disclaimed to me is sloppy - even if there was additional verification done, if you are mentioning this source as the cornerstone of your article, I want to know about the vested interests that source has. Obviously, being the person that allegedly did it means you have A LOT of vested interest in how it is covered and what is revealed. If you want to talk yourself up and brag about it (which seems to be a given if you are telling a journalist about something you allegedly perpetrated) it is totally reasonable for people to be suspicious about how much is fact and how much is fiction. Humans like to exaggerate when talking themselves up.
An accurate but pretty lacklustre "mea culpa" and retraction. I don't mind people making mistakes, everyone does, but seeing how Krebs has handled this whole episode has not inspired optimism in how he'll handle future mistakes. He was essentially used as an unwitting party in a cyber blackmail scheme, and he doesn't touch on that at all. There will continue to be nefarious parties trying to misuse his reputation, so…
Everyone has weaknesses to being socially manipulated. One way to mitigate this is to open a dialog with "the other side" to check and seek out inconsistencies. Perhaps not revealing everything in your exposé story or leaving the veracity of it somewhat ambiguous until things develop further. This could weaken the impact of your initial story. Dialog is probably not easy when the other party is undoubtably criminal and you can get blocked from reaching the right people. In this case, the accusations were against a corporation. They can be good or bad, but ultimately legal processes will reveal things.
I do think Mr Krebs has upped his game in recent years and enjoy reading his stories, but I read them like fiction rather than actual verified facts.
Earlier quoted context omitted.
This is about of straightforward as a "I screwed up, I own it, I apologize" Everyone makes mistakes. Some of the good work Krebs has done seems to be completely overshadowed by a mistake here. Granted, this is probably in response to some legal action either in progress or already settled, but what more do you want from the guy?
If I were ubiquiti management or shareholder I would want a pound of flesh, and I expect their lawyers will be pursuing that.