Chinese Hackers Infiltrate New York Times Computers • Hacker News Board

Re: Chinese Hackers Infiltrate New York Times Computers

#161

Post by pifflesnort » Thu, Jan 31, 2013, 4:22 PM UTC

ceejayoz wrote: post #92

pifflesnort wrote: post #44

Earlier quoted context omitted.

> I don't think the RubyGems people were incompetent. They sat on a publicly disclosed vulnerability in the YAML parser for a week. The YAML parser itself was ridiculously designed to (essentially) eval() YAML. Those were the two active decisions of incompetence. On top of this, they built a massively central system that is widely trusted with no means of code verification whatsoever. There is no telling what people…

> On top of this, they built a massively central system that is widely trusted with no means of code verification whatsoever. https://github.com/rubygems/rubygems/blob/master/History.txt 0.8.11 / 2005-07-13: Added Paul Duncan's gem signing patch. They've had a mechanism for code signing for 8 years. Yes, they could require signing of all gems on the site, but the ability has been there for a long time.

This doesn't do any good if it's not required/used, which it's not.

As a counter-example, the maven central repository requires signatures, and caching Maven repositories validate those signatures.

Re: Chinese Hackers Infiltrate New York Times Computers

#162

Post by babarock » Thu, Jan 31, 2013, 4:34 PM UTC

knowtheory wrote: post #112

babarock wrote: post #53

Earlier quoted context omitted.

I'm confused... What's the relationship between Arabs and Pakistan/Afghanistan? There's a difference between being Arab and being Muslim. The greatest Muslim countries are not Arab (Indonesia, Turkey, Iran, Pakistan). "Islamic unification" is by definition the opposite of "nationalist movements", and is very unlikely to happen. I can guarantee that Saudis, Pakistanis, Morrocans and Turks have way too little in common…

Revolutionaries tend not to be known for dealing in practicalities. And yeah, you're right, Arabian culture is distinct from other parts of the Muslim world, but neither are they totally disentangled either. Both the green revolution in Iran and the Egyptian revolution against Hosni Mubarak had well defined religious components for example.

Again bad example, Iran is not an Arab country. They don't speak the same language, they don't share the same culture, they consider themselves the descendants of the Persian Empire, not the Caliphate (the big Arab Empire a few hundred years ago).

Also, I'm not sure I get your last sentence either. An awful lot of revolutions in the world (Arab and otherwise) have been fueled by religion. Even in the US, religion might not have been a motivation for the War of Independance, but it had a major impact on the relationship between government and religion.

Arabs also know how to do revolutions without involving religion:

- Lebanon went through something extremely similar to the Arab Spring back in 2005. The revolution against the oppressors of the time succeeded by putting religion aside and having most parties unite. (Lebanon is a segregated mosaic of approximately 17 religions, each having more or less political power).

- Syrian resistance (or rebels, depending on your point of view) are not, despite what the media is telling you, an Islamist resistance. The leaders of the resistance have clearly repeated over and over again that they're not after the minorities, they're not trying to put Islam forward, they're simply against the Assad regime.

Re: Chinese Hackers Infiltrate New York Times Computers

#163

Post by wololo » Thu, Jan 31, 2013, 4:52 PM UTC

mylittlepony wrote: post #151

wololo wrote: post #115

Earlier quoted context omitted.

> Or that all theories are not worth our time, since they are just that, "just a theory" (implying there is no proof?), like creationists (of which, America is filled with) like to say. congratulations on the beautiful ad hominem

I don't see it. I was adding to the argument that you are using the word "theory" with a negative connotation, which makes absolutely no sense. And that mistake is very common in America, since you have religious folks spreading misinformation all over the country, including schools. On the other hand, I can see an ad hominem here: > the idea of Americans/Zionists/Illuminati/Nibiru pulling the strings behind every ma…

It's ad hominem because (a) bringing up creationism make the US look bad and (b) has nothing to do with conspiracy theories about the US having orchestrated the Arab Spring and plotting to overthrow the PRC. Are you saying I'm a creationist, or am being secretly influenced by them?

In fact, believing in creationism fundamentally relies on conspiracy theories and makes one more likely to believe in conspiracy theories.

> Someone is a "conspiracy theorist", so whatever he finds exciting must be wrong.

From a Bayesian perspective, I would get behind "much more likely", yes. I'm claiming the conspiracy theories involving those four all assume magical powers in similar ways and are just as unlikely, so I think they're OK to associate with each other, as they inform on each other.

Re: Chinese Hackers Infiltrate New York Times Computers

#164

Post by wololo » Thu, Jan 31, 2013, 5:04 PM UTC

berntb wrote: post #150

wololo wrote: post #108

Earlier quoted context omitted.

Occam's Razor says some office working for the Chinese government is looking for who snitched on Wen Jiabao's problematic enormous wealth. > Perhaps then you believe it is only Americans that never conspire. seriously? Just look at the flailing US response day by day in the Egyptian revolution as they tried to get ahead of how it would turn out for an example of how the Obama administration was just as blindsided by…

>>For US intervention in the Libyan revolution, after the 1994 Rwandan genocide, Rice said "I swore to myself that if I ever faced such a crisis again, I would come down on the side of dramatic action, going down in flames if that was required." A change of subject, but... Why have this been forgotten today?! Syria seems worse than Libya. It reminds me of the civil war in ex-Jugoslavia with the rape camps and atrocit…

http://en.wikipedia.org/wiki/Russia%27s_role_in_the_Syrian_c...

Re: Chinese Hackers Infiltrate New York Times Computers

#165

Post by amalag » Thu, Jan 31, 2013, 5:36 PM UTC

betterunix wrote: post #4

Hilyin wrote: post #3

Earlier quoted context omitted.

I think if they have the ability to steal the passwords, even if they weren't plain text, they didn't do the proper precautions of encrypting with a salt. So either way, they failed.

At this point, passwords should be considered obsolete when it comes to securing things. We should be using smartcards and cryptographic techniques; humans are just not good enough at generating or remembering random strings for passwords to be considered a good idea.

Yes I personally like the Yubikey idea which integrates with AD. Keeping a physical token and just pushing a button is nice.

Re: Chinese Hackers Infiltrate New York Times Computers

#166

Post by javajosh » Thu, Jan 31, 2013, 5:41 PM UTC

rooshdi wrote: post #129

javajosh wrote: post #101

Earlier quoted context omitted.

As much as I'm tempted to accept the self-loathing implicit in your analysis, temphn, I must strenuously object. Talking to people should never be denied or (in this case) punished. I don't care if it's government sponsored propaganda, the NYT, or the KFC marketing department: there is no justification for censorship . If, as you say, "the Chinese government feels that it is under attack by the United States" then pe…

I'm all for freedom of information, but let's not kid ourselves that the U.S. government doesn't restrict information either: http://en.wikipedia.org/wiki/Censorship_in_the_United_States

You know, I really don't think that a regional book ban of James Joyce in 1933 is really all that comparable with what's going on in China today. Call me crazy.

Re: Chinese Hackers Infiltrate New York Times Computers

#167

Post by ceejayoz » Thu, Jan 31, 2013, 5:43 PM UTC

pifflesnort wrote: post #161

ceejayoz wrote: post #92

Earlier quoted context omitted.

> On top of this, they built a massively central system that is widely trusted with no means of code verification whatsoever. https://github.com/rubygems/rubygems/blob/master/History.txt 0.8.11 / 2005-07-13: Added Paul Duncan's gem signing patch. They've had a mechanism for code signing for 8 years. Yes, they could require signing of all gems on the site, but the ability has been there for a long time.

This doesn't do any good if it's not required/used, which it's not. As a counter-example, the maven central repository requires signatures, and caching Maven repositories validate those signatures.

I'm simply contesting the "no means of code verification whatsoever" statement.

Re: Chinese Hackers Infiltrate New York Times Computers

#168

Post by pifflesnort » Thu, Jan 31, 2013, 5:46 PM UTC

ceejayoz wrote: post #167

pifflesnort wrote: post #161

Earlier quoted context omitted.

This doesn't do any good if it's not required/used, which it's not. As a counter-example, the maven central repository requires signatures, and caching Maven repositories validate those signatures.

I'm simply contesting the "no means of code verification whatsoever" statement.

My point is simply that without signatures, there is no means of verification. Having the code isn't enough.

Re: Chinese Hackers Infiltrate New York Times Computers

#169

Post by lallysingh » Thu, Jan 31, 2013, 5:57 PM UTC

jasonkester wrote: post #144

lallysingh wrote: post #127

Earlier quoted context omitted.

What? Why? I happily wish for the day that the Great Firewall gets shut off, but in my book, the Chinese Government has been fantastically successful. The sheer number of people brought out of poverty in the last few decades is mind-boggling. In 1981, 85%[1] of China's population (that's 850 million people[3]) lived on I'm confident that we'll eventually see reform in China. It'll take a few decades. People are still…

It might be worth taking a quick glance at those articles again to make sure you're making a meaningful comparison. The US poverty figures you quote are for an income of $23k/yr, or ~$11/hr. In that chart you quote for China, you notice that even the 71% mark only gets you up to $5/ day (so $0.60/hr).

Frack me. Good point!

Edit: thinking about it. Isn't the poverty line relative to the cost of living? It may take a lot less money to feed and clothe a family in China than in the US.

Re: Chinese Hackers Infiltrate New York Times Computers

#170

Post by j_s » Thu, Jan 31, 2013, 6:09 PM UTC

magicalist wrote: post #149

PakG1 wrote: post #146

Earlier quoted context omitted.

Read the top comment that started this whole conversation. It's foundational to the whole thread. There is no thread without that claim.

If you read my comments above, you can see that I did indeed read the top comment. All that is provided is the assertion that all (american?) organizations questioning the Chinese government are apparently seen as arms of the United States's campaign against China, which explains why the Chinese government would make this move. What I was asking for any specific evidence that would preclude the much more obvious expl…

False dichotomy perhaps? Consider this specific instance as a subset:

  >  the New York Times wrote a story exposing corruption surrounding the 
  >  Chinese Premier, and the people infiltrating the system were looking 
  >  for the sources of that information

of:

  > all (american?) organizations questioning the Chinese government are
  > apparently seen as arms of the United States's campaign against China