421–430 of 497 posts
The opsec of the people who eventually get indicted is always terrible. If you wanted to exfiltrate source code or docs, why the heck would you use the victim's own cloud storage product? You would just point a camera at your display and scroll through the desired materials, or use HDMI capture, or something along those lines.
By definition....
Yes
Earlier quoted context omitted.
You expect Google to scan the database of companies in every country continuously to see if employees are executives of them? How would this handle different people who have the same name? Disclosure: I work at Google.
> You expect Google to scan the database of companies in every country continuously to see if employees are executives of them? How would this handle different people who have the same name? > Disclosure: I work at Google. It's Google. Not a mom and pop shop, not a startup, not even a large bank. It's a massive conglomerate who's entire business model revolves around data. So yes. And same-name conflicts can be handl…
...unless they're Chinese.
The opsec of the people who eventually get indicted is always terrible. If you wanted to exfiltrate source code or docs, why the heck would you use the victim's own cloud storage product? You would just point a camera at your display and scroll through the desired materials, or use HDMI capture, or something along those lines.
Survivorship bias in action? The only ones we hear about are the ones who are sloppy enough to get caught. The people who know how to not get caught, doesn't get caught so we never hear about them.
This doesn't surprise me. I knew someone that intentionally graduated with a specific major, so they could get a job in that industry and send trade secrets/IP back to China. The purpose was to create a competing company. It didn't work out for them that well. They couldn't last more than 6 months at any one company and I think eventually gave up and went back home.
The guy was allegedly stealing all that using Google Drive. I find such moronic behavior really hard to believe. Literally, there’s no illusion of privacy at Google while using company hardware, let alone company services. This has become quite clear after the Levandowsky fiasco - some of the things disclosed there were surprisingly invasive far in excess of what you’d normally expect
> Officials also reviewed surveillance footage showing that another employee had scanned Ding’s access badge at the Google building in the U.S. where he worked to make it look like Ding was there during times when he was actually in China, the indictment says.
If any of you get this far down, one thing that caught my eye is that Google said they had analyzed this guy’s network traffic after locking his laptop, confirming various things. If you work at a large company like Google, every packet on their employee access network is recorded and indexed for forensic purposes. This is not something Google would talk about publicly, but it’s standard practice in any company that…
This is standard practice in all big companies. Everything is tracked and recorded. If you want to say something to a colleague that you don’t want management to know - use your personal phone and talk at a coffee shop or bar in person.
Wonder if any Americans go to Chinese tech companies to steal secrets or if there is just nothing there to steal.
Earlier quoted context omitted.
In highly regulated national security impacting industries like defense, that makes sense. Google has not developed that rigor yet, although it's becoming obvious that their business has high national security implications now.
I don't think Google has ever had rigor, in anything except possible things which directly affect uptime. It seems to be a systematic problem - look at their history with chat apps for example. Great for hackers - both ones working for Google and ones working for other governments, apparently.
Earlier quoted context omitted.
Repositories are rarely worth much. Sure, some algorithms there might save you some time, but its often the design and the data where the money lies (what this guy focused on). Clone google's repo and you'll likely struggle forever to get anything of substance running on a rando vm/docker/etc. not to mention about spinning the entire stack with interconnected services, certificates, shitty code, and layers upon layer…
Source code repo is like a very extremely detailed doc. You might not be able to actually easily run it due to all of the dependencies etc, but with couple of weeks of reading, you should be able to tease back out the high level design.
The design from a design doc can be replicated at almost any company. The actual code is specific to the company and their exact stack.
The company's business position is similarly hard to duplicate. You can understand a company's current capital, customers and money flows. Your new company has to either outcompete for those same flows or create or capture alternative flows, and do this with different capital. Having, say, the entire source code for FedEx doesn't make it easy to launch a competitor. It's practically irrelevant compared to the network of capital investments, corporate goodwill and contracts, etc.