There were BGP anomalies during the Venezuela blackout

Agreed the author here just dumps data but nothing that seems to be designed to disrupt comms in Venezuela is really mentioned.

So if you wanted to attack the US you wouldn’t do a conventional “red dawn” style attack. You’d attack like bin laden. And then keep quiet.

Normally I’d say the most effective way to attack a western country would be to target kids in school playgrounds, but the US seems that regularly anyway so it would be lost in noise. Perhaps target Amazon delivery centres with drones will strike fear into the true heart of America.

> if the server supports TLS 1.2, an active MITM can still downgrade to it

Nope. That's specifically guarded against, so double good news. 1) You get to learn something new about an important network protocol and 2) I get to tell you a story I enjoy telling

Here's the clever trick which is specified in RFC 8446 (the TLS 1.3 RFC)

In TLS we always have this "Random" field in both Client Hello and Server Hello, it's 32 bytes of random noise. At least, that's what it usually is. When a server implements TLS 1.3 but it receives a connection (in your scenario this is from a middlebox, but it might equally be somebody's long obsolete phone) which asks for TLS 1.2 then when it fills out the Random for this connection the last eight bytes aren't actually random, they spell "DOWNGRD" in ASCII and then a 01 byte. If the client seems to ask for any older version of TLS which is supported then the server writes DOWNGRD and then a 00 byte instead.

As you hopefully realise this signals to a client that a MITM is attempting to downgrade them and so they reject the failed attack. You very likely have never seen your web browser's diagnostic for this scenario, but it's very much a failure not some sort of "Danger, Chinese government is spying on you" interstitial, because we know that warning users of danger they can't fix is pointless. So we just fail, the Chinese government could choose to annoy its citizens with this message but, why bother? Just drop the packets entirely, it's cheaper.

You might wonder, why Random ? Or, can't the MITM just replace this value and carry on anyway ? Or if you've got a bit more insight you might guess that these questions answer each other.

In TLS the Client and Server both need to be sure that each connection is different from any others, if they didn't assure themselves of this they'd be subject to trivial replay attacks. They can't trust each other, so to achieve this both parties inject Random data into the stream early, which means they don't care if the other party really used random numbers or just (stupidly) didn't bother. Shortly after this, during setup, the parties agree on a transcript of their whole conversation so far.

So, if the Random value you saw is different from the Random number your conversation partner expected, that transcript won't match, connection fails, nothing is achieved. But if the Random value isn't changed but somehow we ended up with TLS 1.2 it says DOWNGRD and a TLS 1.3 capable client knows that means it is under attack and rejects the connection, same outcome.

Now, I said there was an anecdote. It's about terrible middle boxes, because of course it is. TLS 1.3 was developed to get past terrible middle boxes and it was mostly successful, however shortly after TLS 1.3 non-draft launch (when the anti-downgrade mechanism was enabled, it would not be OK to have anti-downgrade in a draft protocol for reasons that ought to be obvious) Google began to see a significant number of downgrade failures, connected to particular brands of middlebox.

It turns out that these particular brands of middlebox were so crap that although they were proxying the HTTP connection, they were too cheap to generate their own Random data. So your TLS 1.3 capable browser calls their proxy, the proxy calls the TLS 1.3 capable server, and the proxy tells both parties it only speaks TLS 1.2, but it passes this bogus anti-downgrade "Random" value back as if it had made this itself, thus triggering the alarm.

Obviously on the "Last to change gets the blame" basis Google had customers blaming them for an issue caused ultimately by using a crap middlebox. So they actually added a Chrome feature to "switch off" this feature. Why do I mention this? Well, Chrome added that feature for 12 months. In 2018. So, unless it is still 2019 where you are, they in fact have long since removed that switch and all browsers enforce this rule. That 12 months grace gave vendors the chance to fix the bug or, if they were able to, persuade customers to buy a newer crap middlebox without this particular bug, and it gave customers 12 months to buy somebody else's middlebox or (if they were thus enlightened) stop using a middlebox.

> of the Soviet Strategic Rocket Forces

Good, you made a first step, now do the other two.

> but should have been otherwise compensated for that loss

It's quite amusing what you are clearly imply what some state shouldn't be compensated at all.

> Are you incapable of telling what was meant by context, or where you just looking for a reason not to address the point made?

Yes, I'm incapable of telling why you threw something completely unrelated to the question. I'm not LLM.

> Ukraine literally designed and built large portions of these systems as was capable of keeping them.

Ah, yes, the mighty Ukraine who solely done that, right? Every other nation, state and people in the USSR didn't do shit to that. I have a feeling you are thinking about that issue as some sort of video game: just a couple of factories and a bunch of special units. But the things are not like that in RL.

It’s complicated. While it’s true that there is no direct enforcement, systems of sanctions and embargos have been used to indirectly enforce these agreements. Whether this is ultimately effective is not obvious, but I think “international law does not exist” is a simplistic take, with all due respect for your opinion (which I understand and partially share)