51–60 of 61 posts
Do people know that Fortinet is pretty much a de-facto Chinese company?
Any links on that? Only notable incident was when they apparently sold intentionally mislabeled Chinese-made equipment to U.S. government end users. https://en.wikipedia.org/wiki/Fortinet#cite_note-37
Tho Ken Xie is also a Stanford graduate and has had US citizenship for decades.
Prediction: at some point (if it isn't already happening as we speak), the government insistence on "we need to be able to hack into any software if it's important" will collide with "we need to be able to keep foreign powers out of our software", and there will be bitter internal fights about it, both sides claiming national security interests.
The downside of having generally-known weaknesses seems to have been largely deprecated.
Rather than "security by obscurity", the operational status has been "insecurity by obscurity". Unknown to users, systems are largely wholly insecure, and it's only ignorance that gives the illusion that they are secure.
I wrote on this recently: https://joindiaspora.com/posts/b596219086b1013991d8002590d8e...
In practice, the "everyone anywhere can attack any online system" status of the Internet, and the porosity of most LANs and even nominally airgapped / detached systems (see the Stuxnet attack on Iran's centrifuge systems) means that virtually all systems are vulnerable.
I suspect that the debate is quite live within government, particularly as the US itself is repeatedly the victim of such attacks.
Earlier quoted context omitted.
Bruce Schneier has been complaining about this tradeoff for more than a decade: https://www.schneier.com/blog/archives/2014/05/disclosing_vs... >The NSA can play either defense or offense. It can either alert the vendor and get a still-secret vulnerability fixed, or it can hold on to it and use it to eavesdrop on foreign computer systems. Both are important US policy goals, but the NSA has to choose which one to purs…
I know this would be hard to keep under wraps, and extremely difficult for closed source software, but it seems like the right answer here would be for the NSA to create patches for government use. If the government only used open-source software, the NSA could create patches that only the government would use, while keeping zero days that can be used against everyone else. If the government started requiring all/mos…
Tightly enclose all running software with a beyond-root, kernel-level authority/sandbox, so even vulnerabilities only we know can't harm us if they're discovered?
Earlier quoted context omitted.
Any links on that? Only notable incident was when they apparently sold intentionally mislabeled Chinese-made equipment to U.S. government end users. https://en.wikipedia.org/wiki/Fortinet#cite_note-37
I think they are referring to the fact how Fortinet was founded by two Chinese born brothers. Tho Ken Xie is also a Stanford graduate and has had US citizenship for decades.
Prediction: at some point (if it isn't already happening as we speak), the government insistence on "we need to be able to hack into any software if it's important" will collide with "we need to be able to keep foreign powers out of our software", and there will be bitter internal fights about it, both sides claiming national security interests.
In the defensive world, success is abstract, failure is concrete and there are always going to be bugs, accidents, lapses, etc. in the offensive world, you demonstrate success by providing actual intel, you can demonstrate value. I’ve worked on security products for most of my career, there is a point in the lifecycle before your product is just a requirement where customers will ask “how do I know I need this? Or it’s working?” It can be more challenging to answer that than if your product failed and they got popped, at least you can help and provide information if they got popped.
I know who I think would climb the ranks. Long term strategy wise, if they split it up and aggressively worked with industry to patch holes and fix things, encouraging best practices, it would probably save the nation trillions but we would have to use other techniques to get some of our intel.
Earlier quoted context omitted.
I think they are referring to the fact how Fortinet was founded by two Chinese born brothers. Tho Ken Xie is also a Stanford graduate and has had US citizenship for decades.
Not only that, but them having the bulk of their staff in China.
By this logic does it not mean that Google is a Russian/Soviet company? Sergey Brin was born and spent some years in Russia, also Google has staff in Russia(and China in this regard)
Earlier quoted context omitted.
Not only that, but them having the bulk of their staff in China.
> not only that By this logic does it not mean that Google is a Russian/Soviet company? Sergey Brin was born and spent some years in Russia, also Google has staff in Russia(and China in this regard)
A situation is different from where a double citizen operates a sales office of a company from his home country
Earlier quoted context omitted.
By intra-government you mean like US vs China? (or any other competitors? We could say Israel and Germany) I think this has always existed though the information age has swung the balance to there being more importance for average citizens to have encrypted data in a more general sense and not just finance.
"Intra" here means inside the same government (you're thinking of "inter"). The hypothesis is that there will be parts of the US government (like perhaps the FBI) that will advocate for government-controlled backdoors into all encryption, while other parts (like perhaps the NSA) will argue for the strongest, backdoor-free encryption possible. I think it's an interesting hypothesis, but one weakness is that the govern…
Earlier quoted context omitted.
> not only that By this logic does it not mean that Google is a Russian/Soviet company? Sergey Brin was born and spent some years in Russia, also Google has staff in Russia(and China in this regard)
He was born there, but he did not remain as a citizen of that country, and not been going back, and forth in line of business. A situation is different from where a double citizen operates a sales office of a company from his home country
Is above what you are trying to say?
Earlier quoted context omitted.
He was born there, but he did not remain as a citizen of that country, and not been going back, and forth in line of business. A situation is different from where a double citizen operates a sales office of a company from his home country
So that we are on a same page, you are stating that any company is de-factor to be considered belonging to country X if: 1) Founder has a double citizenship 2) Has some of the staff in a foreign country 3) Has a sales office in their home country Is above what you are trying to say?