Re:Juniper breach mystery starts to clear with new details o...
by swiley on Sunday September 05, 2021 @06:35PM
(#28428437)
Your best bet is to use things developed entirely in the open. Even if that compromises performance.
Re:Juniper breach mystery starts to clear with new details o...
by simiones on Monday September 06, 2021 @08:33AM
(#28433050)
That doesn't help if you're trying to be safe from a powerful world government - one with the resources and will to infiltrate an open project for its own ends. It's far less likely that there are US backdoors in Huawei routers (which surely contain Chinese backdoors!) than in any mostly american open-source software you pick.
Re:Juniper breach mystery starts to clear with new details o...
by swiley on Monday September 06, 2021 @05:32PM
(#28438346)
Huawei routers are well known to be backdoored by the Chinese government. If you’re worried about attacks from nations then you can only build things yourself from scratch, your next best option is things done in the open since the bar for hiding back doors is much higher.
Re:Juniper breach mystery starts to clear with new details o...
by SkyMarshal on Sunday September 05, 2021 @10:18PM
(#28429615)
>But the PLA and the GRU can't physically confine you to an 8x8 steel cage on trumped-up charges predicated on the data they exfil from your network.
Actually they can, and with less legal recourse for you than in the US. It just depends on where in the world you happen to be when they decide they want you.
Re:Juniper breach mystery starts to clear with new details o...
by arcticfox on Sunday September 05, 2021 @11:58PM
(#28430075)
Why bother with cages when you can go straight to Novichoking someone's underpants?
Re:Juniper breach mystery starts to clear with new details o...
by jvanderbot on Tuesday September 07, 2021 @11:25AM
(#28445987)
It is entirely nonsensical to me that buying from alibaba would save you from an overly-inquisitive domestic government.
In any country, you'll end up in a steel cage regardless of whether you bought your computer or software from the KGB, NSA, or a homemade kit in a bazaar in Nicaragua made by a kid from Chile.
You'd also be crazy to trust anything made by American gear vendors. This is not the only instance of this, just one of the ones for which FVEY got caught.
Is non-US gear also compromised? Yeah, probably. But the PLA and the GRU can't physically confine you to an 8x8 steel cage on trumped-up charges predicated on the data they exfil from your network.
Your best bet is to buy gear from countries either not-friendly or actively hostile to the country you're in. Sure, you're probably pwned, but they're not sending a SWAT team in an MRAP to shoot your dog, either.