Military power is not just about the number of bases. The simplest example is cyber warfare, where China has invested heavily and is arguably the world's most formidable power in that area

Scale isn't the same as capability though, and cyber talent isn't exactly hard to find, just ask the Israelis (or maybe HN readers can do a bit of navel gazing). It's not fair to compare script kiddie levels tools like ransomware and cryptominer bots in the same breath as the toys from NSO group and Stuxnet. If we are counting cyber warfare capability by quantity of malware released, I would expect Africa to become a cyber "power" too in the next decade or so, because they have a large somewhat educated population and no good opportunities.

I don't think most HN software engineering folks realize how easy it is to train script kiddies. Most of the big "cybersecurity" consultancies (yes even the big IPOed ones) are staffed by people who basically went through a bootcamp and gained a few certifications. Corporate "security" especially is more about checklists and compliance. You are not getting any real talent like the ICs' blogs that get posted here on HN. The typical staff at cybersecurity companies won't be able to subvert broken branch predictors and post networking stacks exploits on twitter. Those sort of low level application security engineers are a lot rarer and more expensive. Many of the "cybersecurity" companies provide script kiddies and consultants without a STEM background. Forget about fizzbuzz, they are closer to McKinsey than Accenture.

Arguably, based on what? Flimsy attributions based on Chinese strings embedded in payloads?

When has China, as a state actor, done anything as remotely as egregious as STUXNET?

Many reports that China has surveillance embedded in cell tower equipment across the US and in container cranes in every major port. Who knows if they have been behind past cyber attacks on our oil infrastructure and electric grid. We don't hear about it because it's classified/ not diplomatically wise to share that info all the time

Did we learn nothing from the weather balloon circus?

Monitoring the weather = surveiling the weather = spying on the weather = spying = spying on Americans

It's a game of deranged telephone, fueled by the billion-dollar anti-China propaganda industry.

Similarly, did a Chinese OEM implement a SNMP daemon in their gear? Oh no, their literally spying on us1!11

I'm amazed anyone still buys China's "weather balloon" lie. A weather balloon that large and expensive is a major project. It would have a project leader, project webpage, articles and conference papers, sharing of data, government permits for operation, and all kinds of other artifacts that China could trivially point out proving it was a weather balloon. Instead, China has consistently refused to even give a single name or company associated with it. It is the most secretive "weather balloon" I have ever seen.

Buddy, the USAF also shot down weather "spy balloons" from a hobbyist club in the Midwest. You are vastly overestimating the seriousness of this affair.

Buddy, I never said anything about the subsequent balloons. Don’t try to deflect from the point you know I’m making: the first balloon was clearly not a weather balloon.

The US OPM breach.

The majority of those "bases" are like a gym and a barrack