I contacted Amazon to report an advertiser out of Tel Aviv that was using JavaScript hosted on CloudFront to fingerprint user's devices and if an Android device was detected a fake media player or fake CAPTCHA would trick user's into accepting push notifications for fake virus warnings to install questionable apps from the Play Store.
This script also pushed ads for a fake AdBlock app that was a dropper for banking trojan apps.
Making takedowns automatic on any user report means the dictators take down the apps of the dissidents.
In the absence of AI that would necessarily have to be good enough to also radically change society and the economy, the only solution I can even think of is a big increase in funding for the policing of apps. Who exactly would fund that? Governments would want to use such powers to pursue their own agendas, while Big Tech taking a proportion of App Store income is already being called “[Apple|Google] tax”.
Or we could use a different architecture for our applications that isn't so easily taken down. You know like locally installed apps, that can do something without the cloud overlord pushing new code with every pixel or character that is transmitted.
How would that stop, to go up-thread a bit, "an advertiser … that was using JavaScript … to fingerprint user's devices and if an Android device was detected a fake media player or fake CAPTCHA would trick user's into accepting push notifications for fake virus warnings to install questionable apps from the Play Store"?
Why can’t we we reduce cloud provider margins and use that money to fund it!
I mean — why is this not obvious? Force these companies to adhere to certain regulatory standards - the minimum of which is transparency and accountability.
This is besides the point. Just because the Middle East has been in turmoil since it was neo-colonized after WW2 doesn’t mean it’s okay for massive corporations to exert this much influence.
Also, while we are on this subject, your language has some pretty orientalist vibes to it. I wonder who you think created these problems and who feeds them today?
I’m confused. Do you support corporations having this kind of unchecked power or do you support the neo-colonial strategies that have left places like the Middle East in turmoil for the past century?
No dispute there. That’s why you should push for accountability and transparency. When we discover groups like NSO, we (the public) should be able to use FOIA like mechanisms to query these cloud providers and check if they are doing business with these criminals. We should be able to see who exactly approved their application and why they didn’t fail whatever standards we (the public) have decided that cloud providers should uphold. Maybe the standards had gaps or maybe there is corruption. Either way, the public has a method for feedback into key parts of society: cloud providers.
In the meantime, Google and Amazon simply ignore all complaints about spam originating from their networks.
In the olden days of the internet, ISPs that ignored abuse complaints would be blocked by their peers. Now that Gmail and AWS are too big to block, they act with impunity.
This is complicated when you see how non-ethical companies like Lyft are messing with competition I wouldn't be surprised they would flood provider with spam-reports...
It doesn't really matter how difficult it is. What this demonstrates is that AWS is not a public utility and will be swayed by mob rule to take down companies that are no longer "acceptable".
It feels like this is more a result of Amazon not being able to connect you with the right escalation path to verify & act on these claims than a considered decision to ignore them.
Does anyone here know what an individual reporter should do? Is there an escalation ramp that exists but was so poorly marked that neither sloshnmosh nor Amazon support was able to find it? Does the ramp go through other organizations (e.g. report to CERT or some other org first and come back with a case ID)? Does the ramp not exist and need to be built?
Doesn't cloudfront generally act like cloudflare? Ie. We don't inspect your content. Law enforcement are the only people who can stop us hosting a site.
If you violate policy (of which there are likely many varied yet incontestable interpretations), AWS pulls the rug out from under you faster than one can say "neutral". That's excluding they do not make newer policies on-the-fly.
It has nothing to do with "neutrality", they have Terms of Service like every single service provider in the world. If you violate them, there goes your infra. Spreading malware is almost certainly a violation of AWS' ToS (Amazon engs, correct me if needed)
It's a little more complicated than that in Cloudflare's case. The debate isn't really relevant to AWS/CloudFront or anyone else, but Cloudflare has famously had a policy of not kicking off any customers as long as they abide by US law. The CEO publicly identifies as a free speech absolutist. (Malware/phishing/etc. is still removed, since it's illegal.)
The CEO publicly broke their policy on this on two occasions: the neo-Nazi website The Daily Stormer, and 8chan. In each case, only after a long saga played out.
For The Daily Stormer: after they mocked the deceased victim of the Charlottesville rally, Cloudflare received public pressure to boot them but refused, and then the owner subsequently tried to troll them/the public by claiming Cloudflare executives secretly supported their ideology, causing them to finally be removed. (https://blog.cloudflare.com/why-we-terminated-daily-stormer/
)
For 8chan: Cloudflare received a lot of heat for not removing them after the first and second incidents of posters becoming mass shooters, eventually removing them after the third mass shooting. (https://blog.cloudflare.com/terminating-service-for-8chan/)
I forget the term/aphorism for this (like "double-bind", sort of), but they put themselves in an awkward position because they're probably one of the most neutral service providers out there - still far more than probably anyone else to this day - but by marketing themselves as 100% neutral, being only 99.99999% neutral created lots of lasting negative PR that people still regularly bring up.
Any other company would've kicked those people off way sooner and there would've been little to no publicity, because they routinely do such things, but now Cloudflare is hated by both the pro-censorship and the anti-censorship crowd. (See: https://en.wikipedia.org/wiki/Cloudflare#Mass_Shootings and everything below. It's quite a rollercoaster.)
It's a gray area. They sometimes reverse proxy frontend portals for those services, but not the services themselves. Sometimes the frontend won't have anything obviously illegal.
Anything that's actively serving malware or phishing pages is removed.
clouflare stopped being like that long ago. they publicly posted that they will take down stuff they makes the ceo worry, and they will inspect what your users are reading/sharing - and notify agencies with powers and guns when they find stuff from now/then on.
- no longer a dumb pipe, no longer neutral, actually active in directing law enforcement to take you down and possibly take people out.
I just have to wonder if people downvote this thinking it's not possibly true, or they just don't like what is said.
Link to relative info is posted on another comment (https://news.ycombinator.com/item?id=27884821) - but for those who have not read it, here is an excerpt from a 2019 cloudflare post/statement:
"...what we have done to try and solve the Internet’s deeper problem is engage with law enforcement and civil society organizations to try and find solutions. Among other things, that resulted in us cooperating around monitoring potential hate sites on our network and notifying law enforcement when there was content that contained..."
So I stand by the statement, I can't see any other way to read it.
reason for "no longer a dumb pipe," - is that I believe that was the 'defense' aka reason being used for a while to push back against different groups that were accusing and then trying to public shame cloudflare;
for protecting alt-right(?) I know there were a few PR pieces pushed in the UK or Euro press about some things - maybe hookers or something..
anyway for a while cloudflare was all like, we are just a really big pipe that pushes data and can absorb ddos.. we don't get into content moderation or opposite-net-neautrality..
there were complaints that some groups 'on the right side of history (or whatever)' - were trying to take down the stormer site I think it was and that their co-ordinated takedown attempts were failing as cloudflare was protecting the send/receive, being a pipe, not a judge..
This is what I believe ATT was using as a defense some time ago; they don't stop drug dealers from making calls they just provide the 'pipe'
There was also some groups complaining about cloudflare making it hard to find servers - to find jurisdiction, again uk /euro I think - I have those articles saved on one of my systems.. and may be linked to a HN comment long ago - where I said chipping away at this pipe thine will lead to a bifurcated internet - where we will have internet place X internet place Y - and companies like cloudflare may have to turn into a dozen different companies to keep up with the changing 'this speech is not okay' rules for various places..
funny how fast things can change.
I believe many of cloudflare's early customers especially felt protected and safe because of the stances - and I bet most don't know about the 180..
I also think most average web people would think if you set 'whatever' for your DNS - that the dns routing is basically a dumb pipe - it's not spying on you and sending copies of your data to gun agencies.
Just as I think most people would not expect their cell phone company or internet provider to spy on data and send snippets of your communications to agents. I would not expect my web server co to deep packet inspect all comms looking for bad things. (not without a warrant and being directed to look at a specific line, now a whole data center / cell co, etc.)
I think it was a terrible choice to make for cloudflare, but I know not an easy one either way.
So 'pipe' is a term that has been used in this way for a while now in similar fashion I thought - and it's not meant literally like a copper water line.
Also in some ways cloudflare has been a pipe - a pipe for flowing data that would be choked by ddos attack if were to try to send/receive across the net in most other ways kinda of.
It feels like this is more a result of Amazon not being able to connect you with the right escalation path to verify & act on these claims than a considered decision to ignore them.
Those two things are actually the same thing, both are wilfully ignoring situations like this.
Never assume malice where ignorance and incompetence would suffice instead. Those two things are actually not the same thing at all, depending on how you define “willful.”
Yes, that is a good summary of Hanlon's Razor, a sort of corollary to Occam's Razor about mot creating unnecessary entities in your conceptual models.
Hanlon's Razor is a good first approximation or initial approach to a situation, not the end of the discussion. There are many situations where incompetence may appear to be an explanation, but is in fact not the root cause, and may even be being actively used as a cover for malicious actions.
The point of the razor is that it is up to us to sort out the difference, not to just jump to a conclusion that it is malice, or that it is incompetence.
In this case, Amazon has had plenty of time, resources, and skilled people to see the need and implement an escalation & resolution pathway. That they have so persistently failed to do so for so long indicates a cause beyond mere incompetence. Even if they are not being as actively malicious as the malware distributors, they clearly and actively DGAF.
> That they have so persistently failed to do so for so long indicates a cause beyond mere incompetence.
So you are claiming that they have had so many opportunities to do the right thing, that they aren't merely incompetent, but are in bed with the evil doers? That would be a huge claim, to say the least.
There are many options between incompetence and being actually 'in bed with', which I read to mean 'knowingly cooperating with', the criminals.
The first example is that it's simply more profitable for them to turn a blind eye unless one of the relationships becomes a public problem. They wouldn't be actively aiding and abetting the crime, but neither are they stepping up to ensure that it isn't happening on their systems. It's being complicit several steps beyond incompetence, but not the same level as active cooperation.
And, considering that Amazon has no shortage whatsoever of funds and skilled people to prioritize anything they want to prioritize, I'd say more than sufficient time has passed that they're at least at something resembling this sort of willfully ignorant stage.
How many FTEs should they have dedicated to triaging security complaints from (relatively speaking) randos on the Internet about their customers?
Also, would you take that job?
Some poor support person probably got this and punted because they couldn't pattern match to something in their handbook.
For every thoughtful, detailed security report there are about 500 others that involve voices from appliances, self-xss, csrf on logout and 5G coronavirus. It is extremely difficult for L1 support to make sense of these. Having a support contract or attracting attention on the forums are decent ways to pop out from the background noise.
Not to worry, they'll replace their overworked human staff with sentiment analysis bots which will do an equally uneven job of sorting the wheat from the chaff, with even less hope of appeal.
Malice is the wrong term for it even if we accept the premise. (I do not but that is another can of worms.) Malice implies a desire to hurt people. It would be utilitarian callousness if anything, negligence if there were legal obligations shirked. There is no law against just poor customer service like being a jerk isn't illegal.
To me, a negative response says "We have evaluated our policy and decided that we will not stop this." A non-response says "A frontline agent didn't know how to make a call on a non-downtime ticket from a non-customer so now it's in a bureaucratic black hole and nobody has actually read your email and probably never will." Which is still crappy, but not really malicious in the same way.
I’ve had government agencies claim it’s not a refusal/rejection if they refuse at the moment and claim you might (with no guarantee) have success if you try later.
More importantly, they are the ones that decide what laws are enforced.
What is sad is that in America, the law around surveillance and security is largely a nice marketing campaign. Sure, you have rights that protect you from the government.
But practically speaking the government won't enforce them, doesn't stop its employees from abusing them even for personal drama, undermines or stops dead any lawsuits by saying the discovery is impossible due to "national security", or will invent terms like "enemy combatant" and then apply them to its own citizens to bypass even the constitution. It will setup "oversight courts" that rubberstamp everything and have no real power or regulatory function/safeguard.
The result of this is that each presidential election is becoming truly dangerous to the opposition. If a McCarthyism movement takes over either party that's in power with the modern surveillance infrastructure, legal "precedents" established by Bush in the war on terror, the confirmation of those powers by the Obama administration holding onto them and continuing funding of infrastructure, undermining of judicial powers, rote acceptance by the people at large, and propaganda outlets available to push messaging, and huge amounts of institutional mores and standards thrown out in the Trump administration, the opposition has real motivation to feel an existential threat.
The Ministry of Defense has a strong inclination to approve any such requests. It's a hassle for the company in question, but the system is set up to encourage inflow of foreign capital to build up and maintain the defense industry.
In the same interview the spokesman said that some companies choose to avoid it by operating from offices outside of Israel (Bulgaria and Cyprus were mentioned). This seems to imply that the process is burdensome.
Their biggest customers are middle eastern governments according to the WaPo article. US certainly has bought the software but it's mostly Saudi, UAE, Qatar, etc. US has NSA so they don't really need some software. Middle eastern powers dont have the same type of technical expertise to develop their own in-house.
> So should we considered the NSA a terrorism-aiding organization
This statement needs the "we" defined to be meaningful.
If it is the U.S., then obviously no, the NSA is an arm of the state. If "we"` is e.g. China, probably no, because words have meanings and the arms of recognized foreign states don't conduct terrorism, they do espionage and they do war. If "we" is a freshman dorm room, then, of course, the NSA is a terrorist organization alongside the student government.
> > So should we considered the NSA a terrorism-aiding organization
> If it is the U.S., then obviously no, the NSA is an arm of the state.
Its perhaps worth noting that “terrorism” originally exclusively denoted action by the State against its own subjects, though it was within a few years expanded to include other activities.
> “terrorism” originally exclusively denoted action by the State against its own subjects
Correct, in the French Revolution, I believe. There are a variety of definitions of terrorism. The common elements seem to be the (a) peacetime use (b) of violence (c) against non-combatants (d) as a political tool. There also seems to be an unspoken requirement that it occurred after the formation of modern states (otherwise almost all of the preceding human history was terrorism and the word gets normalized); the French Revolution is a useful line.
The NSA targets non-combatants (c) in peacetime (a). It does not use violence (b), though it does enable it (⅓b). It does not do so for domestic political aims (to any proven degree); the degree to which it does so abroad depends on where one draws the line between politics and geopolitics. (The CIA, in contrast, engages in all four overseas.)
When an organization that has done terrorism becomes a terrorist organization is another question.
> If it is the U.S., then obviously no, the NSA is an arm of the state.
Some here in the states don't exactly feel like the people running the USG have the people's best interests at heart. Common folk across countries probably have more in common with each other than with the ruling elite.
State-sponsored terrorism is a thing - and has been for a LONG time. And US citizens are targets as well as non-citizens.
There is a community on reddit called "self-aware wolves" that narrowly identifies a much broader phenomenon: there are many elements of modern society which are generally tolerated but not morally permissible. This is a representative instance.
There would need to be some actual violence involved to constitute terrorism. If you spy on some journalist and then us that info to catch him and cut him in pieces while he's still alive, then the dismemberment may be considered terrorism and the spying was aiding that terrorism; if you spy on many people and the end result is just that some officers laugh about their naked photos or deny them jobs or disallow crossing borders, then that's just "ordinary" mass surveillance with no relationship to terrorism.
The NSA does not illegally spy. Congress has given them large authorizations to collect data and they need FISA approval before tapping Americans. 99.9% of the good work that NSA does will never be seen by the public.
1. There are many, many more Western countries other than the US.
2. Even if they develop their own tools and research their exploits, using NSO provides a layer of plausible deniability and hiding behind someone else's fingerprint (think about the command and control servers, for example).
3. Even if they develop their own stuff, most governments have multiple arms which can use these tools (think about FBI, CIA, NSA, various military intelligence branches), and they tend not to share between them. This makes smaller government branches which don't have the resources and expertise of the others (think DEA, ATF...) buy from 3rd parties.
4. Zero days are a scarce resource, if I ran an agency I'd rather use someone else's every day and keep my own just for the special stuff.
In summary, it's exceedingly appealing for bodies like the Dutch police to use NSO tools and NSO's association with the Saudis and other provides a convenient masking to their operations.
Anyone notice that this statement from NSO in the article doesn't make sense:
"NSO does not operate its technology, does not collect, nor possesses, nor has any access to any kind of data of its customers."
If this is true, how do we have a singular list of all phone numbers penetrated? If there was this type of "segmentation" or firewall between NSO and its clients, why was there this huge central data leak?
NSO is tracking what its clients are doing. It may not be telling its clients it is also tracking them. I wouldn't be surprised if NSO could also access every one of those penetrated devices as well independently of its clients.
They are trying to claim that the service is so fully automated that it is the client that does the selection of the target. They claim that their system does not require any fine-tuning from their side, etc.
“It should be noted that no ethically-trained software engineer would ever consent to write a DestroyBaghdad procedure. Basic professional ethics would instead require him to write a DestroyCity procedure, to which Baghdad could be given as a parameter.”
- Nathaniel Borenstein
It could mean that NSO controls the infrastructure that manages the tool, but that they don't actually collect the data themselves. So what they said could technically be true if all they do is manage the infrastructure that enables their clients to do the collection of data.
But do they have access to the phone numbers that their customers are targeting? That seems by itself to contradict their statement ("nor has any access to any kind of data of its customers") right there.
If we assume they aren't lying, which is generous given their track record, it could be that they provide the tools and infrastructure to collect the data, but don't instruct the software to collect the data. Sort of like if I had a loaded gun and told you I would point and shoot it where you told me to, and then argued that I didn't technically make the decision. It's technically true and complete bullshit.
They could be lying, or they could just be trying to use weasel words. "Data" could be referring to collected data, and they consider phone numbers "metadata". I haven't been following the story though, so I don't know which is more likely.
Thank you. I was trying to understand this myself.
NSO seems to be trying to distance themselves from how its software is used by its "clients," but that seems undercut by the plausible supposition that NSO knows exactly who its clients' targets are.
> The Amnesty report said NSO is also using services from other companies such as Digital Ocean, OVH, and Linode ...
We've been using Digital Ocean for a few years now (sqlitebrowser.org), and they've been really good. Hopefully they look into this and take some useful action. :)
I have to say I'm not surprised that NSO and similar entities are using any CDN/large-scale hosting company they can find. The bigger the better, and spreading their stuff around as widely as possible with as much obfuscation in server purpose as possible. Such things are impossible or problematic to block/null-route without breaking many other things hosted at same AS.
I see you 'helped build' Digital Ocean, so I can understand your personal reasoning, but really - it's not at all important to anyone else.
Also, wasn't that a bit of a fad back in the late 90s early 00s? I know my wee business followed the path of concatenating words for brand ...something... , but I honestly couldn't care less how other people deploy it in their own space, as long as they remember the name.
Of course, some people might choose to reply "Oh I see you worked on DigitalOcean! Funny people care about something like that, but given another human does, I'll respect that!" Some might chose to reply "I can do whatever I want, I don't really care what you think" - people can choose how they react. It's always very interesting to me who choses what, it's very telling regarding personality. I am well aware people are welcome to do as they please, nevertheless, the name of the company is "DigitalOcean" not "Digital Ocean".
The replies to my comment generally simply serve to remind me of the quality of humans in this community, I'm certainly not sure why I waste my time contributing to it.
My pet peeve is publications spelling NASA as Nasa. They've come up with some story to explain their decision that sounds just as bad as some of the lies Walter White told. I don't care how ubiquitous NASA maybe, it is and always will be an acronym. I accept removing the dots so it's not N.A.S.A., but I will only accept Nasa as a formal name if that's the name of a person.
How do you feel about "scuba" or "laser?" Acronyms that are pronounced like they're spelled (eg, Nasa, gif, taser) tend to end up being spelled like words sooner or later instead of being in all caps.
Personally, I don't write SCUBA or scuba, as it's just not part of my day to day conversation, but I would go with SCUBA. Also, it's never just laser or LASER, it's friggin LASER!!! Pew Pew!
Ironically, I'm the same way with "PostgreSQL". There used to be _so_ many weird mis-spellings of it. eg "postGreSQL" seemed to be popular for some unknown reason
There is another point if view, and that is that corporate marketing should not take precedence over correct use of language.
Some languages tend to be more strict about this. I think it's particularly common to see English play fast and loose with the language compared to other languages.
In Sweden, for example you will see media write Iphone, because it's a name, and names are capitalised.
The same goes for Digital Ocean, or Digitalocean if you prefer. It can definitely be argued fairly that the writer does not have to break language conventions just because a company says they have to.
Exactly. Language is for all its users. I can insist that my name be rendered only in 14.5 pt Comic Sans colored with Pantone 19-3336 ("Sparkling Grape"). But people get to decide for themselves how they're going to speak and write. Corporate branding guidelines constrain only their employees and people who want to curry favor with them. Everybody else can do as they please.
Good point that everyone else can do as they please.
Moreover, this can be a big problem for the corps, and it is up to the Corp to protect their trademark and prevent everyone from doing quite as much as they please.
If people start using a trademark as a generic term too much, the trademark can be lost. There are legions of examples, starting with aspirin, escalator, dumpster, etc. [1]. So, they try to insist that it be used only the (TM) or as "Acme Brand widgets". It would not surprise me to see Google end with the same fate.
> Corporate branding guidelines constrain only their employees and people who want to curry favor with them. Everybody else can do as they please
What a weird take on why you should spell a company name correctly.
Correct, nobody is going to put you in jail for misspelling Digital Ocean. You can do as you please. But everyone else is going to think you don't know what you're talking about if you can't even get their name correct.
Dang. Everybody else! That's a lot of people. You must have done a great deal of work to check with them all, so clearly I have to yield. I had no idea the entire rest of humanity was so passionate about corporate branding guidelines.
Oh no! Now an internet random thinks I'm cringe. Since we're criticizing other people's language choices today, I'll mention that everyone (absolutely everyone) thinks nobody older than 14 should use that word.
Seriously, bub, my problem isn't the hyperbole. It's that you're universalizing your personal preference as a way to try to dominate people. It might work on others, but you won't find an old software developer who minds being called "weird". We were all thought weird.
> I'll mention that everyone (absolutely everyone) thinks nobody older than 14 should use that word.
Now you get it! It's kinda awesome I got to teach you a rhetorical device and you picked up on it so quickly.
> It's that you're universalizing your personal preference as a way to try to dominate people
My comment was dominating to you? Damn, I'm sorry.
> It might work on others, but you won't find an old software developer who minds being called "weird". We were all thought weird.
What does you being socially awkward have to do with this? You still need to spell company names correctly, regardless of whatever behavioral issues you have.
The media in Sweden use both by the looks of it. They do that for IKEA as well but it doesn't really make sense imo since it's an abbreviation of names. Both are made up language constraints anyway so I don't really see why the typographic rules of a language are more important than the equally artificial typographic rules of a company name.
You will definitely see both. You'll see things like Iphone being written by media sources that pride themselves on good writing, such as Dagens Nyheter.
If you go to https://sv.wikipedia.org/wiki/Ikea the first sentence can be translated to English as: "Ikea Group, written by the company as IKEA Group, is a multi-national furniture company founded in 1943 by Ingvar Kamprad"
Words such as TV started out in upper case because it's an acronym, but once it becomes a normal word, it's written in lower case.
They still write Iphone X, why not Iphone x? or Iphone 10? or Iphone tio? Roman numerals aren't really a part of the Swedish language after all. They write IOS or iOS, why not Ios? Is this not a normal enough word? It's just artificial rules replaced by a different set of artificial rules. Why not just use what everyone else uses, haha.
A bit of a meta discussion in a thread totally unrelated to this, sorry about that.
I think we're drifting away from the original point, which is about not letting corporate marketing departments decide how the written language should work. I used Swedish as an example of a language where this is a more firm rule than English, but Swedish is certainly not alone. It just happens to be the language I know best.
But, I do find the topic of Swedish writing standard to be interesting, so I'll be happy to do my best in responding to your questions, even though I'm not formally a linguist (although I was raised among them)
With regards to your question, I'd write Ios, because it's not an acronym and I do believe that I'm not alone in this. About the version number, I find at least one case of the use of Ios 10 at Svenska Dagbladet: https://www.svd.se/apple-har-atgardat-problem-med-ios-10/om/...
However, it seems to be highly inconsistent, and this is probably caused by these organisations saving money on proof readers.
> which is about not letting corporate marketing departments decide how the written language should work
Why do you keep repeating this? You say you were raised among linguists, but you're getting the most basic tenant of linguistics wrong. There is no such thing as "correct" language.
But more to the point, language allows you to write proper names as though they are registered or defined. It is not incorrect to spell it DigitalOcean, because that's the registered name.
If my name was JoeBob, you don't get to split up my name just because you think English requires it.
> There is another point if view, and that is that corporate marketing should not take precedence over correct use of language.
There is no such thing as correct use of language. That being said, you should spell proper names as they are registered. It's iPhone, not Iphone.
> It can definitely be argued fairly that the writer does not have to break language conventions just because a company says they have to.
Language convention is to spell the name as the company as it is registered. You wouldn't change someone's last name because it didn't follow some other, slightly related convention...
You can actually flip that argument on its head - that maybe Digital Ocean was intended,but because a URL cannot contain a space, we ended up with a space-less version.
If someone were to use NSO paid hacking to attack Apple executives's devices and then release everything they found, I bet Apple might take this more seriously instead of having some PR flack write marketing copy. Same is true of any tech company: until it hurts them specifically they can just ignore it or make it sound innocuous. Maybe Amazon has been targeted and they found out.
If someone were to use it against US government entities, maybe the NSA/CIA/etc might decide enough is enough, no matter what country they are in. So far at least publicly it seems like a non-event. But once the phone numbers are identified from that leaked list, things might become more serious for NSO.
People used to fight real wars against adversaries who targeted their country in some way, why should commercial entities supporting such attacks not be treated the same, except via non military action? Spying has always been done, but it can lead to serious consequences.
> If someone were to use NSO paid hacking to attack Apple executives's devices and then release everything they found, I bet Apple might take this more seriously instead of having some PR flack write marketing copy.
That's not why Apple is skittish about this. Any action from them would invite the question "What about China?". And Apple loves China('s money).
Take security a lot more serious than they currently do. They've had some seriously embarrassing security holes in their software the last few years.
Also, they could increase the payout for their bug bounty. Why report to apple for a 0-day when you can make $1 million from these guys? It's not like Apple doesn't have the cash.
> Take security a lot more serious than they currently do.
That statement doesn't mean much. How do you know they're not taking it seriously enough and still struggling with the enormity of the problem regardless? You could always claim any entity isn't taking security serious enough.
The alternative explanation makes a lot more sense: security is extremely difficult at Apple's scale, serving a billion consumers with complex and essentially always-connected electronic devices (not to mention their huge services business now). Devices that also happen to be one of the single most important attack points that there is.
They could attempt to slow down the ad-ridden stupidity train they have everyone riding on, believing there is no such thing as iphone security tools besides the steaming iOs UpDaTeS
Apple takes security more seriously than almost any other vendor in the entire world. It's in a small club of vendors that operates at the literal frontier of what computer science knows about building security into commercial products. No reasonable argument about what Apple can do start from the premise that they don't take the problem seriously.
They aren't above criticism. They do some things well that Google doesn't do as well, and vice versa; it would be good if everyone could level up to highest standards set by any in the club. It's totally fine to point these things out.
As for the bounty payout thing, I highly recommend you track down a talk from someone that has run a vulnerability/exploit market; there are a couple. The economics of selling vulnerabilities to the grey market are nowhere nearly as simple as they appear in ordinary message board threads. In particular: Apple offers a fixed, lump sum payment, where every market I'm aware of offers tranched payments that end when a vulnerability is burned.
Didn't Bloomberg ruin their tech reputation with the still-unproven (years later) and probably baseless claims of nano chips planted in the supply chain of Supermicro ?
People keep asking that. Seems like every few weeks for however long it's been, I see a comment like yours.
I haven't seen anyone mention what news source meets the standard of never having published an article with insufficient evidence according to one or more people on the internet.
I mean, obviously not the NY Times, for instance, right?
A good news source would retract their initial article(s) when experts debunked them and nobody could corroborate, not double down with even less evidence.
The combination of: the absolutely terrible article being an obvious hit piece, the potential damage of the claims with almost no real evidence to back them up, and the complete lack of contrition or accountability.
I don’t think it ruined Bloomberg’s reputation entirely (I still love and frequently read Money Stuff), but it did eviscerate any credibility they had in highly technical, investigative technology reporting. And the refusal to admit the failures publicly definitely calls into question their editorial process and organizational culture.
Also, the idea that ‘thing x’ shouldn’t be criticized because ‘thing y’ is also bad is pretty clear “whataboutism” and an unhelpful way to address valid criticism.
Whataboutism is when someone deflects accusations against themselves by pointing to others. I am not Bloomberg nor do I work for them, and accusing people of being shills is mentioned in the HN guidelines as being discouraged.
What concrete proof does your article have? Bezos literally has access to his phone and the text that MBS sent him, containing the exploit. You're going to take some conspiracy theory based on rumors over the analysis of the actual phone that was hacked?
The affair and all those things are probably true, but that doesn't really negate the fact that he was most likely also hacked by MBS.
Frontline (PBS)in partnership with Forbidden Stories are doing a report [1] on NSO hacking the phone of Khashoggi’s fiancé and other journalist and activists around the world.
Looks like her phone was compromised by NSO based on the reporting on this video.
> De Becker then commissioned an examination of Bezos’s iPhone X. The eventual report by Anthony Ferrante, a longtime colleague of de Becker’s and the former director for cyber incident response for the U.S. National Security Council, concluded that the promotional video about broadband prices that MBS had sent Bezos the previous year likely contained a copy of Pegasus, a piece of nearly invisible malware created by an Israeli company called NSO Group. Once the program was activated, Ferrante found, the volume of data leaving Bezos’s smartphone increased by about 3,000 percent.
> The eventual report by Anthony Ferrante, a longtime colleague of de Becker’s and the former director for cyber incident response for the U.S. National Security Council, concluded that the promotional video about broadband prices that MBS had sent Bezos the previous year likely contained a copy of Pegasus, a piece of nearly invisible malware created by an Israeli company called NSO Group.
Key word in that sentence: "likely." AFAIK, nothing has been proven beyond rumor and conjecture, which isn't proof of anything at all.
Did they find the Pegasus or related code on the phone, or not? That is a yes or no answer. Likely?
I was thinking exactly the same thing. Given what we know about this hack — a Whatsapp or iMessage essentially taking over his whole phone — this seems plausible.
It's not a contradiction. Whoever would have ordered NSO or similar actor to hack Bezos' phone is probably after more juicy info than a dick pic or at least wouldn't leak it for 'lulz' and thereby revealing that the phone is compromised somehow.
I am willing to bet money that NSO Group has multiple AWS accounts, many under several layers of cover.
You can't really spin them up with any significant quota on short notice (ask me how I know, AWS service team) so having established ones with workable limits in advance across multiple cloud providers would be table stakes for any competent spying organization.
NSO (and its infrastructure) are the vulnerable single point of control. That's in fact part of the service they're offering, whether they realise it or not: outsourcing blame, exposure, culpability, and liability. Something like how a re-entering spacecraft is fitted with a sacraficial ablative heat shield. The shield's job is to absorb punishment, often destroying itself in the process, protecting the more valuable payload.
The problem with this model is that NSO are, as with heat shields, replaceable. A new target will appear to take its place.
But that too will draw attention, it will have to assemble talent (leadership, engineering, sales, operations), and will itself have vulnerabilities. As I suggested in a thread yesterday, playing in the field of dirty ops raises prospects for piercing the corporate shield of liability for all those involved: the firm, its personnel, investors, creditors, suppliers, and where identifiable, clients.
Given how much care they took not to write the payloads to the phone storage, presumably they took the same care not writing it to server storage on cloud hardware.
Isn't NSO just a poor-man's NSA, since the NSA can force Google/Apple/Microsoft/Amazon/[Any Carrier] to do anything to any number of devices or data, and in secret?
NSO is used to keep those with money and access to NSO in power undermine their legitimate rivals. It can be used to plant evidence on their devices as well as monitor everything they do.
To clarify, are you arguing that NSO Group have had a bigger impact on innocent people, suppression of speech, etc. than the NSA?
If so, I'm not sure I buy what you seem to be arguing, that "NSO case in India" and "It can be used to plant evidence" makes it anywhere near as bad as what the NSA has done/does. In my opinion this is exactly how a "poor-man's NSA" would look: What your money can buy from greedy corporations protected by nasty governments.
>legitimate opposition
Who decides what is legitimate though? It sounds like weasel words to me, just like "terrorists" (that get defined by those in power and then maybe later becomes revolutionists and heroes if they actually win). Going after Snowden, torture in Guantanamo, and using three letter agencies for industrial espionage is also "legitimate".
> arguing that NSO Group have had a bigger impact on innocent people, suppression of speech, etc. than the NSA?
I'm not the OP, but maybe a way to put it is that impacts are more variable or chaotic?
Generally speaking, the "impact" of a US government entity is reasonably predictable based on US policy and interests. Something like NSO, where tools are sold on the market to many entities are probably less predictable and thus more impactful. I'd expect a lower level of operational discipline from <random mideast state> than from the US military.
The other factor is who are NSO Group's masters, and what do they know? If <random mideast state 1> compromises <random mideast state 2>, does <third party> get intel?
On the contrary, a rejection rate that low implies rubber-stamping, prima facie. You would need positive evidence to support your assertion, e.g. that FISA submissions are unusually high-quality. The actual case is, I am sure, that the system was constructed to make allowing the warrant to be easy, rejecting it hard, and the people involved are just responding to incentives. Namely, since it's all secret they are only accountable to each other, so why give each other a hard time?
>a rejection rate that low implies rubber-stamping, prima facie. You would need positive evidence to support your assertion
I've deftly avoided ever taking a class in statistics, but I have gathered there are two schools - Bayesians, who are honest about having priors, and everyone else.
Intelligence agencies don't force people to do things, their operations are covert. It's the DoD/FBI that will force things and issue gag orders. Think of the intelligence agencies as Ninja, and the FBI/law enforcement as Samurai.
>Shouldn’t there be an outcry against the suppression of free speech?
Only if someone was one of the many people who don't understand what Free Speech is or incorrectly think of rights only in terms of themselves and people they like, not for those who they don't. In this case, Amazon is exercising their own Free Speech rights. Free speech necessarily (and as a matter of law) means the freedom to not speak and to not associate with other people. If I want to lend my support to a specific candidate with a sign in my field, I necessarily must have the right to refuse signs by everyone else. If the government puts a gun to my head and forces me to let every single candidate put a sign in my field, then the effect is no special endorsement for anyone and a flagrant violation of my free speech rights.
Someone denying another person the use of their own private property because of disapproval over their behavior doesn't generally mean any free speech issues, quite the contrary. As always there are certainly very rare edge cases, but none of them apply to a situation like this. Amazon refusing business to someone due to their race or gender or the like would be a problem, but "spies working with authoritarians" is not a Protected Class.
>What jurisdiction’s laws were broken by this company?
Why would that matter? Amazon isn't the government. They aren't threatening with force/arresting/jailing/killing the NSO Group, just refusing to continue their business relationship. So they aren't restricted to caring about only illegal behavior. In fact a core part of the whole point of free speech is to move consequences into the realms of social and economic, rather then force, not to eliminate all consequences entirely. There are a few limited legal instances they can't discriminate over. Otherwise they can deal with whomever the hell they want.
This is not even a free speech problem in the first place. We are talking about actions. To draw up an analogy: If I own a gun store and I sell you a rifle and ammunition because you want to hunt deer and I learn that you started shooting at journalists instead, I can decide to stop selling (an act) you further goods because of your actions.
As pointed out elsewhere, this is a business relationship.
In any case, the grave human rights violations that are the result of the use of Pegasus - including loss of life and liberty - weigh much more than an abstract notion of a corporation's freedom to act and impose their will on other corporations.
I don't understand the line where lots of people are seemingly outraged about people using online platforms to disseminate propaganda and extremist materials. (ie. most recently Google Drive)
NSO group seems to be a not-so-nice company. But why does what they do justify blackballing, while similar companies (say BlueCoat or any of a dozen companies that provide solutions to hack on behalf of the police) are ok?
You're going to have to be more specific than a handwave-y "lots of people" to have good online discussions. You also need to be specific in your terminology. You need to actually address the specific people and their arguments, or else do a much better job of phrasing an inquiry into theoretical tradeoffs. Ie., from your other reply:
>What I don't understand is why AWS is justified to shut them down; but Google or Facebook is not justified in preventing their platforms from being propaganda distribution channels?
So I do in fact think Google and Facebook at 100% "justified" to shut them down, and I think Amazon is too. I do have lines where I think morally, if not legally, a service can start to drift into quasi-governmental (or perhaps should be that way) territory. An example for me would be core physical infrastructure companies, not just at Tier 3 but also at Tiers 2 and 1. I think those should operate as common carriers. But I don't think social media fits. Not using it at all (as I don't) may have "costs" in terms of social opportunities but alternatives are trivial.
So for me there isn't any dissonance here, I generally support "Big Tech" (and everyone down the ladder) associating as they see fit when it comes to ongoing online service relationships within existing jurisprudence. The initial legal tweaks I'd like would be aimed at things like expanding user power in a purely additive way (like giving people the option to access root hardware/software key stores), or internalizing costs some companies are shifting onto the public, rather then beating down what some people don't like.
Hacker News (and every other forum) aren't hive mind and it's silly and tiresome to have them treated that way. What you did in your first post here was essentially throw up a big silly strawman.
>Corporations aren't humans; they don't have free speech rights.
As a matter of law in the United States you are objectively wrong. This has been settled in a series of SCOTUS decisions starting with Buckley v. Valeo (1976). Corporations are legal persons, and further the individual humans that make them up do not somehow lose the free speech rights just because they decide to take collective action.
And in turn: as a matter of morality, common sense and the point of free speech you're also wrong. It's important that people be able to speak to power, and a core part of that for humanity is socializing, being able to form groups to support each other and pool ideas, skills and resources to have a greater effect than what any individual alone could accomplish. Seriously, you say "corporations don't have free speech rights"? Exactly what form of combined effort do you imagine most, say, NEWSPAPERS are organized under? So what, you think individuals should be able to investigate something all by themselves, but the government should be free to put the boot down on newspapers because they're corporations? You think that jives with free speech?
Oh maybe you only meant "the bad ones". That makes it very easy, but no reason to limit it to corps in this case, just stop "the bad humans" too and everything is great. Nothing could possibly go wrong with that plan, since everyone agrees who "the bad ones" are.....
> It's important that people be able to speak to power, and a core part of that for humanity is socializing, being able to form groups to support each other and pool ideas, skills and resources to have a greater effect than what any individual alone could accomplish. Seriously, you say "corporations don't have free speech rights"?
The people in many corporations in fact lose their free speech rights and have to follow the company line. Granted, they agreed to that in their employment contract but this is in many cases a coercive relationship.
> Exactly what form of combined effort do you imagine most, say, NEWSPAPERS are organized under? So what, you think individuals should be able to investigate something all by themselves, but the government should be free to put the boot down on newspapers because they're corporations?
Well, the individual reporters could still be free to exercise their free speech rights without conferring any right on the newspaper itself.
> "As a matter of law in the United States you are objectively wrong."
You are quite correct, of course. I meant to write "shouldn't" instead of "don't".
> "So what, you think individuals should be able to investigate something all by themselves, but the government should be free to put the boot down on newspapers because they're corporations?"
I'll point out that there's an entirely separate and intentional carve-out for freedom of the press that is distinct from freedom of speech, so that's not a good justification for corporations to get freedom of speech as a right directly.
>I'll point out that there's an entirely separate and intentional carve-out for freedom of the press that is distinct from freedom of speech
Not really as a matter of law we're talking about here. "The press" isn't some special legal entity, there's no licensing for it or anything. Absolutely critical press victories like NYT v. Sullivan were based on freedom of speech protections.
But whatever, so you don't want Mozilla Corporation to be able to advocate for Firefox if the government doesn't want it to because Google managed to lobby successfully? No company can come out in favor gay rights or Pride Day if the government doesn't want them to? You're fine with with the government being able to punish companies for arguing against encryption backdoors? And what about the individuals at those companies, if the CEO speaks about those things is that the company speaking and punishable or is it ok if he says "this is my opinion" first every time? What about employees?
Like, we can go through a million examples here if you want but I don't think it's that hard to see how maybe government might abuse that just a little bit.
>"The press" isn't some special legal entity, there's no licensing for it or anything
This is one of those things that's plausible and common enough to read on the internet that it makes me worry about alternate universes intersecting.
If you type "credentialed members of the media" into Google, do you see any results, or is it just me?
Another key phrase I find is "reporter's privilege" relating to state laws to shield the press, which, as you might imagine, requires defining what a reporter is.
"Some privilege schemes are narrow and apply only to full-time employees of professional news outlets, while others are broad and extend to bloggers, filmmakers, freelancers, book authors, and student journalists. In other words, some are inclusive and others are exclusive."
they absolutely do have free speech rights in the United States. Also, if NSO was hosting malware on AWS resources, it's almost certainly against their terms of service..
Not convinced that using the service to distribute malware, on behalf of odious third party governments for antidemocratic purposes, is protected by free speech demands. It's not speech, is it?
Sure, and it "seems like" the extremist propaganda that Big Tech shut down was violating all sorts of other laws like incitement.
Is "seems like" enough of a reason now for private companies to choose not to contract with other private companies? Or should we go to a judge and jury in both cases?
>Sure, and it "seems like" the extremist propaganda that Big Tech shut down was violating all sorts of other laws like incitement.
Most of it actually wasn't FWIW, hateful extremist content is generally perfectly legal free speech. "Incitement" gets used way, way too often on the internet, almost nothing that gets posted online is legal incitement. But neither "Big Tech" (such a dumb term) nor Hacker News nor a random forum on birds needs any violation of law or anything else to moderate what gets posted on their sites. It doesn't have to be "negative" or whatever at all even. There is nothing illegal or objectionable about someone who likes discussing trains for example. But if you post lots just about trains on a birder forum they may delete all your posts and ask you to stop because they want to focus on birds, and if you continue to do so they can delete everything and ban you. Why would there be anything wrong with that?
Private society looking at extremist content and saying "we're not going to shoot you over it but we do strongly object and we're going to socially ostracize you and deny you business and our support in any way we can" is free speech working as intended.
>Is "seems like" enough of a reason now for private companies to choose not to contract with other private companies?
Uh, yeah? People can refuse to do business with each other for nearly any reason at all, and definitely for anything other people merely say or do (at least, within the bounds defined by any existing contracts, but Amazon has covered its bases pretty well there to put it mildly).
> "Private society looking at extremist content and saying "we're not going to shoot you over it but we do strongly object and we're going to socially ostracize you and deny you business and our support in any way we can" is free speech working as intended."
Given that such logic was once used to attempt to deny service to and harass PoCs, religious, LGBTQ and other formerly "undesirable" classes, society clearly doesn't buy that logic and made them into protected classes and required businesses to serve them on an equal footing. It's not a valid argument unless you're arguing to roll back protected classes too, which I hope you're not.
(Note that I'm not defending NSO or Amazon here. I concur with others that NSO isn't engaging in speech, so while there may be a contract law issue between them and Amazon, there is no freedom of speech issue here.)
>Given that such logic was once used to attempt to deny service to and harass PoCs, religious, LGBTQ and other formerly "undesirable" classes, society clearly doesn't buy that logic and made them into protected classes and required businesses to serve them on an equal footing.
No, that was not the logic, businesses were not discriminating based purely on speech and choices of content. That's the point. I mentioned Protected Classes, but those are about entire classes of people and things that are innate to their personhood. Skin color and sex/gender being obvious ones, but disabilities either at birth or acquired later in life still are innate aspects. We've decided that public businesses as part of the privileges they have may not discriminate and rightly so.
But none of that has anything to do with actions and expression, and indeed a core part of the point is that all protected classes are in no way "inferior" or less capable of reason, argumentation, responsibility, social activities and so on! No one is born with some political alignment, as humans we all have to develop that ourselves.
>* It's not a valid argument unless you're arguing to roll back protected classes too*
No, because the worldview you've come to about given issues, morals and so on have nothing to do with protected classes.
Religion is not innate, nationality is not innate (cf. the discriminatory "Help Wanted. No Irish Need Apply" signs of the 19th century), and while sexual preference may be innate, expression of it can be consciously restrained as demonstrated by all those people who suffered from being "being in the closet". Does not being innate mean these protected classes should not exist? Clearly not, so appealing to innateness does not rescue your argument.
To be clear, I'm personally all in favor of Amazon choosing who they want or don't want to contract to. But the comment I was replying to was saying it's only okay (as in, good for society, I guess) for Amazon to kick off NSO because Amazon thought they were violating the law. I agree most extremist content is legal free speech, but not all of it is, which should be enough reason, by that rule, to kick off extremist content.
I'm simply agreeing with the comment at the top of the thread - all the outcry we usually hear about private companies being too powerful should apply here too. (My opinion is there should be no outcry about either.)
> Most of it actually wasn't FWIW, hateful extremist content is generally perfectly legal free speech. "Incitement" gets used way, way too often on the internet, almost nothing that gets posted online is legal incitement. But neither "Big Tech" (such a dumb term) nor Hacker News nor a random forum on birds needs any violation of law or anything else to moderate what gets posted on their sites. It doesn't have to be "negative" or whatever at all even. There is nothing illegal or objectionable about someone who likes discussing trains for example. But if you post lots just about trains on a birder forum they may delete all your posts and ask you to stop because they want to focus on birds, and if you continue to do so they can delete everything and ban you. Why would there be anything wrong with that?
I don't think anything is wrong with that.
What I don't understand is why AWS is justified to shut them down; but Google or Facebook is not justified in preventing their platforms from being propaganda distribution channels?
Specifically here on HN, people were outraged about Google's actions, but at the time I posted my original comment, nobody seemed to be upset about AWS's actions against NSO, at all.
Isn't the line due process of law, though? If NSO is allegedly committing a crime, then we can punish them in courts of law that are empowered and qualified to investigate the allegations fully and decide whether to deprive them of their rights. Why would we put these decisions in the hands of Big Tech?
At least, that's what I heard during the debates about deplatforming Parler. It was apparently very bad for private companies to decide that a customer was engaging in distasteful but legal actions. What is the principled argument that it was not okay for AWS to take down Parler but it's okay for AWS to take down NSO?
For state actions, yes. For private actors, if I suspect someone is using my services to break the law or engage in terrorism, "but your honor, I didn't have a court order confirming they were terrorists" won't cut my liability.
Parler was a free speech question because it was almost purely speech. NSO Group isn't just speaking. It's doing, and it's doing things that will bring liability for people around it.
> So then the question becomes Did Amazon let police gather evidence before touching anything?
Why does that become the question? If I fire a customer, must I ask the police for permission first?
America isn't a police state. And we don't have general data retention laws. The First Amendment contains both the freedom of speech and freedom of assembly; there is a balance between Parler's freedom to spew rubbish and Amazon's freedom to not assemble with them. With NSO Group, the free speech question is sharply constrained; Amazon's rights are thus stronger.
When you changed it. To use your own words, if you "suspect someone is using my services to break the law or engage in terrorism" and you then delete all evidence then you are absolutely tampering with evidence. If AWS was used to DDoS all hospitals in the US and people died, would you see a move by Amazon to delete all trace as just fine and dandy "because the US isn't a police state"? I doubt that. It doesn't matter if it is a small or big crime; knowingly deleting evidence is a crime too.
AWS ain't a law agency. They just decided to boot this organization out of their infra. Fair enough. AWS simply decided they don't want to benefit financially from this organization's operations.
I dunno. NSO group is extremely capable. I know a lot of folks go back and forth on the “if you don’t want X vendor to shut you down then go build it yourself” and for various reasons. But in the case of NSO group I feel like AWS cutting them off is probably more of an annoyance than anything else. They’re gonna be ok.
Possible. But they rely on the infrastructure AWS, Linode or DigitalOcean provide in order to fly under the radar among legitimate traffic. If all of these service providers were to blacklist NSO, Candiru or Cellebrite those would have to fall back to more exotic providers and would therefore be easier to uncover.
This script also pushed ads for a fake AdBlock app that was a dropper for banking trojan apps.
Amazon refused to do anything about it.
More info:
https://forum.xda-developers.com/t/massive-mobile-advertisin...