The problem is to define "demonstrate" and the criteria. Remember the gatekeeper is now an unemployed gal who "know lot's of things about cyber security" according to her main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter...
Yes, security through obscurity isn't security, but this also seems incredibly irresponsible for any "security researcher". AFAIK, just basic standard good practice is to report the flaws and allow a reasonable interval before publishing, and there seems to be no hint of this.
Modern society really is held together with duct tape, baling twine, and a few pieces of bubble gum...
>>Remember the gatekeeper is now [...] unemployed [...] who "know lot's of things about cyber security" according to [its] main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter...
Good to see that; thanks for digging deeper. I hope he has done this behind the scenes and the holes are patched, because I'm sure that by now, someone with worse intent has already followed those footsteps...
> CommuteAir added that the server, which was taken offline prior to publication after being flagged by the Daily Dot, did not expose any customer information based on an initial investigation.
If TFA (may not be accessible right now) is to be believed, “the” server is a very generous understatement of the size of the exposed infrastructure, and customer information was very much accessible if not accessed per maia’s words. So seeing a statement like this from the CommuteAir PR people actually makes me feel less reassured, not more. (The attacking side looks better so far—maia itself is not a “watch the world burn” type, judging from its breach history, even if its writing makes you wonder whether the absurdist parody is deliberate or the author is in fact slightly manic. Kind of like Justine Tunney.)
> Stealing source code and making it public isn't really helping anyone, most likely this is just an ego-inflation bragging exercise... A lot of these so-called hacktivists claim noble goals but then it later transpires to be down to other more selfish reasons,
There are a lot of ways a hacker can get attention and gain notoriety to inflate their ego. They could be causing harm to people, breaking things, causing chaos, and spreading lies. There are a lot of invisible whitehats around doing good out there. The evil stuff stands out a lot more. Responsibly reporting the data leak issue in that mental health app, and being willing to reveal the data about the no fly list to someone (if it feels they're the right someone), that all seems pretty good to me.
hacktivists are just people who try to make the world better through hacking. There's no requirement that they never do anything else for any other reason, or that they only ever hack for a really good cause, or that they never take any pleasure in the recognition they get for their actions or in what they've accomplished.
What's even the point in looking down on someone for doing good things in order to gain a positive reputation? Isn't that something we hope people will do?
Snowden was a compromised asset of Russia, working for them. Most of what he released had nothing to do with his stated purpose. People have all kinds of reasons for doing that sort of thing. Sometimes they really believe in the other country, sometimes it's entirely selfish. We won't know even if he says something on the topic, since we can never know his mind, and he'd demonstrated that he's dishonest.
> Snowden was a compromised asset of Russia, working for them.
So Snowden was a Russian asset, who wanted to go against Russia by leaking information about a US surveillance program, and then after failing being a Russian asset, went back to Russia...??
I'm having a lot of trouble with this line of logic, can you point me to something credible on this?
I can 100% believe there was a selfish purpose, but this doesn't seem like it.
>>go against Russia by leaking information about a US surveillance program
The information Snowden leaked was in no way against Russia, it benefited Russia enormously.
Even the stuff that was on his claimed point created turmoil in the US to this day, which harms the US and only helps Russia
The other stuff he leaked helped Russia directly, and directly endangered and likely got killed US people and/or assets.
and of course he claimed his laptop was secure while he was in Hong Kong on his way to Russia. Anyone who thinks it stayed that way and he was allowed/invited to stay in Russia is a fool.
There is nothing he did that didn't harm the US and benefit Russia, and he was a very successful Russian op. the mere fact that it is still being debated here in the Us shows how successful it was, even if just a provocation/disinformation operation.
In an attempt to sound like he had noble reasons for leaking hundreds of thousands of unrelated secret documents to journalists, Snowden claimed it was watching James Clapper's congressional testimony in March 2013 that triggered him to start downloading and exfiltrating classified material.
This was a lie. He'd actually started collecting his trove of stolen documents many months prior, in mid-2012, coinciding with arguments with his managers. He had a grudge against his employers, and he acted upon it.
Snowden also never mentions that nation-state adversaries got all of this material too. The intelligence agencies of China and Russia must have been rubbing their hands in glee when he fled to them in quick succession. No wonder Russia continues to protect Snowden from being brought to justice in the US, from their point of view he did a stellar espionage job for them.
That's not the only bullshit from Snowden either. Even little things like his claimed $200k salary when it was actually closer to $100k-ish. He's a serial fabricator full of grandiose claims about himself and what he did.
I would like Snowden just as much even if his reason was "I was bored and just felt like fucking some shit up".
I also think this was likely good for the NSA. Their internal opsec and controls seem like they were terrible if they existed at all. Snowden was a wake-up call to do better, and hopefully that makes the US even more secure than it was before.
> Snowden claimed it was watching James Clapper's congressional testimony in March 2013 that triggered him to start downloading and exfiltrating classified material.
This was a lie. He'd actually started collecting his trove of stolen documents many months prior, in mid-2012,
Did he say that the lies to congress were what "triggered to him to start downloading", or was that what finally convinced him to take the truth to the public instead of continuing to bring his concerns to other people within the intelligence community? If I remember correctly, he'd been investigating what looked to him like an unconstitutional program for a while.
> coinciding with arguments with his managers. He had a grudge against his employers,
Nobody gives up their well paying job (while also making sure they'll never work in their field again), risks their life and their life with their loving partner, gives up their freedom, gives up ever seeing their family again, etc all because they get into an argument with their boss.
> Even little things like his claimed $200k salary when it was actually closer to $100k-ish.
That'd be a weird thing to lie about, but he has clarified that issue. According to him the $200,000 was his "career high" salary. He took paycuts at Booz Allen Hamilton in order to get closer to the material he wanted to access. He ended up making $122,000 a year, but that wasn't the most he'd ever made doing intelligence work. Is there some evidence that shows he never made $200,000?
There's no evidence that Snowden brought his supposed 'concerns' to anybody in his chain of command, prior to defecting to Russia. The documents he began stealing in 2012 weren't targeted towards the bulk data collection program - he exfiltrated whatever he could lay his hands on, which of the hundreds of thousands of items were mostly military secrets, and classified information on intelligence work abroad. The claim that this was all driven by watching Clapper testify in committee is a convenient lie, a cover-up for what he was really doing: a massive theft of secrets across the board.
Serial liars do often go back and 'clarify' their lies once called out, it's part of spinning a web of deception. Admitting any wrongdoing, as normal people might do, isn't on the agenda for people like Snowden, all puffed up and full of ego, living off their own bullshit.
Not only did he defect to Russia and enjoy being celebrated there, he also has many people in the US and allies lauding his espionage, filmmakers and journalists gushing over his narrative and airbrushing out inconvenient facts. What a series of accolades for a liar and thief. He seems to revel in this 'wise whistleblower-in-exile' act he's carved out for himself while remaining Putin's pet. This treacherous escapade worked out better than he ever could have imagined.
I think the point here is to expose the nofly list as an unethical and/or illegal government program by leaking it to journalists that can evaluate and summarize it's contents, not to help them secure it better.
White hat hacking assumes that the hacked party is doing normal or ethical business, and that helping them secure it would be generally beneficial.
Also, I'm pretty confident that Maia, as a famous hacker and cybersecurity expert, isn't going to be easily duped by someone impersonating a journalist, and knows how to verify such things.
after your comment, I looked at her main page more closely and found that she mentioned "it/she" in a superscript the middle of a paragraph, so that's what I corrected it to.
I do have to say that, while it's polite to use people's preferences, when just reading an article and posting a quick comment, it's pretty casual, and (almost always) no offense is meant, so none should be taken. Note that the bulk of the comments here are all over the map, and I'm sure no one means to be offensive.
The problem is to define "demonstrate" and the criteria. Remember the gatekeeper is now an unemployed gal who "know lot's of things about cyber security" according to her main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter...
Yes, security through obscurity isn't security, but this also seems incredibly irresponsible for any "security researcher". AFAIK, just basic standard good practice is to report the flaws and allow a reasonable interval before publishing, and there seems to be no hint of this.
Modern society really is held together with duct tape, baling twine, and a few pieces of bubble gum...
[EDIT: pronouns]