Hacker News Reader

Comment by anotherevan | Hacker News Reader

Related: Mozilla may treat Aussie staff as 'insider threats' to code base

https://www.itnews.com.au/news/mozilla-may-treat-aussie-staf...

https://news.ycombinator.com/item?id=19243630

shouldn't all staff be treated as threats really? esp on projects with global impact(and hence global interest in compromising)

Don't know why this got downvoted; it's difficult and expensive to build systems that require multiple coordinated actors for critical changes, so few companies do, but that doesn't mean it's not a risk.

https://www.pcmag.com/news/366493/email-providers-servers-wi...

Given Yahoo's experience, yes.

The guy in charge of security and data access had a backbone and a reputation, so when somebody wanted a backdoor they simply went around him and got other people to hide it. (Which, of course, meant that the experts didn't review it and the thing was insecure.) I don't think Mozilla is wrong to treat Aus staff as a possible source for government privacy intrusion, but by that standard they really ought to view US (et al) employees as risks too.

Of course, the Yahoo compromise was allegedly approved by Marissa Meyer and corporate counsel. (Which suggests some ugly things about trusting behavior up the corporate ladder.) I guess that could mean Mozilla expects a US intrusion to show up at the executive level, while an Australian intrusion would be more likely to threaten random employees with legal consequences.

Yes. The number of cases were insiders were suspected or proven to be part of some issue is quite large. And this includes executives.

Yes. It was part of why certain assurance activities were in TCSEC at B3/A1 levels. It's why they had to model every behavior, every information flow, allow independent replication, and allow building from source locally. Leaves little room to hide backdoors.

https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Eval...

DO-178C also traces code to requirements to spot dead code or back doors.

Contents of the TOLA act in question: https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...

Reply on news.ycombinator.com