Hacker News Reader

Comment by ralph84 | Hacker News Reader

> FireEye is a reputable security organization that is publicly traded

So was RSA when they accepted $10 million from NSA to backdoor their crypto library. As long as FireEye keeps the customers who pay the bills happy they'll be fine, just like RSA was.

View on HN

It's hilarious to say that RSA were ever reputable - they were the butt of every insider infosec joke for decades.

We _knew_ at the time that Dual EC_DRBG was bad - there is an entire openssl mailing list archive from the moment it was announced/proposed talking about it being bad

FireEye / Mandiant are _the_ team within infosec who are experts in the field of attributing state threat actors - you won't find many experts who openly disagree with them

It could be that no one disagrees with them because they're always right. Another possibility is that there's only so much "attribution" business to go around, and the customer is always right. The very idea of worrying more about who walked in the open door than about closing the door is a sure sign that "politics" has taken over completely.

Given the fact their CEO is former USAF OIS and has handled this event magnificently using ethics and morals as a guide I seriously doubt they’re hiding anything. They discovered the biggest cyber espionage campaign in the 21st century. And took a few punches to the gut in the process. They are setting a model disclosure example. Unlike the other compromised organizations that won’t admit a damn thing until they’re seated in front a legislative board of inquiry or grand jury.

Reply on news.ycombinator.com