An Update on SolarWinds | Hacker News Reader

An Update on SolarWinds

blog.jetbrains.com

180 pointsingve28 comments

translation: "hell no, you are not throwing US under the bus for your idiocy!"

These stories JetBrains is defending against are sadly what passes as "Jounalism" in our society.

That's why the laws that protect them need to be either changed or revoked. JetBrains should have 100% legal ability to sue the New York Times for slander.

The UK had laws which were much more favorable to people who sue alleging slander or libel, and they caused significant problems which led to their being substantially changed.

https://en.m.wikipedia.org/wiki/English_defamation_law

Edit to note: the kinds of changes you’re suggesting seem great when the plaintiff is a small company suing the New York Times, but what about when a very large company sues a small newspaper or blog?

New York Times Co. v. Sullivan is the case that pretty much prevents that unless it is beyond blatant. A decision or law to tighten the scope that decision would probably improve the public discourse dramatically in an era where the correction never comes close to the distribution of the original lie.

NYT v Sullivan is only relevant to public officials - those holding or running for public office, which adds for them the requirement to prove 'actual malice.' In subsequent cases, the requirement has been expanded to employees of public officials as well as public figures - those who "achieve persistent fame and notoriety" and those who voluntarily engage in public controversy. In either case, the owners of a small company who have not voluntarily placed themselves in the public eye would be generally considered private individuals and thus the restriction on suing the media for defamation would not apply.

In lower courts there has developed some concept of an involuntary public figure. These are people who don't go out of their way to enter the public spotlight but who are involved in an event of overriding societal importance. So for example people being investigated by a government agency major crimes can't sue for defamation after being found not guilty. If JetBrains is actually under investigation then it's fair game, but if not it likely is still a private figure and this would be a pretty good example of a valid defamation case.

The problem is newspapers and journalists would be killed with a change in the law, and let TV "news" commentators like Tucker Carlson and Rachel Maddow to continue saying whatever they want.

The problem is that the line between news and commentary at this time is blurred. Hell; we can't even agree on what is true anymore just look no further than the election fraud claims made by the President of the United States.

I would be more sympathetic to newspapers and journalists if they were neutral observers, but as you say, the line between news and commentary is blurred and it seems everyone in media has picked a side. I think forcing these papers to do some basic fact checking would slow down the "must report first and damn the facts" mentality. The thinning or elimination of the fact checking people was the canary in the coal mine.

Not really, it would just put the onus of deciding the truth onto the court systems, which doesn't sound great. JetBrains can't prove they weren't the underlying vulnerability so I have a hard time seeing any world where they would be able to successfully sue The New York Times here.

If the NYT caused their valuation to crash then they have a case

Here is an update for January 8:

https://blog.jetbrains.com/blog/2021/01/08/january-8th-updat...

> Our IDEs are standalone tools and bear no relation to TeamCity, other than the fact that we use our own installation of TeamCity to build them.

It sort of seems like a compromised CI pipeline would allow an attacker to do all kinds of interesting things to your distributed binaries...

True, but it wasn't JetBrains's CI pipeline that was compromised.

But if they have a vulnerability that SolarWinds has not yet disclosed, they could very well be distributing compromised software.

Everything has a vulnerability that Solarwinds hasn't disclosed. What is the logic in focusing on this extremely unique choice? A plan by a government wants to spearfish developers at every enterprise software company to find 1+ ways in to their clients and should have chosen something universal. Without any apparent data, it seems more likely the suspicion is just speculation because it is less common than email clients, legacy browsers, dev-servers, common libraries, etc.

I.e. because no one else found this intruder the crap software that everyone uses must be safe?

Yes, but that’s a big if. It’s also simply possible that Solarwinds has their TeamCity admin account password set to ‘password’ and accessible on a public network.

... actually, SolarWinds used "solarwinds123" on their FTP site.

Which is stored on a publicly-accessible GitHub repository.

(Source: https://www.theregister.com/2020/12/16/solarwinds_github_pas...)

Right, and we don't know, which means we should audit aggressively and assume these things may still be open attack vectors. You don't hang out with the backdoor open waiting for your friend to let you know.

I guess that's why they said that they are auditing aggressively their CI tool.

We should, but we should have assumed CI software was an attack vector since before the solar winds hack. It’s always been a vector. This hack doesn’t change anything.

From the January 8 posting:

> we would like to inform you that we have proactively reached out and spoken to the US Department of Justice, and have offered them our full cooperation in this matter

So what exactly did the NYT and WSJ get wrong here?

They were implying that jetbrains was "in" on the hack.

Wrong. From NYT

>Officials are investigating whether the company, founded by three Russian engineers in the Czech Republic with research labs in Russia, was breached and used as a pathway for hackers to insert back doors into the software of an untold number of technology companies

NYTimes has updated their article since publication, based upon my re-reading of it.

I _think_ this was not so clearly stated, or was misstated as "A Russian Company", in an earlier version.

The caption for the image at the top of the page is:

> Officials are investigating whether a Russian company, based in the Czech Republic, was a pathway for Russian hackers to insert malware that would flow to a number of technology companies.

"An obscure Russian company," I think, was one of the earliest headlines.

Poor CEO, be dragged through this for nothing..

So whats the chance they got owned so hard that they dont even know they got owned?

Reply on news.ycombinator.com