• 0 Posts
  • 2.8K Comments
Joined 1 year ago
cake
Cake day: June 5th, 2024

help-circle





  • FOSS is certainly easier to audit, though there’s still a risk of malicious contributors introducing backdoors or other exploits.

    And just to be clear, there are groups within China who are relentlessly executing cyber-attacks against European and US assets. China’s not the only source, but it’s the biggest (at least based on what we’re seeing at my workplace, which includes a high-volume website). And nothing happens in China for long without the CCP’s approval. So, at least de facto, assume that’s in line with Chinese government policy.

    The best course of action is to never assume any third party is going to protect your data unless someone credible has independently confirmed it. Don’t buy internet-connected devices unless there’s a damned good reason for them to be connected, and even then, firewall the hell out of them and make sure there’s no path from such a device to your sensitive data. If you have a home LAN for your various connected devices, keep that stuff logically (and ideally physically) separate from your personal data.




  • The CLOUD Act is to allow data stored outside the US by US-based cloud providers to be accessed by selected foreign countries that have issued subpoenas and have requested US government assistance. It’s not a backdoor per se, and anyone with any sense encrypts their data before uploading it to the cloud instead of relying on cloud provider encryption services. Even if the US government weren’t snooping, there’s the risk that a cloud provider could be compromised by other hostile actors. Though it’s not all that wise to assume that cloud providers’ encryption services don’t have backdoors, unless that’s been confirmed by an impartial third-party audit. I know of no such audits.

    The PATRIOT Act is a human-rights nightmare for many reasons, but doesn’t grant the US government anti-privacy powers that the CLOUD Act doesn’t. It’s just more vaguely worded.

    And if you really want some worse Kafkaeque misery, FISA warrants will give you plenty if your or your firm’s name is on one.