@Edent Shopping around for a power company? Is this some sort of European joke that I’m too American to understand?

Everyone knows you get exactly one monopolistic nightmare of a company and you enjoy it.

@bagder Yeah, I do sometimes have that complaint especially when I watch their videos on things I don’t know as much about (eg physics).

Sometimes feels like detail for the sake of demonstrating that the problem is complex rather than detail for the sake of teaching the viewer.

@bagder I actually spent some time talking the writers of that video through the technical details of the backdoor, since they came across a lecture I gave about it just after it was discovered (if anyone wants more depth / less polish: https://youtu.be/Q6ovtLdSbEA).

I think their video is definitely a bit dramatic and geared towards a less technical (or at least less cyber-focused) audience, but was impressed with how much they cared about getting the minutiae right.

Realistically, most of their viewers won’t care about ifunc or dynamic linker audit hooks, but it does keep things interesting for the cyber folks watching.

@G33KatWork Cool to see this published, and pop up on my feed! I actually consulted with the writers of that video on the tech details of the backdoor.

If you’d like a much less polished (but more technical) explanation, I gave a lecture about a month after it happened: https://youtu.be/Q6ovtLdSbEA

@Sempf Not sure how I feel about the advice to “move away from traditional firewalls and vpns” in favor of “zero trust networking”.

Seems they base this advice in data showing many attacks start with VPNs, but isn’t that just because VPNs and firewalls are the only public-facing software on the network? Kinda like suggesting removing vault doors in a bank because “most thieves enter via the door” and “safety deposit boxes should be locked anyways”.

I’m not convinced that doing away with these technologies will make anything better, you’re just increasing attack surface.

Behind VPNs and firewalls we obviously should still aim for “zero trust” for depth of defense.