Why would they even care. There will be no consequences for getting caught.

Who said it was Russia?

The article only mentions a Russian IP.

so we would be busy arguing about the meaning, while they do something obviously terrible again

it's beautiful

You can ship a lot of things in a container, especially in air gapped environments, including very malicious things.

Not at all: it says DOGE appears to have created a container in a place where containers were never created by NLRB. Tell THAT to someone who doesn't know what Docker is, and it is less informative.

Where's the technical ignorance?

Editorialized by the reporter, not the original report.

From the email shown in the photo, it seems like DOGE was trying to build and run a docker container using Integuru (YC W24) https://news.ycombinator.com/item?id=41983409 to scrape the system

No it’s malicious

They intentionally turned off logging. Only attackers and criminals do that.

It's just docker containers. As a technical person I was confused reading that at least 3 times until I made the mental connection that it's docker containers. So yes you are right it's made to sound more opaque and nefarious than one would normally assume in our field. If they have a policy that says we can't run docker containers in network A or zone B then just say so but don't lie to make it sound like Russia Hackers. That's the kind of shit that makes fence sitters and reasonable people across the isle not trust your motives.

Anywho, this whole "opaque" or "untrusted" code running in a VM is the same lingo that big corporates use to gatekeep newer technologies that bypass traditional processes. E.g. "oh sorry you can't test locally because you need to use our officially licensed and expensive Oracle DB instance. Oh and BTW, you can't use the free container image that Oracle provides free of charge. It's running 'untrusted' code in our network." and endless variations of that.

This is a common refrain but logically empty. It implies, for example, that the minority deserves any hypothetical persecution by the majority simply for being fewer in number at the ballot box. Failing to convince the majority that your rights matter doesn't mean you deserve to be punished.

Hell no. A country in which the Citizens United decision is in effect is extremely less democratic than a country without such a corrupting influence in play.

"Now I think about it..." work on that some more going forward. The country is complicated and Democracy has grades. We're getting an F at the moment.

Ah yes, "democracy", voting once every 4 or 5 years and accepting whatever the government does because "we voted for them"... while disregarding 49% of the population (+ people who changed their mind) just "because". Some people have a really limited conception of democracy... You're electing representatives, not Lords and Kings lmao.

You're just a few steps away from a russian version of democracy if you define it so loosely in the first place

The “consensus” is built over more than a decade of misinformation

> so the people who didn't vote don't count

Democracy is about how the people (demos) in a state or other community coexist by negotiating their individual and collective needs and priorities. Reducing it down to "you didn't vote so you don't count", or worse still, "you voted for the losing side so you don't count" is a gross distortion. Its not just about the vote, its what happens after that.

> That's the beautiful thing about democracy, you get exactly the government that you deserve.

This makes no sense. There isn't something out there that renders a singular judgement on what people deserve. There's only us.

Maybe in a perfectly functioning democracy, but the U.S. has been actively separating policy from politics maybe for my entire lifetime. Just for starters:

* The two-party system dominates the process, and actively excludes 3rd parties. Look into changing requirements for debate participation.

* The Democratic party argued in court that they have no obligation to use a "fair" primary to select candidates. This was in response to a lawsuit from donors claiming the party mislead them by tipping the scales against Bernie Sanders in 2016.

* Gerrymandering continues to enable parties to win large majorities in state legislatures while losing the popular vote at the state level.

* Many of our current troubles have been caused by the Supreme Court, which is not democratically elected.

* The Electoral College and Senate apportionment continue to give more power to voters in low-population states.

> consensus

No, it wasn't. It was what about half voted for. There was no consensus. Consensus means general agreement, not a small majority.

That they're elected by majority (never mind the indirections) is a key reason why it is important that the executive is not allowed to wield too much power unilaterally.

(And a key reason why the executive in most countries have far less power than a US president...)

America doesn't live in a Democracy, it lives in a bipartisan and increasingly sectarian dissolution of Democracy originally based on gerrymandering, now based on establishing Unitary executive theory through force.

Red Team/Blue Team isn't Democracy, its Oligarchy with extra steps - self-evident by the recent actions of an ultra-wealthy elite to shape political decision-making in ways that increase their wealth.

You need only look as far as the inauguration of 47 to be slapped in the face by the audacity of it - flanked by the Railway Barons of Silicon Valley - Elon Musk, Jeff Bezos and Mark Zuckerberg - and bolstered by Tim Cook, Sam Altman, and Bernard Arnault.

Russian IPs are used, because russia won't help the american authorities with investigations. If I was an american and hacking into <whatever american thing>, I'd use russian IPs too.

Russian IPs were in the pool because it never occurred to them to check where these IPs were geo registered

What's the typical use case for a DOGE employee to have a Russian VPN setup on their work PC?

Totally an honest mistake! It’s ok because the stakes are really low; not like it’s the US government!

If the intent is to collect foreign IPs attempting login - you could block it down the chain. Lots of intelligence reasons to do this.

maybe to detect that the valid credentials are leaked / used in the wilds?

Auth providers (like Okta for example) often do the geo-blocking at level 7 -- because if you know the login being used, you can then lock the account that is being accessed from a blocked region.

If you block outright an adversary has reason to try another IP. If you allow the attempt then show a standard "login failed" page they have less information to go on.

So the default behavior of a Fortigate is to allow you to apply an access policy to the VPN tunnel itself, which can easily be a geoblock, but the local-in policy where the remote is actually authenticating against the firewall is much harder to change.

Not saying this is a Fortigate or that the federal government didn't change the low effort configuration, but it's certainly not unusual, Fortinet is a huge presence.

Not necessarily. One could have a gov site allowing anyone to view it, but have stricter rules on a /login path, HTTP POST, auth header, or it could have been blocked by some compny-wide safety layer that manages this stuff semi-automatically. But that's just a speculation.

Remember these are elons are script kiddie hackers, it only occurred to disable the outer firewall, azure ad will independently geoip block all by itself

Lets be honest: they are compromised. Musk is compromised. Trump is compromised. They are all traitors who are selling America out. It took almost four decades but Russia is winning the cold war after all, without firing a shot.

The article mentioned that traces of a few GitHub repos were found. One of the READMEs left behind described a tool used to create a multihop network to hide the original source.

Seems plausible that they could have used that tool when logging in and it happened to bounce off a Russian IP.

DOGE's mission isn't pentesting though, there's other federal agencies for that, like the article mentions, US-CERT operated by Homeland Security.

Homeland Security and co need to step in, but they're controlled by hostile agents.

> more than 20 such attempts

If I am testing a login I don't need 20+ failed attempts to know it's not working. Sometimes the simple answer is the correct one. The series of events does not read as someone, whose job has been reported to disable security and demand root access to systems, testing the already in place login system to make sure Russian IPs (specifically) can not log in.

This administration colluding with Russia? I feel like we tried to get people to care about that before.

What is interesting to me is how those two things are mixing. Theoretically any one of us could own a russian domain and any one of us could get a job at NLRB (or another gov agency) but our jobs and our ownership of that domain are two entirely separate things.

What's interesting here is how these two things are seemingly mixing. At this point I have two pet theories:

- One of the DOGE staffers is a Russian agent: This one I'm putting in the camp of "highly highly unlikely" but still possible given those login attempts from Russia.

- The more likely theory is this is just some braindead attempt to "own the libs". If we look back 6-8 years to when all the Trump Russia stuff came out and turned into a nothingburger. This could be some idea like: "Yo I've got this VM in Russia, let's own the libs and make them thin the Russians are invading again!"

There’s no limit. Everything Musk does can and will be given the benefit of the doubt.

It’s a matter of identity, he’s their guy and they stick to him through malpractice and treason.

There is an easy (but maybe incorrect) answer. People who give benefit of doubt in the face of obvious bullshit excuse are simply okay with alleged things happening. A stronger version of this claim is -- such people don't believe the bullshit excuse at all and want alleged things to happen.

But his suggestion that they're connecting from Russian IPs as a ploy to make the NLRB seem insecure with the plan of using that as a way to make it unable to prosecute cases, is that really giving them the benefit of the doubt?

Isn't that instead to suspect them of a nefarious plan to basically cripple labour law enforcement?

Or a botnet with thousands of infected US computers?

Right because they got caught before and the Supreme Court and the right side of the aisle bailed him out time and time again

If this was the case then Russia would also admit they did it. It's weird to not hide your IP, but still deny the hack on political level.

I'm not so sure. Look at the bargaining power in geopolitics a country gets, when they know a certain country hacked them (Dem. hacks, Clinton email hacks, by Russia). It is always better to hide your tracks or to blaim someone else. Especially if it can be done easily.

Why would a representative of a US government agency use a Russian VPN with legitimate, freshly created login credentials? I'm confident this is against all the cybersecurity rules in place.

I also don't understand why the HN comment section is full of people trying to make excuses or explanations.

Not really. I am not a doge supporter, but if was and I wanted to troll the left, I would route traffic through a rented vps with a Russian IP.

It’s possible to route traffic such that assuming the crypto is perfect, the actual vps is not able to decrypt data.

I also think that it I were a doge member and _wanted_ to leak data to Russia, this is the exact opposite of how I’d go about doing it.

Something worth knowing is that "attribution" is extremely difficult.

Also "attribution engineering" is really quite easy and difficult to see through.

Often the purpose of a hack is not to exfiltrate data or sabotage systems but is exactly to direct blame (or sometimes distract/misdirect)

Indeed in vault 5 of Snowden's NSA leaks an "attribution engineering toolkit" was a interesting find. Malware is almost always engineered to throw forensic investigators off the scent.

That all said, I think this incident happening in US gov, in the current climate, without immediate urgent investigation is scandalous and in itself an indicator of deeper and very serious skulduggery.

As a technical problem to correlate # bytes @ time is just a very simple and you don't need a PhD to solve. Its a matter of how many measurement points on the network you have available.

Having said that. I doubt they checked and who cares where it landed? Its out.

Occam's Razor on doge (and the admin as a whole) points to opportunist amateurs, fraternizing on bravado & loyalty while willing to entertain treason by jumping through hoops for why it can't bother them.

Looking for deeper layers is a distraction. Nostalgic even.

I can empathize.

The more concerning part is the use of valid username/password combinations. Unless they literally set this up as root/root (not...as implausible as it should be but from the description it seems unlikely) then how did they get them?

(and even if that is what happened, it goes back into "holy shit how did that happen?")

If one is using roaming, does it show the IP of locality they are actually in or the IP assigned to their home operator? I vaguely remember that it's the latter.

DOGE people were brand new to the infrastructure. (That's one of the criticisms - they're doing all this wild activity without really understanding the environment they're working in.) So they very plausibly would not know about the region-restricting firewall.

And then, they tried to get it shut off as soon as they found out it existed.

I'm pretty sure it's the other way around. This way is just stupid and borderline suicidal.

> at what point does it make sense to say “maybe you don’t deserve the benefit of the doubt”

Eh. June 2018.

I read that comment a steel man of the position that this is genuine anti-corruption activity, and pointing out via doing so that even if you give them an incredibly unwarranted amount of good faith, it still doesn’t make any remote amount of sense.

I'm pretty sure that was /s

We really need to come up with a commonly understood "sarcasm" character that doesn't also ruin the intended statement.

Yeah I've seen a few HN people try and defend undefensible things, citing they are "steelmanning"... but nobody asked them to. Same with "playing devil's advocate". It's fine in philosophical debates I suppose, but it's not necessary in a lot of cases.

Second, if you are the "playing devil's advocate" type, make sure your post contains your real, own, personal opinion. You can't just go say morally objectionable things and brush it off as that.

> the government can now disappear people to a gulag in El Salvador with no due process

To be wafer-thin fair to Trump et al, that was started by Bush with Guantanamo.

Musk is heavily anti Union. He’s running DOGE. They exfiltrated highly confidential data from the National Labor Relations Board, which oversees things like labor disputes.

This is all under the auspices of Trump, which is figuring out how to get away with ‘deporting’ US citizens to El Salvador without due process.

Connected the dots yet? How long do you think until union organizers are getting black-bagged in the middle of the night and disappeared to El Salvador? A month? Less?

Unless the stolen data is being used to compile lists of enemies of the state to send to the gulag. Like are any of these troublesome trade unionists immigrants? Time to send them to the gulag, solves two problems at one - that’s efficiency!

You think these aren't related? There are quotas to fill in El Salvador...

>>It's all terrible, but it pales in comparison to the fact that the government can now disappear people to a gulag in El Salvador

90% of people who were sent to the gulags survived and came back. This is much, much worse.

I could stand in the middle of 5th Avenue and shoot somebody and I wouldn't lose voters.

Yet he literally can't get existing laws to be policed and acted on by government officials. Hardly absolute power when judges brush off his work left right and center.

I’ve been noodling this argument ever since November, and I am pretty confident now that America has a fragile, asymmetric information economy.

Most Americans on the right live in a protected information market. I am not talking about media bias — both sides have that. The issue is deeper: on the right, the marketplace of ideas has been captured. There's no free trade between ideas, only ‘subsidized’ narratives and ‘tariffs’ on dissent. That’s how Trump — or anyone like him — thrives. Realists, by contrast, get priced out.

This isn’t culture war stuff, this is structural failure. The traditional metaphor of American free speech — the Holmesian "marketplace of ideas" — breaks down when one side captures the market.

There is no competition of ideas when there is no fair fight.

If you’ve got a couple of million bucks to spend, my guess is start buying up and supporting local news channels in the rust belt, and then let them work on whatever they want to work, as long as they can show actual independence.

Or perhaps gift people subscriptions to things like groundnews or something. I don’t know if theres any science that shows it effectively diversifies information consumption of its users.

I don’t know what the napkin math is for a tipping point, but I suspect its not as expensive as litigating an entire administration.

Russia and China run their goverment offices with their own Linux distributions for very long now.

That's why we have docx

apparently? JEDI and Wild and Stormy were two programs just from the DoD and NSA that were 20 billion USD.

AWS, Azure, Oracle, SUSE (via Rancher) and I am sure GCP all have confidential & classified (C/S/TS) clouds, as well as lower FedRAMP clouds to get that sweet sweet federal money.

Not sure what questions it raises, it has been a thing for decades.

What questions? All of the major cloud operators have government offerings too.

I mean, from a legal point of view?

It's pretty new, yes. The binding operational directive from CISA only came down in December. Agencies are in the midst of running the assessment tools and implementing the changes right now. See here: https://www.cisa.gov/news-events/directives/bod-25-01-implem....